Malware lurks behind safety seal

Sites handed the TRUSTe seal of approval are twice as likely to host malware or engage in spamming as those not endorsed by any security certificate, according to a study by spyware researcher Ben Edelman.

Edelman reached this conclusion after cross-referencing a sample of 500,000 top websites, as reported by a major ISP, that are endorsed by a TRUSTe certificate with data on untrustworthy sites, as listed by McAfee's SiteAdvisor service.

Of the sites certified by TRUSTe, 5.4 per cent are linked to either spamming or spyware, according to SiteAdvisor's data. This compares to just 2.5 per cent of sites in the rest of the ISP's list that SiteAdvisor categorises as unsavoury.

TRUSTe disputes these findings and takes issue with Edelman's methodology. "Saying that our sites are more untrustworthy is a stretch," TRUSTe marketing director Carolyn Hodge told vnunet.com.

The non-profit organisation runs a well-known website privacy scheme that allows sites to display its seal of approval providing TRUSTe approves of an organisation's privacy policy.

As Edelman points out, many reputable websites have bought into the scheme as a way of assuaging the privacy concerns of net users. The problem is that TRUSTe seals also feature prominently on various sites identified as unsavoury by SiteAdvisor. Edelman acknowledges that SiteAdvisor data isn't perfect, but argues "if SiteAdvisor says a site is bad news, while TRUSTe gives it a seal, most users are likely to side with SiteAdvisor".

He singles out four sites certified by TRUSTe as of January 2006 that enjoy a dubious reputation including: Direct-revenue.com, an adware purveyor that faces litigation by the New York Attorney General; Funwebproducts.com, whose toolbar allegedly appears in ads shown by other vendors' spyware; Maxmoolah.com, which sells email addresses to spammers, according to Edelman's tests; and Webhancer.com, which installs tracking software on surfer's PCs without their informed consent.

TRUSTe said FunWebProducts was listed as a member on its site in error while Direct Revenue and Maxmoolah no longer hold TRUSTe certifications. But Edelman argues that both organisations shouldn't have been allowed a privacy seal in the first place yet enjoyed the benefits of TRUSTe endorsement for months before it pulled their right to display its certificate.

Edelman acknowledges that establishing and enforcing a compliance regime is tough, but says TRUSTe is biased against turning applications down. "Hard-hitting rules are particularly unlikely when certification authorities get paid for each certification they issue - but get nothing for rejecting an applicant," he said.

"Consumers deserve certifications that are correctly issued in the first place - not merely revoked after months or years of notorious misbehaviour, and not mistakenly listed as having been issued when in fact they were not," he concludes, adding that there are problems with TRUSTe's approach beyond those involving the four sites he highlights. ®