Industry


Ads by TechWords

See your link here


Subscribe to our e-mail newsletters
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
More E-Mail Newsletters 
Preston Gralla's picture
Preston Gralla

Seeing Through Windows

Beware! "Trusted" sites often host spyware and scams

TRUSTe, which promises to help consumers by certifying only "trustworthy" Web sites as being safe, in fact certifies many sites that "that seek to scam users -- whether through spyware infections, spam, or other unsavory practices," according to well-known spyware researcher Ben Edelman.

More frightening still, TRUSTe-certified sites are twice as likely as non-TRUSTe-certified sites to host spyware or scams, Edelman found. Edelman examined more than 500,000 Web sites, and checked their safety using SiteAdvisor, whose robots check Web sites for spyware, and which uses other methods and test to check sites for spamming and other scams.

The results were startling: "Of the sites certified by TRUSTe, 5.4% are untrustworthy according to SiteAdvisor's data, compared with just 2.5% untrustworthy sites in the rest of the ISP's list. So TRUSTe-certified sites are more than twice as likely to be untrustworthy."

He cites several egregious examples, including Direct-revenue.com, which has been certified by TRUSTe even though it hosts spyware, and faces ligitation by the New York Attorney General and consumer class action suits, he says. Other TRUSTe-certified sites that host spyware, or engage in spam or scam are Funwebproduct.som, Maxmoohlah.com, and Webhancer.com, he claims.

The upshot? In essence, TRUSTe can't be trusted. If you see its seal on a site, consider staying away. Edelman recommends that TRUSTe establish solid rules against spyware and scams and then enforce them --- something he says that TRUSTe has yet to do.

Edelman, by the way is a Ph.D. candidate at the Department of Economics at Harvard University, a graduate of Harvard Law School, and has testified before Congress and elsewhere about spyware. He's probably the most authoritative expert on the planet about spyware. So you can trust him, even if TRUSTe isn't so trusty.

What People Are Saying

Edelman oozes sincerity for

Edelman oozes sincerity for the highest bidder yet again. This is nothing but an ad for SiteAdvisor.

SiteAdvisor is ADWARE itself! Once you install it, you get constant offers from McAfee to "upgrade" your protection by buying more McAfee products... ads you would not get without SiteAdvisor.

There might be an underlying truth to this TrustE issue, but when the source of this story is a piece of adware (SiteAdvisor) and its biggest shameless promotor (Edelman), who can tell?

I agree. Having read Preston

I agree. Having read Preston G.s stuff for a while I'm kind of surprised he just took Mr Edleman's word for it -- especially now that SiteAdvisor is just marketing tool in McAfees upsell strategy.
Also site advisors ratings aren't real time and don't always assess true threats.

As a neutral and casual

As a neutral and casual observer of this posting, I did take time to visit the blog.truste.org site suggested by Carolyn Hodge and I reviewed their "strict set of standards" and "processes".

I find it interesting that they do not address spyware except indirectly, as it may relate to "PII" (Personally Identifiable Information). There is no wording in their standards that includes the terms "spyware" or "malware". From this I am left to infer that they will in fact provide their certification to sites that include spyware or other malware.

Some accuse Ben Edelman of self interests but it sounds like TRUSTe is obfuscating the issue.

Thank you for raising that

Thank you for raising that issue Glenn,

I don't want anyone to be left with the impression that we knowingly certify companies which publish adware or trackware, and that we aren't taking steps to address the gap in our standards.

As you note, our web seal program does not address standards for software, a shortcoming we realized as part of the Anti-Spyware Coalition meetings in early 2005, when we stopped accepting applications from any websites which offered suspect software. We are closing the loophole by developing the Trusted Download program http://www.truste.org/trusteddownload.php We issued a full set of program requirements in November 2005 which include definitions for syware and also standards for consumer notice, choice and control. All applicants to any TRUSTe program which are adware or trackware will be required to submit thier software to be certified.

It isn't obfuscating, but it does take some effort to gain consensus from internet companies, consumer advocates, anti-spyware companies and download sites (CDT, AOL, Yahoo!, CA, Download.com, and others) to create standards that can be applied to intrusive and harmful behavior without proscribing helpful and respectful software.

TRUSTe agrees the program can't be launched fast enough, we are in an invitation-only testing period and expect to launch imminently.

I agree with Carolyn, and

I agree with Carolyn, and would add that Ben has an interest in promoting Site Advisor. It might be useful if people actually started digging into Ben's research, assumptions, and interests before simply regurgitating his latest post. Ben's out to promote Ben Edelman, Inc., and a lot of people in the Internet privacy field neither like him or want to work with him.

Whoa! You might be throwing

Whoa! You might be throwing the baby out with the bathwater. TRUSTe, and our 2400 certified sites, definately do not agree with Ben's conclusions. If you read the paper, and not just his blog posting, which I encourage folks to do before jumping on the bandwagon, you can see that his underlying data set is SiteAdvisor. A great tool for consumers, but a completely different criteria, methodology and program, than TRUSTe. Both approaches have thier strengths and shortcomings, but to say that you are likely to encounter spyware and scams on TRUSTe sites is flawed. For more on TRUSTe's position on this paper you can read here: blog.truste.org