Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×

IE 8 To Include New Security Tools 177

Posted by ScuttleMonkey from the hopefully-half-of-them-work dept.
Trailrunner7 writes "Internet Explorer has been a security punching bag for years, and rightfully so. IE 6 was arguably the least secure browser of all time. But Microsoft has been trying to get their act together on security, and the new beta of IE 8, due in August, will have a slew of new security features, including protection against Type-1 cross-site scripting attacks, a better phishing filter and better security for ActiveX controls."
This discussion has been archived. No new comments can be posted.

IE 8 To Include New Security Tools More

IE 8 To Include New Security Tools

Comments Filter:

  • Better security for ActiveX controls (Score:5, Insightful)

    by sakdoctor ( 1087155 ) on Friday July 04, 2008 @06:45PM (#24062565) Homepage

    Or scrap ActiveX controls?

    • Nope, just the best one to date. (Score:4, Funny)

      by DaedalusHKX ( 660194 ) on Friday July 04, 2008 @06:54PM (#24062627) Journal

      "Uninstall Internet Explorer 8? Are you sure? Yes/Yes"

      Perfect security tool, IMHO.

    • Re:Better security for ActiveX controls (Score:5, Insightful)

      by Tweenk ( 1274968 ) on Friday July 04, 2008 @07:13PM (#24062743)

      ActiveX is a critical technology in (South) Korea - you can't do any online banking, online shopping, etc. without ActiveX support. MS can't drop ActiveX or it would lose the Korean market.

      • Re:Better security for ActiveX controls (Score:5, Insightful)

        by Anonymous Coward on Friday July 04, 2008 @07:41PM (#24062905)

        > MS can't drop ActiveX or it would lose the Korean market.

        Lose it to whom? There aren't any other ActiveX providers, so if MS dropped ActiveX, South Korea would have no choice but to use whatever MS would provide as replacement.

      • Re:Better security for ActiveX controls (Score:4, Insightful)

        by Daimaou ( 97573 ) on Saturday July 05, 2008 @01:36AM (#24064269)

        Or maybe South Korea could pull their collective head out and stop supporting lock-in and using crap technologies.

      • Re: (Score:2)

        by rbanffy ( 584143 )

        If dropping ActiveX granted any real market advantage (people who know what is ActiveX are less than 2% of the overall computer-using population and people who know how bad ActiveX really is doesn't reach 1%), they would screw the South Koreans all over.

        BTW, it seems they already screwed SK pretty bad.

      • Countries must eventually pay for the bad decisions their IT elite made. I am sure (South) Korea is not an exception.

    • Or scrap ActiveX controls?

      If only... no one act would improve more the quality of everyone's browsing experience.

    • Re:Better security for ActiveX controls (Score:5, Interesting)

      by TheNetAvenger ( 624455 ) on Friday July 04, 2008 @08:09PM (#24063041)

      Or scrap ActiveX controls?

      Too much legacy, best thing to do is continue to sandbox them as much as possible.

      MS is shoving devlopers to either Silverlight or XBAP that have extensive sandboxing/security in comparison. MS has been in the process of killing ActiveX for several years now, next trick is to smack the developers around by making non-internal deployment really freaking hard.

      Even Win32/64 has been being killed off slowly, but developers are slow moving creatures sometimes. (This is the biggest reason even people that hate Vista should be rooting for it to replace XP at the very least, as the non-Win32 APIs are its bread and butter, even working directly inside the vector composer of Vista, that XP can't do even if you try running .NET 3.x on it.)

    • Re:Better security for ActiveX controls (Score:5, Insightful)

      by JebusIsLord ( 566856 ) on Friday July 04, 2008 @08:47PM (#24063203)

      ActiveX is the only thing keeping large businesses TIED to IE. The last thing MS would do is scrap them. And to be honest, within a corporate intranet (where users don't have the rights to install activex controls), ActiveX is a pretty solid technology.

    • Re: (Score:2)

      by eonlabs ( 921625 )

      That's not how windows security works. If they doubled it, expect:

      An activeX control has been detected on this site. Allow it to run (Yes/No)?
        (the close window button is missing, yes and no don't exist)

      Are you sure you want to run it?
        (They may use both yes and no buttons instead of an OK button here)

    • Re: (Score:2)

      by WgT2 ( 591074 )
      Ooow. I thought 'Include New Security Tools' meant they would include Firefox... or something.

  • Was I the only one to misread the title? (Score:5, Funny)

    by The Standard Deviant ( 869317 ) on Friday July 04, 2008 @06:47PM (#24062583)
    Was I the only one to misread the title as: "IE 8 To Include New Security Holes" ?

    • Re:Was I the only one to misread the title? (Score:5, Insightful)

      by kjart ( 941720 ) on Friday July 04, 2008 @07:01PM (#24062675)

      Was I the only one to misread the title as: "IE 8 To Include New Security Holes" ?

      That's true for almost everything new. As complexity rises, so does the chance of a problem, and browsers are surprisingly complex nowadays.

      • Re: (Score:2)

        by Jekler ( 626699 )
        Although it's true that the potential for problems rises (perhaps exponentially) with the complexity, advancement does not have to mean an increase in complexity. Simplification is a much greater mark of advancement than complexity is.

  • On hacker/cracker messageboards everywhere:

    OOH! more security vulnerabilities to play with!

  • Let me guess... (Score:5, Funny)

    by GSPride ( 763993 ) on Friday July 04, 2008 @06:48PM (#24062593) Homepage
    An 'Install Firefox' button?

    • Yes, congratulations is in order for Microsoft's IE team: they've finally reached nearly the same level as Firefox+NoScript. And they've only been in the game...how much longer? [/msFlame]

      But seriously, maybe we should give Microsoft a little credit. As bad as they've been about IE security in the past, they're actually trying this time.

      • Re: (Score:3, Insightful)

        by lostmongoose ( 1094523 )

        As bad as they've been about IE security in the past, they're actually trying this time.

        Because they say they are, right? They've said that it'll be more secure than before everytime they've done this and nothing really changes.

      • Yes, congratulations is in order for Microsoft's IE team: they've finally reached nearly the same level as Firefox+NoScript.

        Funnily enough, even Firefox without NoScript isn't at the same level. These comparisons should really only be done at default settings without 3rd party addons. It is fairly easy to lock down any of the browsers out there, but the majority of people don't do it.

  • Please say.. (Score:3, Interesting)

    by wellingtonsteve ( 892855 ) <wellingtonsteve AT gmail DOT com> on Friday July 04, 2008 @06:54PM (#24062631)
    ..that they will be more usable than the current 'security tools' we get with IE7 which serve the purpose of securing IE by making it so annoying that no-one wants to use it..

    I mean that security bar thing that appears below the address bar for example when you want to download something. "Are you sure you want to download this file? It may contain viruses, malware, zombies, ghosts, or even the mother-in-law amongst other Scary Things (tm)?" YES! Why no "Don't ask me again, I'm smart enough to know what I'm downloading thanks" option....

    Ahem, rant over sorry.. But please MS, try harder this time..

    • Re:Please say.. (Score:4, Interesting)

      by ConceptJunkie ( 24823 ) on Friday July 04, 2008 @07:49PM (#24062943) Homepage Journal

      It would be nice if Microsoft's biggest security "feature" is asking the user to confirm any operation that could conceivably cause a problem. Oh, well, at least they can blame the user now... after all HE allowed it.

      The one time I tried to use IE7 and MSN search (to look up TV remote control codes) MSN search returned a link that hijacked IE7 to a site trying to play porno movies and because of the constant message boxes claiming "Microsoft" found security problems and should I let it install a "fix" (probably Javascript trying to get me to install malware). The message boxes wouldn't go away and I couldn't even shut down the browser without killing the whole app from the task manager. (By the way, I checked the first several pages of Google's results to see if that fake link showed up, and it wasn't there. MSN is useless, too.)

      I would have never in a million years thought that IE7 would be that horrible. It's like it's 1998 all over again. Microsoft does nothing but FAIL. I've been using Firefox (with NoScript, AdBlock+, etc) since it was Phoenix 0.4 or so and I had literally forgotten how horrible IE used to be... and still is. In all those years nothing like that has ever happened to me with Firefox.

      I'm convinced Microsoft just needs to give up. They have become completely worthless and literally have nothing else to offer.

      More details and ranting if you're interested: http://conceptjunkie.blogspot.com/2008/04/microsoft-needs-to-die.html [blogspot.com]

      • You could easily create a similar messagebox loop for Firefox, to try to encourage someone into installing a malware Add-On.

        Unfortunately, no browser that I know of allows you to kill a javascript without taking out the whole browser.

        • Re:Please say.. (Score:5, Informative)

          by Rutulian ( 171771 ) on Friday July 04, 2008 @11:03PM (#24063757)

          Actually, you can't with Firefox 3. It will detect a looping script and give you the option of stopping it. If you use NoScript, you can block it entirely.

          • Well, that's good to hear!

            And FWIW, you could configure IE to whitelist javascripts on a site basis by using 'zones'.

            • Well, like most of the security features Microsoft provides, IE zones are annoying and a pain to use properly. Firefox, by default, blocks most annoying Javascript behavior, but NoScript really takes it to the next level. If you ever find yourself on Firefox, you should try AdBlockPlus+NoScript. It's a pretty good combination and is very usable. See here [noscript.net] and here [adblockplus.org] for more information.

              • Yeah, I'm aware of those extensions. NoScript in particular makes the web browser practically unusable for a normal person (as would managing IE zones), so I think it's a somewhat unfair standard to set. Only a few nerds are willing to break normal browsing behavior just to prevent getting rickrolled or dialog-spammed.

          • Re: (Score:2)

            by Tim C ( 15259 )

            Firefox 2 would pop up a dialogue box after a while telling you that a script was taking a long time to run, and giving you the option of killing it. Or at least it did for me; I've no idea if that was stock behaviour or one of my extensions.

            • Yeah, it may have been in Firefox 2 as well...I don't remember exactly when they added that feature.

        • Re:Please say.. (Score:5, Interesting)

          by ConceptJunkie ( 24823 ) on Friday July 04, 2008 @11:12PM (#24063795) Homepage Journal

          Maybe you could, but it's never happened to me... even before NoScript came along.

          That's the irony about the Web. It started out as a document display technology and eventually morphed into an application platform, taking about 15 years too long and going down too many dead ends on the way. I read somewhere that someone suggested the Web should have simply been X from the start. It surely would have saved them reinventing the wheel a dozen times in the last 20 years, that's for sure.

          We've almost come full circle. The browser is _almost_ the OS which runs your applications. In fact, Microsoft's biggest problem was that they hooked the browser directly into the OS (in fact, their problem has always been that they hook everything directly into the OS). ActiveX was just a shortcut to run native code via the Web, and it suffered all the obvious problems from being so. "Hello, world,, run anything you want on my computer. I trust you." Java was better, but it's just too darn bureaucratic. I can't imagine having to actually develop in Java... from everything I've seen it's worse than dealing with the government and insurance companies combined.

          So where will it all end up? Starting around 1991, we reverted back some 15 years in UI development and had to go through the 80's again, but in browsers. I figure in another couple years Web apps and native apps will essentially be indistinguishable, especially from the non-techie's point of view. That's not bad except all the good UI standards and conventions developed by Xerox, IBM, Microsoft, Apple backed with decades of research have been almost completely abandoned. I can't even imagine what the average computer experience will be like in 10 years, but if the past 20 is an example, some things will advance more than I could have ever guessed and others will barely change, and it will still take an expert to solve all but the most basic problems.

          The term "bleeding edge" was a play on the term "leading edge" but at the rate things change, there is no more "leading edge" any more. With Vista and recent releases of OSX, the "bleeding edge" is the mainstream, and we've come to not only not be surprised that systems aren't even remotely complete when shipped, in fact, we expect a "dot oh" product to be essentially a late alpha. I don't recall what product it was, but it was a "release candidate" and at the same time the release notes said in effect, "but we haven't documented all the features yet because we don't have a firm list of what will be included". That's not a "release candidate" by any definition... not even Microsoft's. That's an alpha release, by the original definitions. But these days (and Google is a perfect example, even though many of their products are very good), most software never really gets out of "beta" any more. There are Google products that were literally labelled "beta" for years. It's always possible there was some legal reason for this, but the idea of a "test version" vs. a "release version" barely exists any more. Often the only distinction is the size of the group of users who have access to it. Microsoft does this, even though they still pretend to adhere to the gigantic monolithic release after years of development apparently because that's the only way they can justify charging people for the same old crap, but shinier and slower. I think the Ubuntu concept works well. They seem to have an attitude of "We'll take what we've got and make sure it installs and works together" every six months. Each release isn't always a huge change, that depends on the state of things like Gnome, KDE or the Linux kernel or who knows what, but this "evolutionary release cycle", where each subsequent upgrade is relatively small, seems to work a whole lot better than Microsoft's "revolutionary release cycle" where it's a major IT undertaking that is so massive most companies these days would rather not bother.

          Hmmm... I seem that have digressed a bit.

      • Re: (Score:2)

        by rbanffy ( 584143 )

        Why the hell were IE7 and MSN Search your first options to getting some information?!

    • Re: (Score:2, Insightful)

      by account_deleted ( 4530225 )
      Comment removed based on user account deletion

  • The only good activex is a DEAD activex. Kill it once and for all, for christ sakes.

    • Re: (Score:2)

      by Tweenk ( 1274968 )

      As I commented under the first post it's not that easy. In Korea everything runs on ActiveX (online banking, e-commerce, etc.), it was the preferred way to provide rich client functionality for years. While ActiveX is deprecated, they can't drop it right now because of the giant backlog of legacy ActiveX applications in Korea. This is also one of their most loyal markets, so it would be a shot in the foot.

      • Fuck Korea, Microsoft and the horse they rode on.

        Activex should've died a simple rapid death a decade ago. Microsoft is willing to actually make their stuff standards compliant: that'll mess much more many people up than killing activex off.

        In any case, I dont care at all: ive necer used activex and I never will. Hell, i dont even use IE and never will.

      • It's also at the heart of around a bazillion lines of VB applications and stuff.
        While it would in theory be totally smarter to upgrade everything to .Net and use VSTO and the like, the installed base becomes the chief competition for MS.
        Even if MS gave away all of the tools and converters to migrate away from all the VB, there would still be a crushing battle with bureaucratic inertia.

      • so kill it,

        and make the banks, etc reconsider in their next round of development. its actually pretty easy to adhere to standards that make apps cross-browser happy.

        geez, if an online app gets 3 years of production life, its done pretty well, so planning for the next version _without_ activeX should be pretty straight forward.

        just looking through my web server logs, theres still plenty of nufties running ie5/6, so killing activeX in ie8 wouldnt be the end of the world overnight - ppl would just have to have

        • Re: (Score:2)

          by LO0G ( 606364 )

          What a great idea.

          I do have one question...

          If Microsoft kills it's plugin technology (ActiveX) how do you expect people to render video?

          Every major browser out there (with the possible exception of Lynx) has a plugin technology that allows things like video rendering to be possible. As long as you allow plugins that have the ability to render arbitrary code, you have an environment that is the functional equivilent of ActiveX.

          ActiveX has a bad reputation simply because it is the most popular plugin technol

  • I only have one comment..... (Score:3, Interesting)

    by zappepcs ( 820751 ) on Friday July 04, 2008 @07:03PM (#24062695) Journal

    Since IE7 and Vista, I am no longer qualified to comment on the user experience of Windows products. These two products killed off *any* thoughts I might have of using MS products at my personal expense. Still on XP with FF/OOo et al at work. It might^H^H^H^H^H^H will take more to get me to try another MS product than it did to get me to try Ubunutu.

    New security tools sounds like a good idea. Hope they do well with that. Everyone has to work to keep the bar high on secure computing development, but I won't be trying it. Yeah, don't bother telling me about how F/OSS has problems too... everything does. I just prefer my problems not be served to me without the lubricant.

    I do hope they achieve something good, it will be good for the Internet as a whole.

  • Sandbox javascript, flash etc ... (Score:4, Insightful)

    by BlueParrot ( 965239 ) on Friday July 04, 2008 @07:12PM (#24062735)

    There isn't any good reason why the javascript engine should run with the same privileges as the browser, and there certainly isn't any good reason why plugins like flash should have as many privileges as they do. Sandboxing those bits should help a lot.

    • Re:Sandbox javascript, flash etc ... (Score:5, Informative)

      by Z34107 ( 925136 ) on Friday July 04, 2008 @10:06PM (#24063519)

      In IE7 on Vista, those bits (and everything you do, actually) are sandboxed. It's called protected mode [microsoft.com] and like everything well-written and intelligible in life, there's a MSDN article. ~~

      If you can get to a Vista machine, boot up Internet Explorer 7. In the bottom-right hand corner, you'll see a "Internet|Protected Mode: On." Internet Explorer, and everything launched in/from IE, run under a low "Integrity Level", which means they only have access to the "Temporary Internet Files\Low" folder and "HKEY_CURRENT_USER\Software\LowRegistry" key.

      Any file access is transparently redirected from these points: An ActiveX control trying to create "virus.dll" in "c:\windows\system32" will have it actually created "Temporary Internet Files\Low\C\Windows\System32". (Nothing in this folder is executable.)

      Open up task manager. (CTRL+SHIFT+ESC) You'll notice an "ieuser.exe" process - should something need more privileges, like you saving a file to your downloads directory, this process will grant that one action regular, non-admin user privileges. Anything system changing has to pass through an "IEinstal.exe" process, which will trigger a UAC prompt.

      My understanding is limited to some Vista beta-era documentation and the MSDN article I linked, but they pretty much sandboxed the entire browser with sub-guest-account privileges. It's relies on some new parts of the Vista kernel (you won't see the same sandboxing on IE7 in XP) but it's still pretty nifty, I think.

  • So keep using internet exploder 7 'till then, k? (Score:3, Funny)

    by lastomega7 ( 1060398 ) on Friday July 04, 2008 @07:35PM (#24062869)
    We promise you IE8 will be cool.
    -MS lackey

    PS- Despite what anyone tells you, don't get 'fire fox,' it's probably a virus.
  • Perhaps the most long-awaited security feature of all, the IE8 team promises that it will immediately uninstall itself if someone mistakenly puts it on their PC.

  • Will this turn out to be the same BS from Microsoft, as it was with all the previous IE releases? History tells us - yes. I mean, what real incentive do they have? All they care about is that IE integrates tightly with their other technologies, so already locked-in corporate users are happy.

    The side-effect of less or no security introduced by having IE preinstalled on about all of the new consumer PC shipments is not their concern. Nobody pays for it, anyway.

  • Of course, that's not saying much.....

    • Re: (Score:2)

      by gmuslera ( 3436 )
      Is saying a lot, in fact, with this is the 8th time that Microsoft about their current next version of web browser.

      Ok, even more, they said that for middle versions like IE 5.5 too.

  • I don't care what they do for security, I just want IE8 to support standard CSS stuff like border-radius, box-shadow and text-shadow. That's what people want to see when they sign up for contracts.

    Same goes for Firefox (still no box-shadow) and Opera (neither box-shadow or border-radius).

    Yada yada yada specs not finished, I don't care. Use the standardized prefixes for non-approved standards, they're here for that (ex: -moz-border-radius, -webkit-border-radius, etc).

  • So long as IE is built around the idea that it's possible, even in theory, to create a sandbox that is both leaky and secure, the Microsoft HTML control will continue to be the biggest channel for malware in the world.

    We (the security community) have been saying this for a decade, and Microsoft keeps saying "this time for sure".

    Don't bet that this time is the last time they say it.

  • Technically, IE7 is the most secure browser out... (Score:4, Interesting)

    by Toreo asesino ( 951231 ) on Friday July 04, 2008 @10:18PM (#24063565) Journal

    it's the only one I know that runs with only the following privileges (Vista only)...

    "RO to File System"
    "RW to user IE temp dir (explicit DENY on execute)"

    Everything other browser runs as logged in user I believe.

    So even if IE7 gets hosed into the floor, nothing will happen.

    That said, it still sucks compared to FireFox 3 in terms of useful functionality, but that's another story.

    • You *can* set up browsers under Linux to have the same types of permissions, using AppArmor or SELinux. It's not OOTB though, and not as easy to approve outside-the-sandbox actions (like saving a downloaded file to a non-temp folder).

      It's also worth noting that this feature, called Protected Mode, is not available if UAC is disabled. If you honestly can't stand privilege escalation requests (for things that damn well should have them) then open the Local Security Policy management console (use the Start search, or look under Administrative Tools), find the UAC policy options, and set it enable automatic escalation for Administrators. You're still sort of protected, in that any app that was started as a non-admin will stay non-admin until it requests privilege escalation, but you won't be given a chance to deny that escalation.

  • Just in time to break Apple's new MobileMe service...

  • whatever (Score:2, Insightful)

    by Anonymous Coward

    year after year after year after year after year after year after year......

    all we ever hear is how MS is making their next OS/Browser/Apps more secure. Have they ever succeeded? Not once... all I have witnessed is bug patches and more complexity. Its very tiring to hear the same garbage over and over again.... ...and for any site that only runs activex - get with the rest of the world and learn something....

  • It'll have the Firefox-tab extension.

  • Personally I'd be more interested in some decent developer tools. Specifically things like a JavaScript profiler and debugger. I know there are a few third party tools that kinda-sorta do this, but frankly they're all pretty horrible, at least compared to their Firefox equivalents. Give me Firebug and Venkman for IE and I'll be happy.

Slashdot Top Deals

On the eighth day, God created FORTRAN.

Close