From Computer Business Review, a sister publication.
Digital signatures form a major plank of the ‘code-signing’ strategies being adopted by the major Internet browser companies (Microsoft with Explorer and Netscape with Navigator), and by Sun, the largest backer of the Java interpreted applet language. The investment is driven by what vendors claim is widespread concern over the possibility of getting a potentially malicious piece of code (in Microsoft’s words) off the Internet. If the idea of using and downloading software on an as-needed basis from repositories on a network or the Internet is to work, the user will want to be sure the copy really is authentic, claims Tom Carty, Director of GTE’s CyberTrust arm. Given that some Java applets have already been identified as possibly created with malevolent intent – though so far only in the sense of making the user’s PC make bear noises or such juvenilia – this is not so far-fetched.
By Gary Flood
Microsoft believes it is credible that a user could download code that, without warning, reformats a hard drive, or reboots the PC. On its Web site it highlights a piece of software that can do this (the Exploder control). Without knowing who published the code, the user wouldn’t have a way to contact or pursue recourse against the software publisher, it says. More sinister is the possibility that bona-fide products could be intercepted by meddlers, resulting in a legitimate spreadsheet prog ram trashing a user’s computer. In the event that this code had been tampered with, the user or software publisher wouldn’t know [this] had occurred. The solution may be to adopt the practice of software authors and publishers signing off their code or products with unique digital signatures. Microsoft has been quick to clai m competitive advantage over head-to-head browser rival Netscape by offering this service through a component of Explorer called Authenticode (although both Netscape and Sun are hot on its heels). Although few products carry such signatures today, Microsoft claims Authenticode can already search for a signature, verify it has not been interfered with, and if necessary block the transfer. Microsoft notes that this does not mean the code is perfect or bug-free; merely that there is a mechanism that offers the same degree of quality control to a customer over the Internet that buying shrink-wrap through the channel offers. Although some will be reassured, there is an undeniable ‘big brother’ aspect to this posture: We’re going to control what you can download. And is there a sub-text that only Microsoft-signed code is recommended? Acknowledging such concerns, Explorer does allow for the accessing of unsigned code, but the user has to give the OK first. Turning Authenticode off and letting all code be downloaded is, says Microsoft, allowed but not recommended under any circumstances. Tom Carty, director of electronic giant GTE’s digital signature division CyberTrust, perhaps not surprisingly, agrees with Microsoft’s stance. It could just as easily not be a software vendor’s latest product as a new novel being distributed electronically – where it’ll certainly be in the author’s interest to ensure people get the real thing, he contends. What is certain is that in the increasingly heated browser wars the issue of code signing is bound to become a bone of contention between Microsoft and Netscape as each seeks to out-compete the other.
