Security issues in IE

[WhiteCrow]

Oh what a surprise - some more security problems have been highlighted in Internet Explorer.

It's hard for me to talk about this one, as I really can't stand Internet Explorer, the best thing I ever did was switch to Firefox, which is years ahead of IE. I can't be bothered with people who switch to IE then complain when they're hit by yet another virus.

If you're reading this on IE then ...

http://news.bbc.co.uk/1/hi/technology/7784908.stm

Users of Microsoft's Internet Explorer are being urged by experts to switch to a rival until a serious security flaw has been fixed.

The flaw in Microsoft's Internet Explorer could allow criminals to take control of people's computers and steal their passwords, internet experts say.

Microsoft urged people to be vigilant while it investigated and prepared an emergency patch to resolve it.

http://www.bbc.co.uk/blogs/technolog...o_explore.html

If the average computer user read the Microsoft security advisory about the Internet Explorer vulnerability - and you'd struggle to find it if you weren't looking - you might be none the wiser about how serious this was, or what action you should take.

A long way down comes this line: "An attacker who successfully exploited this vulnerability could gain the same user rights as the local user." As far as I understand it, that means there is a real danger that Internet Explorer 7 users (and possibly users of other versions of IE) could be opening the door to cyber criminals to allow them to ransack the contents of your hard drive. In other words, it is a pretty serious situation.

So when I spoke to John Curran, head of Windows at Microsoft UK, I had three questions.

1. How serious is this?

Mr Curran told me that only a tiny proportion of websites were infected, but given the sheer scale of today's web, that could affect a large number of people.
So, he said, "it is certainly something people should take seriously."

2. So what should IE users do?

Microsoft is working on a patch but in the meantime Mr Curran said there were four steps to take.
- make sure anti-virus software is up to date.
- run Internet Explorer 7 or 8 in "protected mode".
- set Internet Explorer zone security setting to "High"
- Windows users should enable Automatic Updates so that they get any patch that is issued.

But of course doing all of that is not only time-consuming, it will make your web browsing experience slower and less rewarding. Which brings us to the final question.

3. Shouldn't you switch to another browser until the patch come out?

This has been the advice of a number of security firms - who of course are also touting their latest anti-virus products - but you won't be surprised to hear that Mr Curran disagrees. He told me he had recently seen a report which listed another browser as having the highest number of vulnerabilities. "it would not be advisable," he said,"to send people from one vulnerability (in Internet Explorer) to multiple vulnerabilities."

But given the choice between messing around with Internet Explorer and so enduring a second-rate browsing experience until the hole is fixed, or running Firefox, Safari or Opera, aren't quite a few people likely to switch? This could be the moment when the minnows in the browser wars finally score a significant victory.

[Zbigniev Hamson]

I personally tried Firefox for the first time a few days ago and couldn't get on with it at all. I might give it another go at some point seeing as people keep going on about it, but for now it's uninstalled and gone.

Security issues aside, it just comes down to personal choice and preference, and some people will prefer one or the other and that's that. You can't really convince them otherwise and it doesn't mean they are "wrong" either. People who condemn IE users out of hand deserve the same fate as Mac and Linux nerds really. And that fate is, of course, instant death Mind you, it's the same mindset that's been going on since C64 and Spectrum owners were constantly belittling each other for being "wrong".

[Dirk Gently]

I wonder if it is rival companies that keep attacking I.E.

[WhiteCrow]

I wonder if it is rival companies that keep attacking I.E.

No if the world worked like that don't you think it'd be Bill Gates making a virus to bring down the competition.

I still rank IE users as Neanderthols, who probably don't understand how a wheel works.

[Dirk Gently]

No if the world worked like that don't you think it'd be Bill Gates making a virus to bring down the competition.

Who's to say he isn't?

[Zbigniev Hamson]

I still rank IE users as Neanderthols, who probably don't understand how a wheel works.

I bet you owned an Amstrad

[Pip Madeley]

I'm giving Chrome a try. Not bad so far.

[Si Hunt]

I'm just waiting to see if it's possible to be any MORE personally insulted by Mike simply for not having changed a bit of software on my computer.

Si.

[Jon Masters]

I'm just waiting to see if it's possible to be any MORE personally insulted by Mike simply for not having changed a bit of software on my computer.

Si.

Me sTiLL uses IE5. Jon say Ugg.

[WhiteCrow]

Me sTiLL uses IE5. Jon say Ugg.

Thats okay, so does he ...



I bet your inbox looks something like this too ...

[Zbigniev Hamson]

You could just say something like "I personally find that Firefox is a much better bit of software than IE and I recommend everyone to give it a go and see if they agree", without resorting to calling people Neanderthols (sic)

[SiHart]

Absolutely.

You know we're not all technically minded here Mike. There are better ways of getting the Firefox message out there. People still have the choice what browser they use, and people are perfectly entitled to use IE if they wish (as indeed I did until recently).

Si xx

[WhiteCrow]

You know we're not all technically minded here Mike.

Hence why I've put this up, as people could do with being vigilant about this.

In Jon's case, still using IE5, there are real dangers. I know we moan when Microsoft puts out another update. But mainly those updates exist to plug holes in security. IE7 is more secure than IE5.

Okay you can still use your IE application, and Microsoft are working on a fix, but will you be actively looking for it? Or not bother to update?

I used to use IE until 2004, when I and many people I knew were hit by pop-ups, viruses and trojan dialers. A friend recommended Firefox to me. It has built in virus checking, scans any file you download, popup blockers, tab features, warns you if you've followed a link to a suspected pfishing site etc.

Although the most recent version of IE is a huge improvement, it still lags behind Firefox.

Our advice in work today ...

As you may have seen in the news, Microsoft has identified a serious problem with Internet Explorer which could allow misuse of your PC allowing others to take control and steal information including passwords.



Microsoft is urgently investigating and preparing an emergency fix. We do not as yet know the timescale for this. In the meantime, BAE Systems is taking the following pro-active steps this evening (16 December 2008) to protect our networks:



1. Shutting down access to all internet shopping sites as they currently represent the greatest risk



2. Increasing the ?Internet Zone? security level from Medium to High. This means that when you attempt to access internet sites you may see the pop-up message below which will ask you if you trust the site that you are visiting. It is your responsibility to ensure you conform to the BAE Systems IT acceptable use policy before you enter any external internet site.

[Si Hunt]

The trouble is, if there's one thing less likely to make me switch software it's if the suggestion comes by suddenly being told I'm a caveman who "probably doesn't understand how a wheel works". That just makes me more determined not to be bullied into it I'm afraid.

Si.

[Jeff]

The trouble is, if there's one thing less likely to make me switch software it's if the suggestion comes by suddenly being told I'm a caveman who "probably doesn't understand how a wheel works". That just makes me more determined not to be bullied into it I'm afraid.

Si.

Firefox. So easy a caveman can do it.

http://uk.youtube.com/watch?v=3F3qzfTCDG4

[WhiteCrow]

I actually called IE users Neanderthals, not Cavemen! Although granted I couldn't help but use Captain Caveman as a joke for someone still using IE5.

But what makes anyone think they are so much better than a caveman that some people find it objectionable? In evolutionary terms we're the same.

http://en.wikipedia.org/wiki/Caveman

Caveman

The term has been discouraged in serious use, because of its inaccuracy and dependence on certain misconceptions about early humans.

"Cavemen" were of largely similar intelligence to modern humans

[Zbigniev Hamson]

Very nice trick that. Clearly use a term in a derogatory fashion, then turn the tables against anyone who complains by pretending it wasn't derogatory at all. If I was the suspicious type I might suspect you were deliberately trying to wind people up

[WhiteCrow]

I'm still waiting for people to explain to me how a wheel works, and what makes it so revolutionary.

I used the term "Neandertal", because it can be used to describe an evolutionary dead end. What I kind of feel IE is because it's just not innivotive enough.

Even so, where was the soul who said "no - you're mistaken, you're mocking people's tool usage, and yet neandertals were of comparable intelligence to homo sapiens, and their tools as equally effective"?

http://news.bbc.co.uk/1/hi/sci/tech/7582912.stm

And for those people willing to take another swipe at "cavemen", have you ever tried to make a spear or fire from first principles ... and no I don't mean by striking a match. It's hard work!

We think because we can find the on-button on a computer, or operate a mobile phone we're evolutionarily superior - which is an attitude Douglas Adams mocked countless times.

[WhiteCrow]

In other news ...

http://news.bbc.co.uk/1/hi/technology/7787445.stm

Microsoft is due to issue a patch to fix a security flaw believed to have affected as many as 10,000 websites.

The emergency patch should be available from 1800 GMT on 17 December, Microsoft has said.

The flaw in Microsoft's Internet Explorer browser could allow criminals to take control of people's computers and steal passwords.

[Jeff]

A neanderthal would have less advanced technology than people of the modern era; I have a hard time understanding how Mike's comment can be taken as anything other than a generalised, lighthearted commentary about people willingly choosing technology he sees as less advanced, and expressing his puzzlement as to why anyone would choose "a horse and buggy" to a modern automobile, whilst at the same time expressing his opinion that the difference between the two products is that large.

Honestly, the response here is almost worthy of the absurdity thread. It's funny how when an "odd or unusual" news story about Political Correctness gone awry pops up everyone shakes their head at it, but then as soon as someone says something mildly politically incorrect everyone is kicking up a fuss and crying foul. Heaven forbid anyone on the planet ever says anything someone else on the planet doesn't like. FFS!

[Si Hunt]

That's not true Jeff. It's not the historical accuracy of the insult! It was the "anyone who hasn't got this is an idiot" vibe to it.

But I'm not THAT bothered, so that's my final word on it.

Merry Christmas!

Si.

[Lissa]

We will reach a stage where banks and credit card companies might refuse to reimburse someone who is defrauded while using an old or insecure browser. It's no different to your insurance company giving you the skunk eye and little else if your car is stolen because you don't lock it at night.

IE7 has one of the worst user interfaces I've ever seen and is a massive step back from IE6 in terms of basic usability. But it is more secure and more functional than its predecessors so IE loyalists really ought to upgrade to the latest version. Not because it's cool or snazzy but because it's safer and could save you from an awful lot of messy fraud.

[Si Hunt]

See, with no respect to Lissa, I really don't understand how we can have such differing views on the same application. I'm using EI7 and I find it easy to use. Out of curiosity (and I know you'll enjoy telling me!) what exactly is so bad about it?

Si.

[Zbigniev Hamson]

I use it too and find it pretty much identical in fucntionality to IE6, except with a more compact and less obtrusive interface that still manages to have all the buttons and options there, plus a search bar and tabs too.

In my (admittedly very short) time with Firefox I didn't see much that was different, except the interface took up more space, it didn't seem to want to install Flash at all, and the tabs seemed fiddlier to use. I also didn't like the way the pull down address bar has a massive font and takes 2 lines up oer website, meaning you can only see about 5 at a time. I presume you can customise a lot of this and get it how you like it, but it certainly didn't leap out as being immediately and obviously better to IE. Really it just seemed like it did the same things, but differently.

In any case, there's not really a lot I want a web browser to DO. As long as it can display websites then what's the problem? It's not like most software you'd use where all the functionality in the program itself, browsers are just a window and it's the websites themselves that have all the funcionality.

[Zbigniev Hamson]

I'm using EI7 and I find it easy to use.

Is that from Old McDonald Enterprises?