OZO
Premium
join:2003-01-17
| New security settings in IE8
Users of IE, do you know what is new in security settings in IE8 comparing to IE7?
Here is some new URL actions in IE8:
1. 2700 - URLACTION_INPRIVATE_BLOCKING - Internet Explorer 8. Enables third-party URL tracking in the security zone, also known as InPrivate Browsing. [src]
What does it mean - allow third party URL tracking and how to set it to block the tracking?
2. 2106 - URLACTION_FEATURE_DATA_BINDING - Determines whether databinding is supported. By default, this feature is disabled in the Restricted zone, and in the High security template. [src]
Again, what does it mean? How to make it secure?
3. 120B - URLACTION_ACTIVEX_OVERRIDE_DOMAINLIST - ActiveX - Only allow approved domains to use ActiveX without prompt.
An interesting part about this new setting is - by default it uses value '3' (prohibit or disable) while GUI shows it "Enable" (common value for Enable is '0'). How to explain that convoluted setting?
4. And what is the meaning of this new URL action (in plain English, please):
1207 - URLACTION_ACTIVEX_OVERRIDE_REPURPOSEDETECTION - Determines whether to perform ActiveX repurpose detection, which tests if the control is safe to be hosted. [src]
Is safe to be hosted? This is security setting in IE, not in a hosting service.
5. 1409 - URLACTION_SCRIPT_XSSFILTER - Internet Explorer 8. Enables or disables cross-site scripting (XSS) filter. This security setting determines the default behavior of the browser if the x-xss-protection HTTP response header is not present. [src]
How to set it in a secure manner?
Notice, that some of the most "interesting" (from security perspective) options are not displayed in GUI at all and can be changed only via registry. Particularly, look at the new URL actions: 2700, 2106, 1207, 1409. Is it the new way to make browser secure or what?
I'm afraid that the new set of security settings sometimes with obviously screwed logic and without any explanation from the authors make IE less manageable. Or it's a goal that I do not get yet?
--
Keep it simple, it'll become complex by itself... |
