Site Sponsor:

mcafee_logo.gif
line

Now Available:

Featured Resource:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Dan or post a comment to the blog.

« Feds: We Need A Manhattan Project for Cybersecurity | Main | Passwords for Chocolate »

Paypal: Friends Don't Let Friends Surf with Unsafe Browsers

PayPal is fed up with phishing and they plan to prevent transactions originating in "unsafe" browsers. If you don't have a browser with anti-phishing measures or support for Extended Validation (EV) SSL certificates, don't expect to use PayPal much longer.

PayPal Chief Information Security Officer Michael Barrett was quoted by eWeek saying:


"In our view, letting users view the PayPal site on one of these browsers is equal to a car manufacturer allowing drivers to buy one of their vehicles without seat belts,"

If you are using an old version of IE, its time to upgrade. Apple Safari users can switch to Mozilla Firefox.

UPDATE: Safari users don't have to switch, from the Wall Street Journal:

Update: We just spoke to PayPal. It seems we in the media are reading too much into this. It will block people using old browsers and old operating systems, but contrary to many reports it will not block Apple's Safari browser.

This isn't just good for PayPal customers, it's good for business according to Barret:


"More or less all of the pages on our site are SSL encrypted, and they all use EV certificates. And after nine months of usage, [our] data suggests that there is a statistically significant change in user behavior. For example, we're seeing noticeably lower abandonment rates on sign-up flows for IE 7 users versus other browsers. We believe that this correlates closely to the user interface changes triggered by our use of EV certificates

This is some of the first positive news backed by presumably reliable data on anti-phishing. Some earlier studies have shown users ignoring warning signs about insecure sites. For more on how to protect against phishing attacks, see "Phishing Techniques and How to Protect Against Them" in the Essential Series, vol 2.

TrackBack

TrackBack URL for this entry:
http://www.realtime-websecurity.com/type/mt-tb.cgi/708

Post a comment

(All comments are approved by site leader before appearing here. Thanks for commenting!)

line

Dan Sullivan's Bio:

Dan Sullivan is a systems architect with 20 years of IT experience that includes engagements in enterprise security, application design, and systems architecture. His experience includes a broad range of industries, including financial services, manufacturing, government, retail, gas and oil production, power generation, and education. Dan’s security-related project work has ranged from requirements analysis for enterprise information security to designing and implementing security for database applications and enterprise portals. Dan has written about information security and other enterprise information management topics for Business Security Advisor, DM Review, Intelligent Enterprise, and E-Business Advisor. You can contact Dan at: dan_sullivan@realtimepublishers.net