Writing today because Firefox 3.5 has broken the download record for a new browser version with over 8 million downloads in a single day. One subject that has been the source online discussion is the fact that the EV certificates for a series of SSL brands (four that I know of) have stopped showing up green in Firefox 3.5.

You can be assured that this problem does not happen with the EV SSL Certificates from VeriSign, thawte, or http://www.geotrust.com/.

We're disappearing to an obscure corner of the world for a couple of weeks, and I don't think I'll be blogging. I'll let you know when I'm back in contact.

Gartner recommends that enterprises continue to deploy and improve security solutions that protect accounts and customers against attacks. Enterprises that are custodians of customer accounts should also consider site authentication or assurance to confirm to a customer that he or she is on a legitimate Web site and not a spoof site.

Gartner analyst Avivah Latan goes on to suggest a layered security approach as the best response to phishing.

I'm also tweeting, so follow me there. Again, I have a different vision for this medium. I often have immediate observations I want to make but don't have time to write up a full blog post or am not at a computer or both. I'm tweeting from my phone, so I can capture those immediate opportunities as they arrive. Again, I reserve the right to change my vision for this medium as time progresses.

It couldn't be easier.

1) Go to the awards voting page (http://www.socialsecurityawards.com/).

2) Read the instructions if you feel like it and then hit Next.

3) Fill in all three fields in the Corporate Security Blog entry as follows:
Blog name - Tim Callan's SSL Blog
Blog URL (homepage) - www.verisign.com/ssl-blog
Reason - He writes SSL poetry.

4) Click the Done button.

5) Relax. Take a load off. You deserve it.

That makes all the sense in the world. These fraudsters are trying to trick Internet users into giving away information or giving malware access to their systems. Originally it was a matter of spoofing someone's PayPal or bank account. As the users have gotten wiser (although these workhorse counterfeits are still happening in huge numbers) the attackers have constantly sought green fields. One consistent technique is to take the prospective victim out of the context in which he is looking for a scam. Your bank account is too suspicious? No problem. How about your utility bill or your favorite e-commerce site or your wireless phone service? Account lockout is too obvious? Okay, we can go with March Madness or tax filing or election fundraising or Halloween. We saw them with Katrina and Rita. We saw them with the tsunami.

This trend I'm sure will continue. We will continue to see tailored exploits using whatever is in the news this month.

The solution of course is to definitively know who is operating any given site. If all consumers were looking out for this information and if all sites were using something like EV SSL today, these techniques wouldn't work any more. Instead they're rife. They're growing.

So what do we need to do? It's really up to the sites. Over 70% of client systems on the Internet are enabled for EV today. That's a very high figure. While site adoption has grown very quickly as well, it's far behind client systems. Those organizations that make the rules for the sites can help drive this process. They can take their cue from the IRS and require EV on sites that ask consumers for information or that ask them to download applications, updates, or codecs.