Copyright: Auric Visions Ltd, 2000


INTRODUCTION

Imagine a world in which buying, selling or interacting with the Internet is a worry free experience. Knowing that the current site is the correct site and has the proper level of security would be essential. Growl™ makes that world a reality by providing the necessary information to make informed decisions about which Websites to trust.

Where do I go now?

Traffic Light Indicator


SYSTEM REQUIREMENTS

486 66Mhz (Pentium recommended)

16 Meg RAM

Internet connection

Windows 95 * , Windows 98, Windows 98SE, Windows ME, Windows NT4 (Service Pack 3 or higher), Windows 2000

Growl™ requires the following web browser to be installed:
Internet Explorer 5.0 or above.

 * Winsock 2 is required to run  Growl in Windows 95. Winsock 2 is a free upgrade made available by Microsoft. You can download Winsock 2 by following this link -

www.microsoft.com/windows95/downloads/contents/WUAdminTools/S_WUNetworkingTools/W95Sockets2/Default.asp

You are strongly advised to set your browser to check for new versions on each visit to a web page.

If you're using in a system which accesses the internet via a firewall or proxy, ports 7045 and 7046 need to be set to allow direct access to the Assessment  Server on SER-UK2.SecurityandStandards.Com

See How do I refresh the communications rating for information on how to do this.


REGISTRATION

In order to use Growl™, it is necessary to create a user account with Security & Standards.  Unless during the installation you selected  "I already have an account for the use of Growl", then at the end of the installation your web browser is directed to the registration page.

NB: If for any reason you have still not registered for your free Growl account after having finished installing you may visit http://www.securityandstandards.com/registergrowl.html and register now.

The user account is created as follows:

Enter your personal details into the web form and click the "Send" button.

Following registration via the Website you will be sent an e-mail containing a customer ID and password. Keep a copy of this message. When first run, Growl™ you will require this customer ID and password.

Note: It may take a few minutes to complete the distribution of the registration details to enable your use of the Growl servers.

Only once this registration process is complete will you be able to run Growl.

Where do I go now:

First Run


Installation
INSTALLING GROWL™

Before continuing check the minimum system requirements and quit all other applications.

Where do I go now?

CD-ROM Install

Download Install


CD-ROM INSTALL

Before continuing, check the minimum system requirements and quit all other applications.

Insert the Growl™ CD-ROM. If the CD welcome screen does not appear, go to START and RUN and enter D:\setup.exe where D is the CD-ROM drive letter.

Click on the "install" button. The Wise Installation Wizard will guide you through the following steps of the set up process.

"Software Licence Agreement"

The Software Licence Agreement must be accepted in order to install Growl™. Read this agreement carefully!

"Select Destination Folder"

To select a different folder where the Growl software is to be installed,  click "Browse" and select a suitable folder or simply type in the path. Click "OK" to continue the installation.

"Indicate Account Already Set Up"

Click on the check box if you already have an account set up for the use of Growl.  Checking this box will cause the the registration procedure at the end of installation to be skipped.

Click "OK" to continue the installation.

"Ready to Install!"

Click "Next" in this menu to install Growl™. Click the "Cancel" button to abort the installation.

"Installation Completed!"

Click the "Finish" button to close the Wise Installation Wizard.

Registration

Complete the registration process before continuing.

Where do I go now?

Registration


DOWNLOAD INSTALL

Before continuing, check the minimum system requirements and quit all other applications.

Double click the downloaded file. The Wise Installation Wizard will guide you through the following steps of the set up process.

"Software Licence Agreement"

The Software Licence Agreement must be accepted in order to install Growl™. Read this agreement carefully!

"Select Destination Folder"

To select a different folder where the Growl software is to be installed,  click "Browse" and select a suitable folder or simply type in the path. Click "OK" to continue the installation.

"Indicate Account Already Set Up"

Click on the check box if you already have an account set up for the use of Growl.  Checking this box will cause the the registration procedure at the end of installation to be skipped.

Click "OK" to continue the installation.

"Ready to Install!"

Click "Next" in this menu to install Growl™. Click the "Cancel" button to abort the installation.

"Installation Completed!"

Click the "Finish" button to close the Wise Installation Wizard.

Registration

Complete the registration process before continuing.

Where do I go now?

Registration


First Run
STARTING GROWL™ FOR THE FIRST TIME

•	Before running Growl for the first time ensure you are connected to the Internet

•	To run Growl click on the Growl icon on your desktop. Alternatively, select Growl from the Security & Standards group under Programs group through the windows Start button.

Note: Growl will automatically run your normal browser for you, with the added security of Growl technology. If you run your browser directly it will not have this added protection.

•	Enter the Customer ID and Password as provided through registration.

•	Click the Test Registration button. If the indicator to the right of the "Test Password" button turns red the test has failed. If the indicator turns green the test has succeeded.

•	If the test fails check that you are properly connected to the Internet and that the Customer Number and Password have been entered correctly. It is also suggested that you wait a few minutes before retrying to ensure that the registration details have been distributed to the Growl server. Should the test continue to fail contact support.

•	If the test succeeds click the continue button.

Where do I go now?

Traffic Light Indicator


MANUAL ACCESS TO VIEW A RATING

The Traffic Light Indicator will be blank if there is no current active communication.  Click refresh in the browser to force access to the current site.

Where do I go now?

Get a rating each time I visit a site?

Assessment Rating


Know the web site I'm visiting is secure/insecure?
HOW DO I KNOW THAT THE WEBSITE I AM VISITING IS SECURE/INSECURE?

The Traffic Light Indicator, visible in all views, provides a quick indication of how secure the current Website is.

Where do I go now?

Assessment Rating

 Traffic Light Indicator


How do I find out who is responsible for a site?
HOW DO I FIND OUT WHO IS RESPONSIBLE FOR A WEBSITE?

•	Click Maximised View on the View menu.

•	Click the "Site ID" tab.

•	The name of the organisation responsible for the site is listed in the main window.


Find out what payment methods are acceptable?
HOW DO I FIND OUT WHAT PAYMENT METHODS ARE ACCEPTABLE?

•	Click Maximised View on the View menu.

•	Acceptable payment methods are listed underneath the main window.


know what associations a web site belongs to?
HOW DO I FIND OUT WHAT ASSOCIATIONS A WEBSITE BELONGS TO?

•	Click Maximised View on the View menu.

•	The associations that the current site belongs to are listed under payment methods at the bottom of the window.


know where the site originates from?
HOW DO I KNOW WHERE THE SITE ORIGINATES FROM?

•	Click Maximised View on the View menu.

•	Click the "Site ID" tab.

•	The location of the organisation responsible for the site is displayed in the main window.


Stop the minimised view opening?
HOW DO I STOP GROWL™ OPENING THE MINIMISED VIEW WHEN I VISIT A SECURE WEBSITE?

•	On the "Options" menu click "Settings".

•	Select the "Application Settings" tab.

•	Uncheck the "Automatic Toggle" box.


Working with Growl
WORKING WITH GROWL™

Through the System Tray View, Minimised View and Maximised View it is possible to access information about the origins, identity and security of a website. This in-depth information supports the quick indication of site security provided by the Traffic Light Indicator. This type of information can be crucial to referencing research and making decisions regarding where to spend money.


SYSTEM TRAY VIEW

The Growl™ icon in the Windows System Tray provides a simple, unobtrusive assessment of the current security rating. In order to open the Minimised View simply double click the icon.

NB: By default the Minimised View opens automatically when a secure site is opened.

Where do I go now?

Traffic Light Indicator

Stop the minimised view opening?


MINIMISED VIEW

Shows the full Traffic Light Indicator and allows access to the Growl™ menus.

The other important features of this view are:

•	 Traffic Light Indicator

Instant visual display of the current security rating.

•	 Server Name Display

Shows the server name for the current site on which the security rating is based.

NB: If the site is hosted on several computers the name of the most recently accessed server will be displayed.


MAXIMISED VIEW

Provides a tabbed display for the last 10 secure web sites visited during the current Growl™ session. The most recently accessed server is at the front of this display.

Click on the image below for more information.


RATING TAB

Displays the status of each individual Rating Factor. Like Traffic Light Indicator, red, amber and green indicate the status of each factor.

Where do I go now?

Assessment Rating


SITE ID TAB

Presents the following information:

•	The name of the organisation responsible for the Website.

•	The location of the organisation.

•	The name of the server hosting the site.

•	Any other available information about the site.

This information is taken from the site's Certificate.


SECURITY TAB

Presents the following information about the security applied when accessing this site

•	The certification authority issuing the site identification certificate.

•	A brief description of the encryption employed on the site.


TRAFFIC LIGHT INDICATOR

The main feature of Growl™ is the Traffic Light Indicator. This provides a visual indication of the current security rating. Each colour represents a different rating.

•	Green

Secure according to Assessment Criteria

•	Amber

Users should be aware that the security of Web-site with this rating has elements that may require further investigation. Select Maximised View for further information.

•	Red

               Not secured.

NB: The Traffic Light Indicator will be blank if there is currently no active communication.  Click refresh in the browser to refresh communications to the current site.

Where do I go now?

Assessment Rating

Setting Assessment Criteria

Maximised View

Minimised View

System Tray View


Customising Growl
CUSTOMISING GROWL™

Using the Setting Assessment Criteria, Setting User Details and Application Settings windows, it is possible to fine tune Growl™ to reflect the preferences of the user or system administrator.


ASSESSMENT RATING

The Assessment rating that is displayed by the Traffic Light Indicator is derived from the Rating Factors for the most recent site plus the Rating for the current communications.

The Assessment Rating is defined by the weakest Rating Factor. For example if any factor is red the overall Assessment Rating will also be red.

Where do I go Now?

Rating Factors

Setting Assessment Criteria


RATING FACTORS

In order to provide an accurate assessment rating, individual aspects of the site are measured for security.  These factors contribute to the overall Assessment Rating of the current site.

NB: The Maximised View includes a history of rating information for sites previously accessed.

The Rating Factors included in the overall rating are:

Certificate Validity Check

Certificate Revocation Is Checked

Encryption

Associations

Country Code Match

Certificate URL Match

Communications Rating

NB:Communications Rating differs from all the other rating factors in that it is not related to the current site. Instead this refers to all communications since the browser was directed at a new site as indicated in the address bar.


CERTIFICATE VALIDITY CHECK

Growl™ checks the validity of the certificate being used to identify the site. Due to the fact that an invalid certificate is a high security risk, a failed certificate validity check will always return a red rating. There are therefore no user-defined settings for this Rating Factor. If the certificate is not valid, a red rating is displayed with the appropriate warning.  These warnings include:

•	Certificate Revoked:
The authority issuing the certificate has revoked use of this certificate.  This may indicate that the security of this site or its certificate has been violated.

•	Certificate Not Yet Valid:
The certificate issued for this site has not yet come into effect.

•	Certificate Expired:
A certificate is being used after its expiry date.

•	Certificate Authority has expired:
The Certification Authority which issued this certificate used a certificate signing key which is no longer valid.

More info

Certificates

Certificate Revocation is Checked


CERTIFICATE REVOCATION IS CHECKED

Growl™ checks whether the certificate used to identify a site has been revoked. Not all certification authorities make their certificate revocation lists available however.  The fact that this information is not publicly available can be considered a risk.  If the user considers this to be a significant risk, it can be included in the overall rating. The rating tab in the Maximised View indicates whether a Certificate Revocation Check has been carried out via the following messages:

•	Certificate revocation checked:
Certificate revocation list is publicly available and has been used to check this site's certificate.

•	Certificate revocation not checked:
Certificate revocation list is not publicly available and so no check can be made on this site's certificate status.

The available assessment criteria settings for this factor are:

•	Revocation status unknown:
If selected the revocation state of the certificate need not be checked to get the green / amber rating.

•	Certificate with revocation check:
If selected the certificate revocation list has to be available to achieve the green / amber rating.

More info

Setting Assessment Criteria

Certificates


ENCRYPTION

A significant factor in the strength of protection applied to a site is the length of the Encryption key. Longer key lengths make the encryption harder for hackers to break. Select the longest key lengths available in order to apply the most stringent security standards.

NB: Further details of the encryption employed on a site are given in the Maximised View under the "Security" tab.

A number of sites initially use low strength encryption (e.g. 40 bit) and then switch to high strength (e.g. 128 bit) encryption based on an authorisation code included in the site's certificate. This is necessary because of export controls applied to encryption in the late 1990's. The capability of a site to switch from low to high strength encryption is called Server Gated Cryptography (SGC).

The strength of encryption is indicated by the following ratings:

•	Encryption provides little or no protection: A null or very weak encryption algorithm is employed.

•	xx bit encryption: xx indicates the number of bits used in the encryption key.

•	Strong encryption using SGC: The site is enabled to switch to strong encryption using Server Gated Cryptography.

The available assessment criteria settings for this factor are:

•	Key length is at least 40: The key length must be at least 40 bit to get the green / amber rating.

•	Key length is at least 128: The key length must be at least 128 bit, or the site must employ server gated cryptography, to achieve the green / amber rating.

Where do I go now?

Setting Assessment Criteria


ASSOCIATIONS

Depending upon their business, Website may choose to be endorsed by particular associations or interest groups. The Growl servers hold information on the associations to which the site belongs. In particular, for Growl™ we have collected together databases of sites that are part of recognised trust schemes for web sites. Membership of such trust schemes indicates that the site applies the code of practice required by that trust scheme.

Note: Growl only provides information on associations for secured sites whose identity is authenticated. It does not validate that an insecure site is a member of an association or trust scheme.

Icons shown in the Maximised View indicate the associations to which a site belongs. Membership of associations can be employed as a rating factor. These can be selected in Setting Assessment Criteria.

Where associations are included in the assessment criteria, the rating indicates whether this requirement is met as follows:

•	Member of required association(s):
The site is a member of the association(s) selected by the user as part of the assessment criteria.

NB: the icons present in the association bar indicate the association to which the site belongs.

•	Not a member of required association(s):
The site is not a member of the association(s), which are required by the user's assessment criteria.

Associations can be included in the assessment criteria by selecting an available association and clicking on [image] to add it to the required list. Similarly, a site can be removed from the required list by clicking on [image].

More Info

Setting Assessment Criteria


COUNTRY CODE MATCH

The URL of a Website often gives an indication to the nationality of the business that runs the Website. E.G. the top level domain ".co.uk" indicates that the Website in question is a UK based enterprise. Growl™ checks this against the information supplied in the security certificate.  During this process alternative conventions used for some countries are taken into account (For example, GB and UK are considered equivalent).

NB: URL stands for Uniform Resource Locator, the address information used to identify a Website and pages of information within a site (https://www.sell1.co.uk/page1.html).

This rating indicates whether a country code in the site URL matches that in the certificate:

•	Country Code Match:
Where a country code is included in the URL it matches the country indicated in the certificate.

•	Country Code Mismatch:
Where a country code is included in the URL it does NOT match the country indicated in the certificate.

The available assessment criteria settings for this factor are:

•	Doesn't matter:
If selected the country code in the URL doesn't have to match that in the certificate to get the green / amber rating.

•	Must match URL:
If selected the country code in the URL must match that in the certificate to get the green / amber rating.

More info

Setting Assessment Criteria


CERTIFICATE URL MATCH

Growl™ checks the name of the site recorded in the security certificate against that included in the URL of the page being accessed. For example, the web page https://www.sellerco.co.uk/page1.html should have the URL www.sellerco.co.uk recorded in its certificate.

NB: URL stands for Uniform Resource Locator, the address information used to identify a Website and the pages of information within a site e.g. sellerco.

In a number of cases, the name is related but does not exactly match that in the certificate e.g. secure.sellerco.com rather than www.sellerco.co.uk.  Fuzzy Matching allows names that contain small deviations to be passed.

The rating indicates whether a site name in the URL matches that in the certificate:

•	URL Exact Match:
The site name in the URL matches the site name included in the certificate.

•	URL Mismatch:
The site name in the URL does not match the site name included in the certificate.

•	URL Fuzzy Match:
The site name in the URL approximately matches the site name included in the certificate.

The available assessment criteria settings for this factor are:

•	Doesn't matter:
If selected, the site name in the URL doesn't have to match that in the certificate to get the green / amber rating;

•	Must match URL:
If selected, the site name in the URL must match that in the certificate to get the green / amber rating;

•	Allow fuzzy match:
If selected, the site name in the URL must have a close match to that in the certificate to get the green / amber rating.

More info

Setting Assessment Criteria


COMMUNICATIONS RATING

This indicates whether all, some or none of the current communications are secured using the SSL security protocol.

This differs from all other Rating Factors in that it is not related to the most recent site accessed and instead applies to all communications since the browser was directed at the site indicated in the address bar.  This factor is shown at the bottom of the Maximised View.

There are no user controls for this rating factor. Red indicates no secured communications, Amber indicates mixed secure and non-secured communications and Green indicates all secure communications.


SETTING ASSESSMENT CRITERIA

Using this window it is possible to change the standards of security which have to be met in order to attain an amber or green rating. This is done by selecting Rating Factors that must be satisfied in order to achieve the desired rating.

•	On the options menu, click Settings.

•	Select the Assessment Criteria tab.

•	Select the rating to set by clicking either the Go Amber if or Go Green if tab.

•	Select the Rating Factors to be included in the Assessment Rating.

•	Click the Close – Saves Changes button in order to apply the changes made.

Click on "Restore Assessment Details" to restore the assessment criteria to the default settings for  Growl.

NB: The change in settings will apply to the Assessment Rating of all subsequent sites but not to sites already visited.

Click on the image below for more information.


HOW DO I CHANGE THE AMBER RATING?

•	On the Options menu click Settings.

•	Select the Assessment Criteria tab.

•	Click the Go Amber If tab.

•	Select from the available options then click the Close – Saves Changes tab to apply the choices.

Where do I go now?

Assessment Rating

Setting Assessment Criteria


HOW DO I CHANGE THE GREEN RATING?

•	On the Options menu click Settings.

•	Select the Assessment Criteria tab.

•	Click the Go Green If tab.

•	Select from the available options then click the Close – Saves Changes tab to apply the choices.

Where do I go now?

Assessment Rating

Setting Assessment Criteria


HOW DO I ADD AN ASSOCIATION TO THE REQUIRED LIST?

•	On the Options menu click Settings.

•	Select the Assessment Criteria tab.

•	Click the Go Amber If or the Go Green If tab.

•	Select the association to add.

•	Click [image].

•	Click the Close – Saves Changes tab to apply the choices.

Where do I go now?

Associations


How do I remove an association from the required l
HOW DO I REMOVE AN ASSOCIATION TO THE REQUIRED LIST?

•	On the Options menu click Settings.

•	Select the Assessment Criteria tab.

•	Click the Go Amber If or the Go Green If tab.

•	Select the association to remove.

•	Click [image].

•	Click the Close – saves changes tab to apply the choices.

Where do I go now?

Associations


Change the associated browser?
HOW DO I CHANGE THE BROWSER WHICH GROWL™ USES?

•	On the Options menu click Settings.

•	Select the Application Settings tab.

•	Click the [image] button and navigate to the .exe of the preferred browser or type the path into the Primary Browser box.


SECURITY CONCEPTS

Growl™ builds on the security mechanisms already widely employed in web security. These mechanisms are then used to provide information that allows the user to assess the security of the current access in a way that is easily understood.

These security mechanisms are not generally visible to the user but are essential to achieving secure web access.

Firstly, if the access from the user's web browser to the web server is secured, the security protection is applied using a standard protocol called Secure Socket Layer (SSL).

SSL includes the main functions that are important in accessing a remote site securely:

•	It authenticates the identity of the site, using a certificate, which confirms the name and other information about a site.

•	Using encryption, SSL hides all data as it passes over public network in order to stop snooping.

Because of restrictions on the export of strong cryptography (e.g. 128 bit) in the late 1990's, both Microsoft and Netscape defined extensions to SSL which allow only authorised sites to switch from weak to strong encryption.  Both extensions are based on the same principal. This is called "Server Gated Cryptography".

More info

Certificates

Secure Socket Layer (SSL)

Encryption


SSL OVERVIEW

The security of web access is based on a standard protocol called Secure Socket Layer (SSL).  This was initially defined by Netscape but has since been adopted by all other major web browsers and servers, including Microsoft Internet Explorer.

SSL includes:

•	Authentication mechanisms to check the identity of the web server being accessed.  This is based on the uses of a Certificate that binds an identity to a key used to prove that identity.

•	Encryption mechanisms which hide any data passing between the user's web browser and the web server.

The first version to be widely used (SSL v.2), has been replaced on most sites and all but the oldest browsers by SSL v.3.0.  More recently, a standardised version of SSL (SSL v.3.1) has been published by the Internet Engineering Task Force (RFC 2246) with the title "Transport Layer Security" (TLS).  SSL v.2 has some minor security weaknesses that were corrected by SSL v3.0.  SSL v.3.1 includes further strength improvements.  Generally, all versions provide the same protection levels.  Sites using SSL v.2 should be treated with caution, more because use of an old version of SSL code indicates lack of attention to security rather than weaknesses in the protection per-se.  Many sites have yet to upgrade from SSL v.3.0 to SSL v.3.1 (TLS), however, this should not be a matter of major concern to most users.

Growl™ works with all versions of SSL.


CERTIFICATES

A digital certificate, as used in SSL, is an electronic statement, issued by a trusted "Certification Authority", which indicates that a given key belongs to an identified web server.  The key contained in the certificate is used in SSL to authenticate the web server.

The certified identity included in an SSL digital certificate generally includes information about the organisation responsible for operating the site, the location of the organisation and the name of the Website.  This information is displayed in Growl™ Site ID tab in the Maximised View.

The strength of authentication in SSL depends to a large degree on the procedures of the Certification Authority and in particular the checks carried out when the organisation registers for its certificate.  A certification authority generally publishes its practices, including registration checks, in its Certification Practice Statement.  The Growl™ Security tab includes information on the Certification Authority and a link to its practice statement.

If the security of a site's authentication key is compromised, or for some other reason the information in the certificate is considered to be invalid, an SSL certificate may be revoked by the Certification Authority.  Generally, Certification Authorities publish lists of revoked certificates in a Certificate Revocation List.  Growl™ checks this list to ensure that a site's certificate is still valid when it is being accessed. The Growl™ Rating takes into account whether a Certificate Revocation List is available from the issuing CA, and if such a list exists, whether the site's certificate is revoked.


SERVER GATED CRYPTOGRAPHY

Because of restrictions on the export of strong cryptography (e.g. 128 bit) in the late 1990's, both Microsoft and Netscape defined extensions to SSL which allow only authorised sites to switch from weak to strong encryption.  Both extensions are based on the same principal called "Server Gated Cryptography" (SGC).

The capability of a site to switch to strong cryptography is indicated by a special code within the site's certificate.  If a site certificate indicates that SGC is supported, Growl™ indicates this in the Encryption Rating.


SUPPORT

Please report all issues, providing a full description of the problem to:

support@secstan.com


Get a rating each time I visit a site?
HOW DO I REFRESH THE COMMUNICATIONS RATING EACH TIME I VISIT A SITE?

In order to ensure that the communications rating is refreshed each time a site is visited

•	In Internet Explorer, click Internet Options on the Tools menu.

•	Select the General tab, click the settings button, select   Every visit to page.


How to customise Growl
HOW TO CUSTOMISE GROWL™

On the Options menu, click Application Settings.

Where do I go now?

Application Settings

Setting Assessment Criteria


SETTING USER DETAILS

The information recorded in this area could be used in to help provide additional services to the user in future versions of Growl™. For instance, the country where user is located could be used to provide consumer advice relevant to the users location. Click on Restore User Defaults to restore the user details to the defaults for the user's system.

•	On the options menu, click Settings.

•	Select the User Details tab.

•	 Update information as necessary.


APPLICATION SETTINGS

Using this tab it is possible to change the browser Growl™ uses and stop the Minimised View from opening when visiting a secure site in System Tray View.

•	On the options menu, click Settings.

•	Select the Application Settings tab.

•	Change the options as required.

•	Click the Close – Saves Changes button in order to apply the changes made.

More info

Change the associated browser?

Stop the minimised view opening?


End User Licence Agreement
CONTRACT INFORMATION AND LICENCE TERMS

for GROWL

PART A – CONTRACT INFORMATION

Before you use any of our products you will be asked to agree our Licence Terms (see below). If you do so, you will enter into a contract with us at that point in time.

Before you enter into a contract with us, it is important that you have the following information.

Who We Are:	We are Security & Standards Limited, a company incorporated in England and Wales under Company Number 03908404. Our registered office is at 18 Harmont House, 20 Harley Street, London W1G 9PH.

“Growl” is a trade mark that we use in the course of our business.

Our Products:	A description of our “Growl” software product can be found on the Our Products part of this website.

Delivery Costs:	We do not charge you delivery costs for our downloaded products.  You may, however, be charged by your Internet Service Provider (ISP) or telephone operator in the normal way for the telephone charges that you incur whilst downloading any software from our website. If our products are supplied on to you on CD-ROMS or other recorded media that are provided free with any magazines or newspapers, you may be charged by the retailer for the magazines or newspapers in question.

Delivery and Performance:	As noted above, our “Growl” product will initially only be available by downloading it from our website at www.securityandstandards.com, or it will be supplied free with magazines or newspapers.  We do not supply boxed products.  The commencement of our services – your right to use a copy of our software – will be begin when you have completed the registration process for the “Growl” product.

Cancellation Right:	You are granted no express cancellation rights in relation to our free Growl products, as you can cease using it at any time without obligation.

Minimum Duration:	The current version of our “Growl” product has no minimum licence term, although later versions may have restrictions.

PART B - SOFTWARE LICENCE

PLEASE READ THE FOLLOWING TERMS AND CONDITIONS CAREFULLY

SECTION A. Definitions used in this document

In this Licence: “You” means the private individual aged 18 or over who has (i) correctly completed a registration form as a user of the Software; and (ii) agreed to be bound by the terms and conditions of this Licence; “We” and “Us” means Security & Standards Limited, a company incorporated in England and Wales under Company Number 03908404 whose registered office is at 18 Harmont House, 20 Harley Street, London W1G 9PH; “the Software” means the “Growl” software; “the Documentation” means the electronic information and help files supplied with the Software; “the Licensed Materials” means the Software and the Documentation; “Registration Form” means the registration form you need to complete before using the Software; “Virus” means any hidden software that can replicate itself and is intended to interfere with the normal operation of any software or computer system (examples of software of this sort includes computer viruses, worms and Trojan horses); and “Working Days” means days other than Saturdays, Sundays and public holidays.

SECTION B.  Matters that you must attend to before using the Software

B.1	PRECAUTIONS

Please take the following precautions before downloading or installing the Software on your system.  We shall not be liable to you if you suffer any loss or damage that would have been avoided if you had taken these steps.

(a)	Back-Up.  Back-up all the important files on your computer system, so that you have copies if any problems should arise as a result of downloading or installing the Software on your system.

(b)	Virus-check.  Whilst we shall do our best to ensure that the Software is virus free (see section H), you should ensure that you have installed on your system a good quality anti-virus software program that has been updated with the manufacturer's latest updates.  You should use this software to ensure that the Software is virus free before using it.

NOTE: Please back-up first, and then virus-check.

B.2	BROWSER AND SYSTEM REQUIREMENTS

Browser

This version of the Software is only intended to operate with Microsoft's Internet Explorer, Versions 5 and above.

System

Please ensure that your computer system satisfies the following system requirements before you install the Software. If these requirements are not met the Software may not work, or its performance may be affected

Browser	Internet Explorer 5, or higher.
Processor	Pentium P133 (or higher), or its equivalent
RAM	32 MB or more
Internet Connection	Required
Operating System	Windows 95(with Winsock 2), 98, ME, NT(Service Pack 3 or higher), Windows 2000

SECTION C.  Provisions limiting our liability to you

C.1	Except as provided in C.3, our total liability to you under or in connection with this Contract (including any liability for negligence and misrepresentation) shall be limited to an aggregate amount of One Hundred Pounds Sterling (£100.00).

C.2	The cap on our liability referred to in C.1 above reflects the fact that:

(a)	the Software was supplied to you at no cost;

(b)	if we were to incur unlimited liability to an unquantifiable number of customers, there would be no economic rationale for us licensing the Software; and

(c)	the cap on our liability makes us liable to you for more than you have paid us in licence fees, which means that we have therefore assumed real responsibility under this licence for our acts and omissions.

C.3	The cap on our liability set out in C.1 above shall not apply to any liability which we may incur for any death or personal caused as a result of our negligence.

SECTION D.  Intellectual Property rights

D.1	All the intellectual property rights in the Software belong to us, and you will infringe our rights if you breach the licence restrictions in sections E.1 and E.3, or if you use the Software after this Licence has terminated.

D.2	Except for the licence granted to you in section E you acquire no rights in relation to the Software.  By agreeing to be bound by the terms and conditions of this Licence you are only licensed (i.e. permitted) to use the Software, you are not purchasing it.

SECTION E.  Licence terms and restrictions on use

Licence

E.1	You are only licensed (permitted) to use the Software on the following terms and conditions.

(a)	The licence is personal to you, and it is conditional upon you correctly completing the Registration Form.  Any errors in completing the Registration Form shall invalidate your licence to use the Software.

(a)	The licence to use the Software is granted for your personal use only, in connection with your own private affairs.  It may not be used by you for any business purposes, and any use of this sort shall invalidate your licence to use the software.

(a)	The Software may only be used on a PC that is owned by you.

E.2	Subject to the exception set out below, the Software may also be used by members of your household who satisfy both of the following requirements.

(a)	they use the Software on your PC with your consent; and

(b)	they use the Software for their own personal use, and not for any business purpose.

The use of the Software by any member of your household is on the strict understanding that you have a valid licence to use the Software during the period in question, and that its terms are strictly complied by you and by that other person. Any breach of this licence by a member of your household shall be regarded as a breach of this licence by you, and you shall be liable accordingly.

For the purpose of this section a “household” shall not include student accommodation, or any property in which parts of a single residence are separately rented out.

E.3	Except for producing one copy of the Software for back-up purposes, you shall not make or permit anyone else to make any copies of the Software.  Except as provided by section 50B of the Copyright, Designs and Patents Act 1988 you shall also not decompile or reverse engineer the Software, nor permit anyone else to do so.

Excessive Use

E.4	Excessive use of the Software beyond the normal use expected of private individuals may result in you being given a high-usage warning requiring you to limit the use that is made of the Software. IF THIS WARNING IS NOT HEEDED THE SOFTWARE MAY AUTOMATICALLY CEASE TO OPERATE. If you wish to continue to use the Software in those circumstances you will need to purchase a commercial user licence from us.

SECTION F.  Technical Support

Note:  Previous F2 deleted at Bradley Geppert's request

F.1	As is generally the case with software help files, the Documentation assumes that the user has some degree of familiarity with computer-related matters.  If you require any further assistance in installing or using the Software which cannot be resolved by reading the help files you should email our help-desk at support@securityandstandards.com.

F.2	If you contact us for technical support we shall assume that you have first attempted to resolve the difficulties in question with reference to the Documentation and any guidance notes that may be posted on our website at www.securityandstandards.com.

F.3	We shall not be liable for any problems with the Software that are attributable to the following matters:

(a) 	any failure of the Software to operate correctly that is attributable to any equipment or software used in conjunction with the Software; or

(a)	any failure by the Customer to follow any specific instructions that have been given by us.

SECTION G.  Testing and Viruses

G.1	We have tried to adopt a responsible approach in relation to the Software, and this includes us taking the following steps.

(a)	Testing.  The Software has been beta-tested and quality tested prior to it being made available to you.  As at the date on which you downloaded the Software, we confirm that we were not aware of any material faults with the Software, and the minor errors that we were aware of were noted in the “README” file included within the Documentation. These minor errors will be corrected in future releases of the Software.

(b)	Virus-checking.  The Software has been virus-checked, and, as at the date on which you downloaded the Software or on which it was recorded on to any CD-ROM for distribution our anti-virus checks disclosed no viruses.

G.2	As we have taken all the reasonable steps we can to ensure that the Software is virus-free, we cannot be liable for any loss or damage that you may suffer due to any computer viruses that may affect the Software. In those circumstances the primary liability for any virus must lie with its creator, and any viruses in the Software will have a negative impact on our business.

SECTION H.  Blocking advertisements

H.1	It is a condition of this Licence that you do not block the advertisements on the Software by using ad-filtering programs or by any other means.  Any breach of this condition shall immediately terminate your licence to use the Software.

H.2	Please note that the Software can determine whether advertisements that would otherwise have been displayed on the advertising panels on the user interface have been blocked.  If advertisements are blocked the software will display a warning, and, if this is ignored the Software will cease to operate.

SECTION I.  Certificates and security

I.1	The Software provides a rating for the security of the websites that you visit by checking three things: whether there is a secure connection in place with that site; whether the identities of the  site, the business operating that site, and that business' location have been certified; and whether the business running the site is a member of a trust scheme, association, or trade body.  These checks, and what they mean, are explained in more detail below.

On-Line Security.  The Software assesses whether the on-line connection between you and the website that you are viewing is secure, so that any information that is transmitted cannot be intercepted.  This can be very important if you are asked by business running a website to supply any confidential information on-line (such as your credit card details, or your name and address), or if the website itself provides you with information (e.g. account balances) that you would rather other people did not see.

Identity.  The Software confirms whether the business behind the website that you are viewing is identifiable by checking whether a certificate regarding its identity has been issued and is in force.  Certificates of this sort are issued by a number of organisations, and the certification process might include some investigations being carried out to verify the accuracy of the information supplied.

Business Practices The Software reports on whether the business that runs the website that you are viewing is likely to be a responsible contracting party by checking whether it is a member of a trust scheme, association or trade body.

An explanation of how the Software uses the three elements noted above to rate a website and the reliance that can be placed on this rating can be found at [• insert link].

I.2.	Point I.1 explains why the various certificates that we have referred to are important, but there are limitations to these certification processes that you should be aware of, and they include the matters set out below.

Validity Most certifying bodies update their records on a regular basis, and we update the records that the Software uses (that are based on the certifying bodies' lists) on a daily basis.  However certificates can be revoked, or they may expire, and the certifier's lists and our own records may take some time to record this fact. In the circumstances it is prudent to assume that the information relating to certificates that the Software interrogates is at least 48 hours out of date, and possibly longer. Certificates are also based upon the information given by the applicant to the certifying body, and some of the information that was supplied may have been false or inaccurate. Some of the original information on which the certificate was based may also have changed, and the certifying authority may not have been notified of this fact or amended its records accordingly.

Identity  It should be noted that although a certificate may confirm the identity of the business behind a website, this does not do away with the difficulties you might have in getting satisfaction from that business, or in bringing, or enforcing, any legal action or judgement against it.

Business Practices  Some trust schemes, associations and trade bodies are more rigorous than others in carrying out their own investigations into the responses provided by applicants, or in checking that a business continues to conform to the required standards. Different bodies also take different approaches in penalising offenders, and in revoking the membership of businesses that do not conform to the required standards.  It is therefore advisable to learn something about the different trust schemes, associations, and trade bodies, and their requirements and procedures, before placing too much reliance upon whether a business has been approved.

FURTHER INFORMATION. For information regarding the practices of a certification body in issuing certificates and preparing revocation lists you should reference the certification body's certification practice statement.  The relevant practice statement for a site's certificate can be found by clicking on the link in security tabbed display in Growl, and the conditions for membership of a particular trust scheme, association or trade body may be found on that body's website which can be found by clicking on the relevant icon displayed by Growl.

I.3	As outlined above, the Software compiles information from other sources regarding whether there is a secure connection, the identity of the business behind a website, and whether that business has a certificate from a consumer organisation.  In addition to the possible shortcomings with certifications, the following points should also be noted.

(A)	THE SOFTWARE COLLATES INFORMATION SUPPLIED BY OTHERS. WE DO NOT INDEPENDENTLY VERIFY THE ACCURACY OF THAT INFORMATION.  SOME OF THE LIMITATIONS ON THE ACCURACY OF THE INFORMATION SUPPLIED BY THE SOFTWARE ARE REFERRED TO IN THIS SECTION OF THIS LICENCE.

(B)	THE SOFTWARE RATES THE INFORMATION THAT IT HAS COLLECTED IN A PARTICULAR WAY. YOU THEREFORE CONFIRM THAT YOU SHALL READ THE EXPLANATORY SECTION IN THE HELP FILE THAT DEALS WITH THESE MATTERS BEFORE USING THE SOFTWARE.

(C)	THE ABSENCE OF CERTIFICATES IN RELATION TO A BUSINESS IS NOT, IN ITSELF, CONCLUSIVE IN DETERMINING WHETHER IT IS TRUSTWORTHY OR NOT, OR WHETHER IT WILL HONOUR ITS CONTRACTUAL OBLIGATIONS.

(D)	IN VIEW OF THE MATTERS SET OUT IN (A), (B) AND (C) ABOVE, YOU ARE PERMITTED TO LICENCE AND USE THE SOFTWARE ONLY ON THE STRICT UNDERSTANDING THAT YOU WILL NOT TO MAKE ANY BUSINESS OR OTHER DECISIONS BASED SOLELY UPON INFORMATION SUPPLIED BY THE SOFTWARE.

You are not permitted to use the Software unless the matters referred to in points (A) to (D) above, and all the other terms and conditions of this Licence, are agreed by you.

Note: this section has been re-worked.

SECTION J.  Termination

J.1	Your licence to use the Software shall automatically terminate if you breach any of the provisions of this Licence.

J.2	The termination of this Licence shall be without prejudice to any legal claims that may arise prior to its termination.

SECTION K.  Other provisions

K.1	Nothing in this Licence or elsewhere shall limit our right to refuse to licence the Software to anyone for any reason whatsoever.  In particular, we may refuse to allow you to download the Software on more than one occasion.

K.2	This Licence is personal to you and you may not assign it in whole or in part to any other person.

K.3	It shall be your responsibility to ensure that we are kept informed by e-mail of all changes to your address and contact details and we shall not be liable for failing to contact you if you fail to comply with this requirement.

K.4	Any notices to be served under this Licence shall be sent by prepaid post to you at the address for service notified to us on the Registration Form and all notices shall be deemed to be served upon receipt at the address in question.

K.5	This Licence shall be governed by the laws of England and all legal proceedings (including all arbitration and dispute resolution hearings) shall take place in London, England.

Our contact details

If you wish to contact us in relation to matters other than technical support (see section F above), you can do so as follows:

Email:
Fax:	+44(0)1245 494517
Post:	Security & Standards Limited Suite A, 192 Moulsham Street Chelmsford, Essex CM2 0LG

SECURITY & STANDARDS LIMITED is a company incorporated in England.

Registered Office: 18 Harmont House, 20 Harley Street, London W1G 9PH.


Traffic light
TRAFFIC LIGHT INDICATOR

Indicator of security rating for the current web access.

See Traffic Light Indicator


Options
OPTIONS MENU

Allows changes to be made to the way

Growl™ works.Changes can be made

to Assessment Criteria and Application Settings.


RATING TAB

Information on how the security rating

of the current site is assessed.


ORGANISATION NAME

The name of the organisation responsible

for the site relating to this tab.


View
VIEW MENU

Select System Tray View, Minimised View or Maximised View.


PAYMENT METHODS

This area identifies the payment methods

that are known to be supported by the

current site. It does so by displaying icons.

Click on the icons in order to view the

relevant Website


Current Server Name
CURRENT SERVER NAME DISPLAY

Server name for the current site on which the security rating is based.


RESTORE ASSESSMENT DEFAULTS

Reverts back to Growl's original default settings.


RESTORE USER DEFAULTS

Reverts back to the the users default settings.


oldservername
PREVIOUS SERVER NAME

The server name of a previously accessed site.


servername
SERVER NAME DISPLAY

The server name of the current site.


encryption tab
ENCRYPTION

Select the strength of encryption required.

NB: 128 bit is virtually unbreakable but not

supported on all web servers.


Encryption factor
ENCRYPTION

Reports the strength of Encryption used.

NB: 128 bit is virtually unbreakable but not

supported on all web servers.


SECURITY TAB

Information about the security certificate

and encryption employed on the current site.


SITE ID TAB

Information about the organisation

responsible for this site.


payment area
PAYMENT METHODS

Displays icons of all the Payment Methods

that the current site is known to accept.


URL factor
URL EXACT MATCH

Shows if there is a mismatch between the site URL

and the URL recorded in the security certificate.


URL disp
URL EXACT MATCH

Controls how closely the site URL must match

the URL recorded in the security certificate.


Counrty code factor
COUNTRY CODE EXACT MATCH

Compares the Country Code in the URL with

the information in the certificate.


country code disp
COUNTRY CODE EXACT MATCH

Decides whether the Country Code in the

URL must match information from the certificate to achieve a rating.


Certificate rev factor
CERTIFICATE REVOCATION CHECK

Shows whether a double check has been performed on

Certificate validity with the issuing authority.

NB: revocation status information is not available for all sites.


certificate disp
CERTIFICATE REVOCATION CHECK

This setting controls whether a double check
is required on the certificate validity with the issuing authority.

NB: revocation status information is not available for all sites.


communications area
COMMUNICATIONS ALERT

Indicates that the current Communications are

safe, mixed safe/unsafe or unsafe.


associations area
ASSOCIATIONS

Lists all the Associations to which the site is known to belong.


GO GREEN IF TAB

Click this tab to set options for the green rating.


APPLICATION SETTINGS TAB
APPLICATION SETTINGS

Use this tab to in order to prevent the Minimised View opening

when visiting a secure site and to change the web browser

Growl™ uses.


ASSESSMENT CRITERIA TAB

Use this tab to select Rating Factors that are required to get a green or amber Assessment Rating.


GO AMBER IF TAB

Click this tab to set options for the amber rating.


REMOVE ASSOCIATION

Click this button to remove the selected Association.


ASSOCIATIONS

Associations are organisations that investigate web based

Businesses or professional groups or bodies which regulate

the commercial behaviour of their members.


ADD ASSOCIATION

Click this button to add the selected Association.


CLOSE NOTHING SAVED

Click this tab to exit  without applying any changes.


USER DETAILS

Select this tab in order to

view or change user details.


MEMBER OF REQUIRED ASSOCIATION

Shows if the current site belongs to the Associations

required by the current Assessment Criteria.


CLOSE SAVES CHANGES

Click this tab to save changes and exit.