Microsoft Is Confident In Security of Edge Browser

jones_supa writes: It's no secret that Internet Explorer has always been criticized for its poor security, so with the Edge web browser (previously known as Spartan), Microsoft is trying to tackle this problem more effectively and make sure that users consider it at least as good as Chrome and Firefox. In a blog post, Microsoft details the security enhancements available in Edge, pointing out that most of the changes it made to the new browser make it much more secure than Internet Explorer. There is more protection against trickery, app containers are used as the sandbox mechanism, and protection against memory corruption is better. Old, insecure plugin interfaces are not supported at all: VML, VBScript, Toolbars, BHOs, and ActiveX are all nuked from the orbit.

Comments

How hard will this break Corp Intranet apps?

[disposable60]

So all those corporate intranet apps that stupidly require IE - how hard will Edge break those?

Re:How hard will this break Corp Intranet apps?

[Shados]

hard enough that IE11 will still be supported for a while in parallel.

Thats the whole point of Edge. So that Microsoft can have a real browser without leaving the big corps legacy shit behind.

Re:How hard will this break Corp Intranet apps?

[Anonymous Coward]

At least we won't have to retrain all the users! "Yeah, yeah, just click on the 'E' to go the the Internet. What? It looks a little different this year? Oh, that's because Al Gore changed the icon in his latest patch. Don't worry about it."

Re:How hard will this break Corp Intranet apps?

[peragrin]

Why were you stupid enough to write apps that only ever worked in IE to begin with?

Don't blame microsoft for your stupidity. We have enough to blame Microsoft for that is legitimately their fault.

Re:How hard will this break Corp Intranet apps?

[MachineShedFred]

Write against a vendor locked-in API, get vendor locked-in.

Re:How hard will this break Corp Intranet apps?

[drakaan]

If only I had mod points. I write .net web apps all the time, and for businesses, and I test in IE *last* because first and foremost, I want it to work in the future, which means for mostly-standards-compliant browsers. Writing IE-specific code is an extremely bad plan. Not all browsers are running on windows desktops or laptops.

Re: How hard will this break Corp Intranet apps?

[VTBlue]

Not true. Microsoft has thought this scenario true thoroughly. Corporations can configure Windows to only launch IE whitelisted domains or sites. This way organizations can default to Edge for general usage while whitelisting legacy apps or apps that have legacy headers.

Re:How hard will this break Corp Intranet apps?

[sycodon]

Some of us have to write .net in the environment provided and using the rules provided. In the case of my major defense company employer, that is VS/SQLServer/.NET/IE only.

Re: How hard will this break Corp Intranet apps?

[LordLimecat]

Im pretty sure you cant control user-side GPOs or IE settings from a HTML header.

Talk the talk, but doesn't walk the walk...

[QuietLagoon]

Microsoft always talks big about security, but time shows that it is just talk.

.
Remember when Microsoft declared the buffer overflow bugs were eliminated from Windows XP?

Re:Talk the talk, but doesn't walk the walk...

[gstoddart]

The problem is that new code is just that ... new and untested.

So you build something new from scratch and say "wow, we did awesome at teh security". Well, OK, now you release it into the wild and wait for people to abuse it -- that's when you find out how well you've done.

Any new code is going to have the problem, because it hasn't been field tested or through several iterations.

It's all well and good for Microsoft to say "nailed it". That doesn't make it true. So I think it's probably safe to assume that unless Microsoft has done something remarkable, there's probably a bunch of places where they haven't fully locked it down.

Secure?

[afidel]

They support WebGL which is going to be the next attack vector as well as continuing to support flash with sandboxing that the hackers will tear to shreds in short order.

This is project proposal V 1.0.

[140Mandak262Jamuna]

A great news to many is that old unsecure plugin interfaces are not supported at all: VML, VBScript, Toolbars, BHOs, and ActiveX are all nuked from the orbit

This looks like what the dev team presented to the upper management about what it wants to do. It will undergo several iterations. Some powerful customer will demand some interface to be supported or else... Some managers will insist on some form of backward compatibility mode. Some bing! advertisement people would ask for "special" interfaces to their team to let them "leverage" & "synergy" and other buzzword bingo stuff. There will be compromises. Some managers will insist with straight face, "yes, yes, this scripting interface is supported, but we say very clearly in the documentation it is not to be used for fresh code and it is to be used only for backward compatibility reasons, so it is not a security threat".

Finally they will be wondering why security was compromised, and blame it on the open source zealots and prejudice among the uninformed and marketing by competitors and assure themselves "it is not our fault, we did not do anything wrong".

Re:This is project proposal V 1.0.

[afidel]

Some powerful customer will demand some interface to be supported or else

No, they're shipping IE11 with enterprise compatibility mode to support back to IE8 quirks which will be fine for 99+% of their customers for legacy apps. Trust me, most of their customers are going to be happy to have a standards compliant browser as the default, the only trick will be in the mechanism to kick user over when they try to go to a corporate site that needs classic IE within Edge and keeping that mechanism from being abused by the bad guys.

Possibilities

[Ol Olsoc]

Microsoft is always confident.

But as a long time hater of Redmond products, am I sensing some sort of sea change?

It's just within the realm of possibilities that the Ballmer days of "When I want your opinion, I'll tell you what it is," are over? In more than just name?

I intend to give them a chance here, maybe its the same old Microsoft. Maybe not.

Re:The first edition

[Ark42]

Except it's really effectively Trident 8.0 / IE 12. Only, they forked it and removed all the legacy support from it, then left a copy of Trident 7.0 / IE 11 around in case you need legacy support still. So it's not really the first version of anything, and it's not like it's completely from-scratch code.