Microsoft Announces New Security for Internet Explorer 4.0

Will added complexity make your life simpler? Analyst says Microsoft didn%squott go far enough.

Randy Legge, Special to PC World

• Email
• RSS
• 0 Comments

The final release of IE 4.0, due this summer, will incorporate special security zones and updated certificate technology. Some of the new browser features plug some big holes. They include:

• The capacity to establish special %dquotSecurity Zones.%dquot

• The ability to specify which Java, Applets, and ActiveX controls runs on a network.

• Control over which aspects of Java can run in an application.

• Updated VeriSign Authenticode technology (the old Authenticode will expire at the end of June).

• Access to a new Web site dedicated to educating users on Net security issues.

Perhaps the most unique update, Security Zones, allows users to divide the Web into separate, predefined areas: Intranet, Trusted Extranet, General Internet, and Untrusted. Microsoft claims such a system would allow control of scripts, applets, ActiveX controls, Java Applets, active content, and the like.

This means a plumbing company, for instance, could assign a known supplier to a %dquottrusted%dquot zone for regular transactions using applets or other control technology, while relegating unknowns to a %dquotsandbox%dquot area where potentially destructive controls couldn%squott harm user files.

Enhancements to Authenticode add status-checking features for the more than 15 million IE 3.0 users. The status-checking capability allows verification of signatures by cross-referencing them with the publisher%squots certificate license. Authenticode will also provide revocation features.

The question, though, is whether Microsoft is really simplifying security issues or magnifying the problem in order to create an advantage over rival Netscape?

%dquotI don%squott think so,%dquot said Carl Howe, a Forrester Research analyst. %dquotThe concept of zones is probably what customers have asked for and simplifies security issues. But Microsoft didn%squott go far enough. If you are going to use certificates, why not use them everywhere? Not everyone uses Internet Explorer. They should really make their entire operating system more secure.%dquot

The no-cost Internet Explorer has been plagued with a rash of security bugs lately, including several in the still-to-be-released 4.0.

• Email
• Print
• RSS