how-to block ads
|
|
Uniqs:
5426 |
Share Topic
 |
 |
|
|
|
 R2R NotPremium,MVM
join:2000-09-18
Long Beach, CA
kudos:1
| Zoning Out! OK, I am getting the gist of this Zone stuff -- but I have a few questions.
How are the Security Gurus setting Internet Zone different from Restricted Sites? It seems like your are disabling almost everything in the Internet Zone -- is this correct? What about Java Permissions? High Security or Disabled?
Second, how do all of these relate:
- Tools|Internet Options|Security|Internet|Custom Level|Micorsoft VM|Java Permissions
- Tools|Internet Options|Security|Internet|Custom Level|Scripting| Scripting of Java applets
- Tools|Internet Options|Advanced|Microsoft VM|Java console enabled
- Tools|Internet Options|Advanced|Microsoft VM|Java logging enabled
- JIT compiler for virtual machine enabled
Any information and opinions appreciated. Thanks.
[text was edited by author 2001-05-23 17:07:26] | |
 wafenMr woogiePremium,Mod
join:2001-02-01
Maplewood MN
kudos:1
| Wrong link.
Opps
[text was edited by author 2001-05-23 17:41:16] | |
 gwionwild colonial boyPremium,ExMod 2001-08
join:2000-12-28
Pittsburgh, PA
kudos:1 | reply to R2
I'm on the brink of disabling even more. Popups are so unbelievably annoying. I would not only not buy anything that pops up behind my browser, whether I want it or not, I go out of my way to avoid the SOB who bought the ad forever after.
Now, to the point at hand:
Internet Zone: No active X, basic java support (soon to go the way of the dodo), and temporary cookies only.
Trusted zone: essentially, the "standard" configuration MS defaults for internet zone. However, no "user data persistence," NO PLACE; no automatic log ins; no iframes, desktop changes, auto updates, or install on demand, anywhere, either, and java/x/channels are always at "high safety."
Restricted zone: Nuthin'. Be glad I let your html through  .
Finally, I have an "extra" zone, called "tracking zone". This is a registry tweak available with Xsetup (http://www.xteq.com), that doesn't even acknowledge the "features" to deny them. It's about as restrictive as you can possibly get, kills popups like magic, stops most tracking efforts dead, and gets applied to any "overly cutesy" sites I stumble over...
Very important to me, in "advanced settings" (everywhere):
Disable:
Folder view for FTP
Auto check for updates
Install on demand
Profile assistant
That's a VERY brief rundown of my own approach to zones. I'm sure some others will have their own pet settings, as we all do, but I think this is a good start... my java settings may be a little risky for non-NT/2k systems, by the way... I set them slightly looser than normal, simply because I have my permissions set such that NT returns a "security exception - access denied" error every time I check it on a test script that digs for information about you via java... my 95 machine, though, obliges them readily, so be aware... remember, MS java isn't "real" java, so the security features of Sun Java 2 aren't necessarily there...  I really do need to disable that... jeez... MS Mock Java isn't something I trust worth a... oh, well... thanks for the thought! Good securing to you...
--
Man will occasionally stumble over the truth, but most times he will pick himself up and carry on. - Sir Winston Churchill | | |
|
| reply to R2
Here is a link that give a brief explanation of all the Advanced Settings. The italics are from the link below. » www.3dspotlight.com/tweaks/iexpl···nt.shtmlTools|Internet Options|Advanced|Microsoft VM|Java console enabledMuch like the Disable script debugging setting, you should only need to Tick this setting if you are testing out java applets/programs in your website for troubleshooting purposes. All others should leave this UntickedTools|Internet Options|Advanced|Microsoft VM|Java logging enabledTick this to enable the logging of any java related use on your system. Untick this setting to disable this logging. I’d recommend leaving this setting Unticked unless you actually need to keep a log of such activity (& view it).JIT compiler for virtual machine enabledWhen Ticked any Java applets are run using the Microsoft Java VM. This shouldn’t really be a problem unless you are running a non-Microsoft Operating System, e.g. Mac. Should you have problems with Java applets in Internet Explorer, try Unticking this setting. | |
R2R NotPremium,MVM
join:2000-09-18
Long Beach, CA
kudos:1 | reply to R2
Thanks for the answers. Gwion, I think I am leaning the direction you have taken. I like the idea of the 'extra' zone the ActiveX gives you, however, I am not sure how that will really differ from a fully Disabled Restricted Sites. I would have preferred that they give you the option to set up the new zone however you want to. That way you could have a Trusted "A" list and and "B" list, for example.
Interestingly, it seems like Steve Gibson has done the same type of thing here. Also, from that page check out this link. On that second page, spin down a few screens and check out his Restricted Sites list. You can download a .reg file to copy those into your system!:)
It seems like this tool may be EXACTLY what I want! Check that out if you want MORE control over your Zone settings. I have not used it yet, but it looks promising.
JoeyT, thanks for the link and the info. How about those first two entries -- Java Permissions and Scripting of Java applets?? Do I need them both blocked and why are there TWO of them?
Lastly, won't ANYONE else tell me the differences between their Internet Zone and Restricted Sites settings??:( | |
R2R NotPremium,MVM
join:2000-09-18
Long Beach, CA
kudos:1 | reply to R2
OK, this is what I can find about the first two entries: (from Ozark's Internet Exlorer Security Options)
Java Permissions :
Microsoft VM lets you set the security levels to control any Java applets your users encounter on Web sites in each zone.
CUSTOM- Although you can specify a custom level, I don’t recommend using Custom Level for Java permissions in most cases because Java security is very granular; you really need to be a Java programmer to understand Java permissions.
HIGH- When you choose the High safety level, you put fairly tight restrictions on Web pages that include Java applets. Using this level of protection prevents Java applets from accessing your computer’s files, registry, or printers, or displaying windows outside the IE window without first warning the user. Also, the applets won't be able to run other applications, but can initiate network connections back to the Web server.
MEDIUM- The main difference between the Medium safety and High safety levels is that in the Medium safety level, the user must give permission to Java applets to access files on the local computer.
LOW- In the Low safety level, Java applets can do almost anything on the local computer, including accessing files, starting applications, accessing the computer's registry, using printers, and contacting computers other than the Web server—even contacting computers on your internal network.
I recommend using High safety for most users for any site on the Internet zone. You’ll probably use Low safety for your Local intranet zone to support any highly functional intranet sites that use Java.
______________________________________
Scripting of Java applets:
The third scripting feature, Scripting of Java applets, controls whether client-side scripts can use objects in Java applets. Because Java scripts and applets work together closely, I recommend enabling this option if you enable Active scripting.
______________________________________
I am still not 100% sure why the first one does not control the second one...
Also, I supect in the Restricted Zone, you all are setting this to Disabled -- CORRECT?? | |
 wayaunegaThe Most Hated Of All Posters
join:2001-02-21
Asheboro, NC | reply to R2
ok heres part of mine
installed all security patches TO DATE
local = everything one java highest safety no activex
internet = deny all
restricted = deny all
no trusted sites
installed sun java 2
added 4 rules in CS to deny all traffic to and from iexploder when dialup present
added block all under app monitoring in pc viper for IE
patched Nutscrape use it as primary browser
if the site is really questionable or my gut starts getting off i use the text browser in genius2 to check it out
could you pass the marshmellows i can feel the flames rising
--
....common sense isn't too common anymore.... | |
 jaykaykay4 Ever YoungPremium,MVM
join:2000-04-13
Scottsdale, AZ
kudos:22 | reply to R2
said by R2:
OK, this is what I can find about the first two entries: (from Ozark's Internet Exlorer Security Options)
Java Permissions :
Microsoft VM lets you set the security levels to control any Java applets your users encounter on Web sites in each zone.
CUSTOM- Although you can specify a custom level, I don’t recommend using Custom Level for Java permissions in most cases because Java security is very granular; you really need to be a Java programmer to understand Java permissions.
HIGH- When you choose the High safety level, you put fairly tight restrictions on Web pages that include Java applets. Using this level of protection prevents Java applets from accessing your computer’s files, registry, or printers, or displaying windows outside the IE window without first warning the user. Also, the applets won't be able to run other applications, but can initiate network connections back to the Web server.
MEDIUM- The main difference between the Medium safety and High safety levels is that in the Medium safety level, the user must give permission to Java applets to access files on the local computer.
LOW- In the Low safety level, Java applets can do almost anything on the local computer, including accessing files, starting applications, accessing the computer's registry, using printers, and contacting computers other than the Web server—even contacting computers on your internal network.
I recommend using High safety for most users for any site on the Internet zone. You’ll probably use Low safety for your Local intranet zone to support any highly functional intranet sites that use Java.
______________________________________
Scripting of Java applets:
The third scripting feature, Scripting of Java applets, controls whether client-side scripts can use objects in Java applets. Because Java scripts and applets work together closely, I recommend enabling this option if you enable Active scripting.
______________________________________
I am still not 100% sure why the first one does not control the second one...
Also, I supect in the Restricted Zone, you all are setting this to Disabled -- CORRECT??
I have disabled everything in the restricted zone. Does that help?
--
JKK
Age is a very high price to pay for my maturity, so
if I can't stay young, I can at least stay immature!
| |
R2R NotPremium,MVM
join:2000-09-18
Long Beach, CA
kudos:1
| How does that compare to how you have set up the Internet Zone?
OK, I have figured out how to create your OWN Zones. This is the registry key:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]
At baseline there are FIVE Zones there 0 through 4. In order, they are My Computer, Local Intranet, Trusted Sites, Internet, and Restricted Sites. You can alter the name that is displayed under Tools|Internet Options by changing the, eh, "Display Name". You can also change what the description of each zone is by changing the, eh, "Description" entry. It is REALLY that easy! If you felt so inclined, you can also specify a different icon my modifying, yes, the "Icon" entry.
Then come the "Levels" entries (CurrentLevel, MinLevel, etc.). These seem control the HIGH, MED, LOW settings. I think 00000000 must be the "Custom" choice. It seems each Zone has a set minimum security level it can reach. I have not yet deciphered these. Also, the "Flags" have no clear meaning to me yet either...
The majority of the entries -- all of those numbers -- 1001, 1004, 1200, etc. -- MUST be the specific "custom" settings for each level. This would include Java permissions, Scripting, etc. No, I have not yet gone through and translated those -- yet!
NOW, the point is -- YOU CAN CREATE A SIXTH OR A SEVENTH ZONE!!
If you want to create a new zone somewhere in between Trusted Sites and Internet -- you CAN. Just export the "Trusted Sites" key -- that would be "2" -- to your Desktop. Change the key's name to "5". Change the "Display Name" to "Intermediate". Write a descriptive line about this Zone in the "Description". If you know how to figure out the Icon stuff, change the Icon -- this usually requires an icon program. I am not sure what to do with the flags. Leave it at 43 or change it to 3 -- I am just not sure yet... Leave all the other settings for now.
Merge this back into your registry -- and voila! A new zone to play with!
[text was edited by author 2001-05-26 00:57:14] | |
R2R NotPremium,MVM
join:2000-09-18
Long Beach, CA
kudos:1
| reply to R2
OK, I created an intermediate zone called "Prompt Zone".
In this zone, ActiveX, Java, and Scripting lead to a "Prompt" screen. I will try to use this as a temporary zone before I enter a site into my Trusted Sites.
Below the picture, I have attached the *.reg file that *should* create this for most Win98 computers. DO NOT BLINDLY RUN THIS!! Instead, look at it first in the "Edit" mode and see if it makes sense.
[text was edited by author 2001-05-26 01:02:58] | |
R2R NotPremium,MVM
join:2000-09-18
Long Beach, CA
kudos:1
| More options... I have followed the advice of the Security gurus and now my Internet Zone is 'highly restrictive'. It is NOT much different than my Restricted Sites. This can be quite troublesome...
I really dislike going to a site and finding out that I cannot use it as I would like if it is in the Internet Zone -- for example, www.microsoft.com. Sadly, just entering www.microsoft.com into your Trusted Sites is not enough. You have to enter support.microsoft.com, search.support.microsoft.com, office.microsoft.com -- and the list goes on!!
So, given this Zone structure, your only option is to move the site from the secure Internet Zone to the "Enabled" Trusted Sites. I cannot imagine running Trusted Sites in anyway but with ActiveX, Java, and Scripting Enabled. This means I am forced to move a new site from the secure zone to the completely insecure Trusted sites -- just to use that site!! Just to search with www.google.com or www.zdnet.com, you have to enter those into your Trusted Zone.
That answer is not acceptable to me!! So I created the Prompt Zone above. This zone serves as an intermediate holding area that is NOT as restrictive as the Internet Zone, yet not a enabled as the Trusted Sites. I think this makes a lot of sense.
However, there is ONE other solution that I would like to see created. I am NOT a computer programmer, so perhaps I can interest someone in doing this -- although it appears that I am the ONLY person who finds this Zone information useful!!
I would like to see a "Toggle Scripting" applet created that allow you to QUICKLY turn ON Scripting for the Internet Zone, the then quickly turn it OFF. This would allow you to search on a site WITHOUT having to decide which Zone it should go in. Therefore, you could search ZDNet when you wanted to -- without having to give ZDNet full permissions.
The registry entry that controls Scripting for the Internet zone is this:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
"1400"=dword:00000000
The code is simply 0=Enabled, 1=Prompt, and 3=Disabled. I have no idea what "2" does!. HOWEVER, you cannot simply create a few .reg fragments and use them to Toggle this OFF and ON -- I have tried to no success!
I suspect this relates to the "Flags". Those are frequently called "EditFlags" and they can control whether or not the registry can be edited. It appears to me that the registry is somehow preventing me from using .reg fragments to change the security level of the Internet Zone.
This is actually GOOD news -- that means a bad .reg fragment cannot easily sneak into your computer and change your Internet Zone settings as well! However, there must be some way around this...
Just brainstorming! If anyone's out there, let me know your thoughts! I won't hold my breath...:)
[text was edited by author 2001-05-26 09:33:20] | |
| Hi:
I suspect that IE is simply not picking up the Registry changes and using them -- they're in the Registry, just not being used. After merging your .REG file, have you checked the Registry to make sure the changes took? If they are there, then IE has simply not been prompted to use the changes.
I've seen this behavior with other programs. Unless you make a change through the program's interface, the changes in the Registry will not be recognized and used until you stop and restart the program in question.
Just a thought,
Eric L. Howes | |
| reply to R2
Re: Zoning Out! If you're interested in adding nasty domains/servers to your Restricted zone, you can find a more extensive list here:
»www.staff.uiuc.edu/~ehowes/resou···#IESPYAD
In fact, the above list is being updated on a regular basis.
Eric L. Howes | |
| reply to R2
Re: More options... I totally agree that a Toggle Switch is needed on the IE toolbar that allows the user to either switch a site to/from security zones, and/or provide a drop down menu to allow quick changes to scripting, active x, java, etc.
For your Microsoft example in your Trusted Zone, use the *. wildcard. Type *.microsoft.com into your Trusted Zones and you won't have to type all those other urls.
I am also very paranoid and have everthing in my Internet Zone disabled except for:
Prompt - Run ActiveX Controls and Plug-in. Acrobat Reader is the usual plug-in I find I need a lot.
Enable - Downloads. I want to be able to download when I feel like it.
Prompt - Submit nonencrypted form data. I find a lot of sites, like Google, that you need this turned on. I don't see a big security risk with this.
In my Trusted Sites I have those sites that I need to use ActiveX, Cookies, etc. I have just about everything set to PROMPT in my Trusted sites. I have sites like Mircrosoft in my Trusted sites because I need activex scripting to download their updates.
I don't "trust" the sites in my Trusted Zone, I still require a Prompt for almost everything.
By putting the sites I use a lot (that require cookies, activex,etc) into my Trusted Zone, I rarely get stuck in a web site where my Security settings get in the way.
[text was edited by author 2001-05-26 10:49:35] | |
R2R NotPremium,MVM
join:2000-09-18
Long Beach, CA
kudos:1 | reply to eburger68
Re: Zoning Out! Thanks, I had lost track of Spy-Ads. Now that I know more, I agree that the BEST answers is a good Hosts list with a good backup Restricted Zone.
I think it is a full time job keeping up with your new names, Eric!
Yes, I have regedit open and IE open. I "Merged" the files. I REFRESHED the screens multiple times -- and even open and closed the programs -- yet the entries did not change. Perhaps a reboot is needed?? But you certainly do not have to reboot to make these changes in IE... strange. | |
R2R NotPremium,MVM
join:2000-09-18
Long Beach, CA
kudos:1 | reply to bangaroo
Re: More options... I think I forget an equal amount as I learn each day. DUH!! Wildcards. YES, YES, YES.
Zones can use wildcards, Hosts cannot.
This is why I post my thoughts here -- I know someone will see my simple mistakes. Thank you, Joey T.
But I disagree with your use of Trusted sites. To me, they should be "Enabled" and not "Prompted". That is EXACTLY why I created the Prompt Zone -- for those sites I was not sure I trusted. Think about it. | |
| reply to R2
Re: Zoning Out! R2:
Yeah, my name shows up as eburger68 (same as in the @Guard forum), but I always sign my posts with my full name. Sorry for the confusion.
When you say you "refreshed the screens," if you're talking about View >> Refresh, then this probably isn't enough. I meant closing down IE entirely and relaunching it. If you've already tried that and it still didn't do the trick, then a complete reboot may be necessary, since IE is built into the OS in Win98 and above.
I'd first check the Registry with REGEDIT to make sure the REG file you merged actually got into the Registry.
Eric L. Howes | |
| reply to R2
Re: More options... Adding that Prompt Zone is pretty cool. I have never seen that done/suggested before.
I just try to avoid messing with my Registry whenever possible. I am definitely not a computer expert so I try not to go to places I don't belong.
"Trusted" is just a name. It could have been called Zone 2, or some other name. The way I see it, Microsoft has given us 3 zones (excluding the Local Intranet) to play with. There is nothing sacred about any of the 3 zones.
If someone wanted, they could have the security settings the same for all 3 zones.
Now that think about it, I could actually use the Restricted Zone to do want you are doing with your Prompt Zone. I don't have anything in my Restricted Zone (because my Internet Zone is very restrictive).
I don't know, I'll have to think about this some more! | |
R2R NotPremium,MVM
join:2000-09-18
Long Beach, CA
kudos:1
| I think there are good arguments for Disabling EVERYTHING in Restricted sites and making sure your Outlook and/or Outlook Express is in this site. I also think adding Eric's list (Spy-Ad) to the Restricted sites is very smart.
So, you should keep Restricted VERY restricted. Then, make Internet slightly less. I like Trusted to be REALLY trusted, and then Prompt is a good intermediate. I think this is logical.
The other option is to use "Local Intranet" as your most enabled zone. However, I would like to reserve this for when I truly have a home Intranet...
[text was edited by author 2001-05-26 11:33:43] | |
gwionwild colonial boyPremium,ExMod 2001-08
join:2000-12-28
Pittsburgh, PA
kudos:1 | reply to R2
Re: Zoning Out! I don't remember where, in their convoluted archive, I found this, but MS has an add on, too, for IE, tha adds dropdowns under "tools" to "add to [restricted/internet/trusted] zone." Very handy. Automatically adds the page url to the three major zones with a click. It's some sort of IE accessory pack, but ... does anyone know what I'm talking about? Darn, I wish I could remember this... I think it came out with 4.0, but it works fine with everything up to 5.5 I've tried.
--
Man will occasionally stumble over the truth, but most times he will pick himself up and carry on. - Sir Winston Churchill | |
|
