Zone Labs Product Security
27/06/04, 00:45
=20
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
ZoneAlarm Pro, Security Suite and Integrity products which employ=20
Mobile Code Protection/ID Lock features do not inspect encrypted=20
traffic. If mobile code is downloaded via a Secure Sockets Layer=20
(SSL) session, it will not be inspected by these products. This is=20
by design and mandated by the SSL Protocol specification.=20
The intended purpose of SSL is to "provide privacy and reliability=20
between two communicating applications [1]." Computer users have the
expectation their SSL encrypted session will be encrypted end-to-end
between the server and client application (in this case, the Web
Browser).=20
As stated in the SSL Protocol Version 3.0:=20
For SSL to be able to provide a secure connection, both the client
and server systems, keys, and applications must be secure [1].=20
As such, Zone Labs products do not attempt to intercept, decrypt,
proxy,=20
or otherwise interfere with the SSL transaction. For our product --
or=20
any other application -- to behave otherwise would violate the intent
and=20
design of the SSL specification and could potentially expose and/or=20
risk the confidentiality of the data transmitted in the SSL
transaction.=20
A clarification of this common program limitation will be made=20
in the product help files and program interface.=20
Zone Labs encourages anyone with concerns about the security of our
products or services to contact us at security@zonelabs.com.
[1] http://wp.netscape.com/eng/ssl3/draft302.txt=20
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
iQA/AwUBQNjWClDxXw2Is3mLEQJXvACg7qHHdJQ3O36pSypxv+BEnj 8K1vEAoKc7
WrvhXTtn75BZ3mu6XRzAWOqY
=3DfXFJ
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
ZoneAlarm Pro, Security Suite and Integrity products which employ=20
Mobile Code Protection/ID Lock features do not inspect encrypted=20
traffic. If mobile code is downloaded via a Secure Sockets Layer=20
(SSL) session, it will not be inspected by these products. This is=20
by design and mandated by the SSL Protocol specification.=20
The intended purpose of SSL is to "provide privacy and reliability=20
between two communicating applications [1]." Computer users have the
expectation their SSL encrypted session will be encrypted end-to-end
between the server and client application (in this case, the Web
Browser).=20
As stated in the SSL Protocol Version 3.0:=20
For SSL to be able to provide a secure connection, both the client
and server systems, keys, and applications must be secure [1].=20
As such, Zone Labs products do not attempt to intercept, decrypt,
proxy,=20
or otherwise interfere with the SSL transaction. For our product --
or=20
any other application -- to behave otherwise would violate the intent
and=20
design of the SSL specification and could potentially expose and/or=20
risk the confidentiality of the data transmitted in the SSL
transaction.=20
A clarification of this common program limitation will be made=20
in the product help files and program interface.=20
Zone Labs encourages anyone with concerns about the security of our
products or services to contact us at security@zonelabs.com.
[1] http://wp.netscape.com/eng/ssl3/draft302.txt=20
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
iQA/AwUBQNjWClDxXw2Is3mLEQJXvACg7qHHdJQ3O36pSypxv+BEnj 8K1vEAoKc7
WrvhXTtn75BZ3mu6XRzAWOqY
=3DfXFJ
-----END PGP SIGNATURE-----