Tomorrow is Earth Day, and in celebration VeriSign is kicking off our "Plant a Tree" promotion for EV SSL. Purchase a VeriSign Extended Validation SSL Certificate between Earth Day and May 22nd and you could grow your conversion rates at the same time you help grow new forests.

In honor of Earth Day 2010, VeriSign will plant a tree for every VeriSign EV SSL Certificate purchased between April 22nd and May 22nd. VeriSign has partnered with American Forests, a non-profit that works to protect, restore, and enhance the natural capital of plants and trees.

It's cool because online commerce is fundamentally a green technology. The more we can do our business online, the more we reduce printing and shipping paper...

I recently discovered the fantastic work PNC has done on its site to educate its users about secure online banking and use of financial services. This area of the site includes not just the standard basic advice but goes into truly deep content such as real examples of phishing e-mails, a place for customers to report fraud, and a detailed description of what green address bars (and other colors) mean on a site. Every site that...

A researcher has published an exploit that uses the SSL renegotiation attack to compromise Twitter logins. That appears to run counter to earlier assessments that this exploit wasn't aimed at the accounts of individuals accessing sites. So what's going on here, you ask?

This attack does indeed follow the parameters of the attack as previously described. It attaches exploit code to the encrypted stream and indeed cannot decrypt the data going to and from the site. What the inserted exploit code does is take advantage of a vulnerability in Twitter's API that allows it to command Twitter to publish the credentials of the currently active account. And of course the currently active account by definition is the same as the one operated by the site visitor who owns this...

Greetings from Las Vegas. Today we saw two presentations regarding attacks that affect the world of SSL. I'll give you a capsule summary of each and tell you how VeriSign certificates fit in. Lest this post become a tome, the summaries will have to be oversimplified. I'll strive to represent the subjects as accurately as I can.

First up was Moxie Marlinspike, detailing the latest additions to his sslstrip tool. The focus of this presentation was various ways to use null characters to fool browsers and other pieces of relying software into believing a certificate has been issued to a different domain than the one to which is was actually issued. The idea is that the attack would give the online criminal the ability to put up a certificate on what appears to be the exact same domain name as the targeted site. sslstrip accomplishes this feat through a Man-in-the-Middle attack and uses the null-character certificate to create its false certificates on the fly.

I'm...