Microsoft Planning 'Lower Rights' IE 7.0

eWeek wrote:

A senior Microsoft executive on Monday confirmed that the upcoming Internet Explorer 7.0 browser upgrade will ship with reduced privilege mode turned on by default to help thwart browser-based hacking attacks.

During a strategic briefing on security at the TechEd conference, corporate VP of Microsoft Corp.'s Security Business & Technology Unit Gordon Mangione said IE 7.0 will be chock full of security and privacy enhancements, all aimed at addressing the biggest threats facing Web surfers today.

News source: eWeek

SOunds Good!

reduced privilege mode?
which means our normal operations will also be limited or something else?

footballism wrote:

reduced privilege mode?
which means our normal operations will also be limited or something else?

Bingo.

It basically means if you want to install a plugin you have to

Hold your breath
Stick your finger in your ear
Enter an administrative password
Agree to a ten-page EULA
Say "I assume all legal responsibility for any consequences in any way related to the installing of this plugin including but not limited to damage to this computer or data and it's not Microsoft's fault" three times

That all assumes the plugin is written in .NET managed code - if it's not written in .NET managed code you probably won't be able to install it at all without modifying your local system policy

I bet Macromedia Adobe is hard at work developing a .NET managed code version of Flash as we speak

Then that sucks:)

You obviously don't run as a limited user, it's not nearly that bad.

Limited users can run .Net Applets without any confirmation dialog even. It's not needed since the code is sandboxed anyway.

I admit, I was exaggerating.

Odd...

Firefox runs with the default account rights and I haven't had any problems with its security

W3bbo wrote:

Odd...

Firefox runs with the default account rights and I haven't had any problems with its security

Firefox reintroduces 7-year-old security flaw

I haven't had any problems with Firefox either. I never experienced anything fatal with IE when I used it, appart from the people who though it would be funny to have a link open a pop-up, which loaded a page that opened another pop-up with that same page in it. A nice little recursive effect if thats what you're after. The end-user however is unable to stop the flood of pop-ups unless they shut down the system. Always ruined my day.

As for the Limited User Account that Microsoft is pushing towards, I'm all for it. I'm sure that they will make the experience as transparent as possible. I don't run a LUA at the moment, although I have been planning to. I just keep forgetting everytime I format. I'll put a post-it note on my screen reminding me to the next time.

W3bbo wrote:

Odd...

Firefox runs with the default account rights and I haven't had any problems with its security

I thought it did...
Odd.

Oh, and good for Microsoft to drop priviledges... however, it shouldn't have to, all you naughty users running as admin!

W3bbo wrote:

Odd...

Firefox runs with the default account rights and I haven't had any problems with its security

By "default" do you mean, Administrative?

If not, then haven't you noticed that the auto-update is broken for LUAs?

For those wathcing this there's a post on the IE team blog now about this that shoudl help explain it. http://blogs.msdn.com/ie/archive/2005/06/09/427410.aspx

Beer28 wrote:

AndyC wrote: W3bbo wrote: Odd... Firefox runs with the default account rights and I haven't had any problems with its security By "default" do you mean, Administrative? If not, then haven't you noticed that the auto-update is broken for LUAs?

Firefox on linux runs as the user that invoked the firefox process. All data is kept in the /home/user/.mozilla/firefox and the one shell script to launch it from lib is in /usr/bin

It is not administrative by default because nobody on linux runs their desktop as root.

What a load of crap - everyone - unless in a locked down organisation would run as root, just as everyone runs as administrator in windows.

Buzza wrote:

What a load of crap - everyone - unless in a locked down organisation would run as root, just as everyone runs as administrator in windows.

On the contrary, Linux distributions generally make it incredibly difficult to run as root (Mac OS X goes one step further and actually disables root by default)

This is one of the things that *nix based OS do better than Windows (mainly due to the history of their development)

AndyC wrote:

Buzza wrote: What a load of crap - everyone - unless in a locked down organisation would run as root, just as everyone runs as administrator in windows.

On the contrary, Linux distributions generally make it incredibly difficult to run as root (Mac OS X goes one step further and actually disables root by default)

This is one of the things that *nix based OS do better than Windows (mainly due to the history of their development)

ahem - 3 distros - FC4, Suse and Solaris all let me install and I only have to specify a password for root, it DOES NOT MAKE ME CREATE A NEW USER WITH LOWER PRIV.

Show me where it FORCES u to create a user in your 'distros'

AndyC wrote:

(Mac OS X goes one step further and actually disables root by default)

Some Linux distros do the same.

Erisan wrote:

AndyC wrote: (Mac OS X goes one step further and actually disables root by default)

Some Linux distros do the same.

How can you enable root (if root is disabled) to install software, a RPM for instance?