Newer browsers have security features designed to help you determine if a website you are browsing is a valid and perhaps trusted site. While the intent is good, the messages users get can be confusing and fear-inducing for not really good reason. Let's see why.

The messages you can get include:

• This web site does not supply ownership information.
• Verified by: Thawte Consulting cc (or some other certificate agency) but with no ownership information.
• Verified by: Thawte Consulting cc (or some other certificate agency) with ownership information.

The latter two are generally accompanied by an https: start to the URL and the information in the message shown when you are on the site indicates the level of certification the owner of the site has applied to the site. That's really all there is to it: provide a secure URL and a security certificate and you get a "Verified by..." message; don't and you get a generic (and maybe worrysome) "...does not supply ownership information" message.

Of the three, only the last one has much meaning. To obtain the certification necessary to get the required EV SSL certificate the owner has to provide a good deal of proof of ownership information to the certifying authority (plus a good deal of money as well). Generally, only banks and other such institutions go to that trouble to convince the visiting user(s) of their authenticity (although this trend may be [and should be] changing).

Note: In any case, no matter how detailed the security certificate is, there is NO guarantee of no inappropriate or incorrect information on the site. The certificate only attests to the ownership of the site. Please keep this in mind as it's important to your interpretation of the various ownership warnings.

Let's look at each in turn in a bit more detail. [Screen shots below were taken using Firefox 3.5.1 and may differ some with your browser.]

This web site does not supply ownership information.

Taken from the CKnow site, this is what you are likely to see for most of the sites you visit. Is it bad? Not necessarily; it just means the owner of the site did not find it necessary to obtain a security certificate for the site. Since CKnow collects no personal information from you there really is no need for the site to have a security certificate or for you to have to undergo the overhead of a secure connection with the encryption/decryption routines at both ends of the connection. Most sites you visit will likely have this "warning" displayed by the browser.

Verified by: ... but with no ownership information.

Taken from the Google Mail site, this is what you are likely to see when you visit a site whose URL starts with "https:" instead of just "http:". If the URL and the certificate match it means that the site domain name as shown in the browser bar is accurate and that there is a valid security certificate for the site. Note that some small business sites use the certificate of the host for the site. That would mean that the certificate and the URL don't necessarily match so caution should be used at those sites but, even so, a mismatch does not necessarily mean anything is wrong. If concerned, contact the webmaster for the site and get confirmation from them directly. Further note that in an effort to appear valid some phishing sites have adopted SSL and have certificates issued to them so having a certificate of this type or not is no guarantee and you should be certain the site is who they say they are before entering any personally-identifying information or credit card data.

Verified by: ... with ownership information.

Taken from the site of an insurance/banking site often used by military members, the USAA certification provides an example of the EV certificate (EV = Extended Valuation). This simply means that they have gone through a rather extensive process to prove to the certifying authority that they are who they say they are. This is the best of the certifications but it's also harder to get and more expensive. Indeed, the expense is one of the reasons smaller businesses have used to lobby against the various ownership information displays. But, over time, the cost has come down and you should expect to see more serious business sites having this sort of certification instead of the more generic certification without ownership information.

But it bears repeating: No matter how detailed the security certificate is, there is NO guarantee of no inappropriate or incorrect information on the site. The certificate only attests to the ownership of the site.