Re: New IE security advice from Microsoft -- WEB400

Anton Gombkötö wrote:

Hi Hans,

As someone else suggested, the best advice that MS could have given
would be to uninstall IE and use some alternative browser like
Mozilla or Opera. But we all know how likely that is.

But the whole issue about entering the links, because they can be
faked in the address line in IE (and some others, too), is almost the
same as a link looking proper and with JavaScript's onClick the page
does whatever it wants, e.g. opening a window with another address but
without address bar, so the user can't even notice.

That would be the same in many other browsers, too, wouldn't it? And
it is a way chosen by many more or less reputable sites.

Stepping into someones shop is dangerous. He might try to sell you
rubbish at a much too high price. It's pretty much the same in the
internet. Await the worst, then you can only be surprised in a
positive way. (The problem with that rule is that i imagine things not
bad enough in the first place :-)

I don't want to defend M$, neither do they have the need for my
efforts nor do i think they deserve it, but this whole thing implies
to the reader that clicking on a link in a non-M$ browser is safe. It
might be safer, because they invested more than marketing in security
thoughts, but it isn't safe.

0.02 Euro

Anton: Certainly, some links are best left un-clicked, no matter what the browser. For example, links in messages in public guest books.

But as I understand the problem, the nature of the holes in IE are such that you can go to fake site, and there is nothing to suggest that you are anywhere else but a legitimate site. That is, in a proper browser, the address line would show the complete URL, like say for example, "http://www.ibm.com/%01@xxxxxxxxxxxxxxxxxxxx/fleece-visitor.html."; But in IE, you'd see just "http://www.ibm.com/";, and quite possibly you wouldn't think twice when prompted for a customer number or a credit card number.

It's just an interesting bit of news that MS *themselves* have said that one way to protect yourself from possible exploits is to manually cut and paste URL's into the address bar!

Anyways, AFAIK, MS is planning on /eventually/ releasing fixes for the recently disclosed holes, including disallowing '@' in URL's, a feature that's not commonly used anyways. Before that happens, take this as a good motivator to install and use a decent browser, like Mozilla. It used to be that IE was the leading edge in browser technology. But now that's no longer true.

Cheers! Hans