Netscape 8 May Give Green Light to Spyware
A new version of the Netscape Web browser is being criticized by spyware experts for failing to notify Web surfers when they're visiting Web sites that distribute the noxious monitoring programs.
Netscape 8's Trust Rating System, which warns users about insecure Web sites, gives a "green light" to Web sites that download spyware onto users' machines, according to Ben Edelman, a student at Harvard University Law School and an expert on spyware software.
An AOL spokesman on Wednesday denied that the new browser gives a pass to the questionable sites, but evidence viewed by eWEEK magazine suggests otherwise.
The critiques are the latest bump in the road for Netscape 8, which was released this month. It was patched almost immediately to cover a host of known holes in its code, which is based on the popular Firefox browser, and to fix a conflict with Microsoft's Internet Explorer browser.
America Online Inc. touted Netscape's advanced security features when it released the program May 19. The new browser was "designed for the millions of online users who are searching for a safer and better browser," a company news release said.
The Trust Ratings feature is a key part of the browser's security story. According to AOL, if a user visits a Web site using Netscape 8.0, the browser automatically checks to see whether the site is on a blacklist of suspected virus, scam or spyware sites, or on a "white list" of 150,000 Web sites deemed acceptable by digital certificate authority VeriSign Inc. and by TRUSTe, a nonprofit online privacy monitoring organization.
Spyware and adware distribution sites do not get "trusted" certification if they are on a list of sites maintained by anti-spyware vendor Aluria Software LLC, according to Andrew Weinstein, an AOL spokesman.
"If a company is on Aluria's list, it will not get the green, 'trusted' certification," Weinstein said.
"That is false," said Edelman, who provides screenshots of Netscape 8's "Trust Rating" System on his Web site.
The new browser gives a green "trusted" rating when it brings up www.hotbar.com, a Web site that distributes a program that adds graphical skins to Internet Explorer toolbars, in addition to a Hotbar toolbar and stealth monitoring software, Edelman claims.
A copy of the new browser downloaded and tested by eWEEK does confirm Edelman's claim: The green "trustworthy" symbol is displayed on the hotbar.com home page as well as on a page on the Hotbar site that attempts to download the software to users' machines.
A green "trusted" sign is also displayed on the download page at www.ABetterInternet.com, another Web site that downloads and installs monitoring software.
Hotbar and ABetterInternet are also listed as spyware on Aluria's Web site, casting doubt on AOL's claims that any companies on Aluria's list are blocked, too.
In theory, sites on Aluria's list should have a gray "unknown" or red "dangerous" sign, according to Weinstein.
Part of the problem with the rating system is its reliance on the work of partner organizations such as TRUSTe, whose assessments of trustworthiness are flawed, Edelman and others argue.
"If Netscape's list of trustworthy sites were perfect or even largely accurate, Netscape's new rating features could be of substantial assistance to users who don't otherwise know what sites to trust. But in fact Netscape has delegated its trust to partners whose trust endorsements are dubious at best," Edelman wrote in an article posted on his Web site.
For one thing, TRUSTe's list of trustworthy Web sites, which are allowed to display the TRUSTe seal, is a list of sites that adhere to that organization's strict information privacy practices. But the seal doesn't address the issue of software downloads, according to Fran Maier, executive director at TRUSTe.
"There are a lot of sites that download software. We can't say whether they're all spyware. It's just not clear to us," Maier said.
TRUSTe is aware of the concern about unauthorized downloads and spyware, Maier said, adding that there need to be clear industry standards about issues such as disclosure prior to installation and practices for installation and removal.
The organization is considering whether to develop a separate program to set guidelines about what constitutes "spyware-free" Web sites, but it hasn't yet committed to such a program.
"It's an obvious area of consumer concern," Maier said.
TRUSTe also forbids sites to display the organization's seal on pages that download the software, though that policy appears to have been broken, at least by HotBar.com, which clearly displays the TRUSTe logo on the installation page.
AOL is reviewing a list of spyware sites that are on TRUSTe's list of certified Web sites, Weinstein said.
TRUSTe is also open to feedback from Internet users and will pull certification for sites that violate its policies, Maier said.
Laws about what is and isn't acceptable practice for placing software on someone else's computer are murky at both the state and federal levels. A federal anti-spyware law is making its way through Congress.
Spyware-specific laws aside, however, Edelman said many of the practices used by spyware vendors probably violate established trespass and contract law and are clearly unethical.
"Spyware companies are putting software on your computer ? to make money and without getting your consent. It's not about what the law requires; you can just look at it and feel like 'this isn't right,'" he said. ?
