Internet Explorer Authenticode
As downloading software over the Internet becomes more popular, the risk of infecting your computer (and your entire network) with a destructive virus becomes more real. Microsoft Internet Explorer now supports Authenticode – the ability to verify a program’s source before you download it. Authenticode enables you to identify who published the software before you start your download, and verify that no one tampered with it. No other browser combines the benefits of store-bought software confidence with downloadable software convenience.
Internet Explorer solves this problem! It enables developers to digitally sign their software code. This means you can verify the publisher of the software and that it hasn’t been tampered with during downloading. This information helps you decide whether you should download certain software over the Internet.
- How Digital Code Signing Works ?
Microsoft has been working with leading Certificate Authorities, such as VeriSign and GTE, to develop digital certificates for use with Microsoft’s Authenticode™ technology. These software publisher certificates are now available from VeriSign, with certificates from GTE and other certificate authorities to be available in the future. Software publishers are using these certificates to digitally sign their software code. If software has been digitally signed with these certificates, Internet Explorer can verify that the software originated from the named software publisher.
To see how this works, visit a site that has a slick demo or Java applet, or another software component that you need to download in order to view. If the component hasn’t been digitally signed, Internet Explorer displays the following dialog box, which asks whether you want to download unverified software.
If the software has been digitally signed, Internet Explorer displays a certificate. You can download this software with the same ease with which you pull a box of software off the shelf in your favorite retail computer store.
Tools for code-signing are available through the ActiveX™ SDK, and will be integrated into Microsoft and leading third-party development tools. Microsoft implementation of code-signing supports existing certificate standards, X.509 certificate format, and PKCS #7 signed data standards.