'Lower Rights' IE 7.0 Coming

blacktop writes "eWeek has official confirmation from a Microsoft vice president that the upcoming Internet Explorer 7.0 browser upgrade will ship with reduced privilege mode turned on by default to help thwart browser-based attacks. In addition to anti-phishing and anti-spoofing features, IE 7.0 will add support for IDN (International Domain Names), built-in RSS and seamless search that will include choices of search providers."

Comments

Interesting

[James_Duncan8181]

So Microsoft are finally properly going at a least-rights solution, but on a per app basis? This is quite a concession, as it shows that the MS campaign to have people not run as admin is not really working at all in the real world. There are still far, far too many shops who are used to coding for 9x to make multiuser practical, even among coders who should know better (I'm looking at you EA/Medal of Honor!).

The other way that this will be fun is watching all of the *really* bad ISVs who assume that IE is a complete solution for their apps and will of course be able to alter the system config when they use it as a component.

And you thought SP2 broke things? *laughs evily*

Will only work if ActiveX is disabled by default

[Motherfucking Shit]

From TFA,

The enhancements will build on the Security Zones feature in current versions of IE that allows customers to prevent untrusted Web sites from invoking ActiveX controls.

Sounds to me like ActiveX will still be enabled by default, they're just going to improve on the ability to block it on a per-domain basis instead of a per-zone basis. This isn't enough. IMO, ActiveX is the biggest (non-bug) avenue by which users become infected with all sorts of shit. It needs to be outright disabled out of the box if IE is going to get serious about security.

The conundrum is that so many sites now require ActiveX that if IE were to ship with it disabled, Joe Sixpack's favorite websites wouldn't work.

Ok...

[http101]

Who the hell titles these articles? Lower rights and Lower permissions mean completely different things...

If MS is adding support for IDN, I'm really going to stick with Mozilla. Does anyone remember the IDN spoofing exploit from Firefox on February 7, 2005? http://secunia.com/multiple_browsers_idn_spoofing_ test/

Let's hope MS caps this hole before it happens. Unfortunately, MS has a reputation for adding bugs along with new features.