For those of you not aware Microsoft will be releasing Internet Explorer 7 in early 2006. With IE7 well on the way Microsoft has started releasing updates on a regular basis detailing the changes they are making to Internet Explorer and what they will mean to the end user. Even a casual read of the IE7 blog and you are well aware that security is the word of the day when looking at IE7. From moving the security lock to the address bar, to changing the color of the address bar when at a malicious site; every detail of Internet Explorer has been looked at trying to make users safer and secure online. This article will look at the web content zones what they are and how they will change in Internet Explorer 7.
What is a Web Content Zone
Currently Internet Explorer classifies websites as either an Internet site (that is a site accessed on an outside network), local intranet (a site accessed from a local network), trusted site (those sites you trust to install and run code on your computer, and restricted sites (those sites which are probably dangerous and will try to infect your browser and operating system with spyware or something similar). As the names imply different levels of trust are given to different site types.
If you want a real life example think of these zones as how you classify people. The Internet zone is like meeting someone on the street you will probably not outright shun this person but are not likely to give him the keys to your car either (unless he is a valet). The Intranet Zone is like your coworkers most of us feel fairly safe with our coworkers and would not object to having them come over to the house for a barbecue. The Trusted Zone is like your doctor you trust him or her with your life and health. Finally the Restricted Zone is like your cousin's friend who got out of prison for armed robbery while you may have to tolerate him you will watch him when he is in your house and probably not leave him to babysit your kids.
As with meeting people security zones let you the user define a specific behaviors for your browser when visiting a site online. If you are using GMail and you are prompted to install an active control every time you visit the site then you will probably get tired of being prompted, conversely if you are tricked into visiting a malicious site through spam then you probably want to be notified if they want to install something on your computer.
Protected Mode, Medium High, EOLAS how the Internet Zone has been Changed
The default zone setting for the Internet zone has been changed from medium to Medium-High or what Microsoft is calling protected mode. This change has been made to help prevent and hopefully reduce the attacks that IE has been plagued with in the past. Another new feature is the ActiveX opt in, which while Microsoft is billing as a feature to "reduce potential damage from malicious Active X controls in the Internet zone" is really the result of a the EOLAS law suit settlement an excellent description of which can be found below. I do find it ironic that the most significant change in Internet Zone security and the thing that people complain about the most when comparing IE to Firefox was settled through a lawsuit not for security but patent infringement.
http://patentlaw.typepad.com/patent/2004/12/eolas_v_microso.htmlZone Spoofing
While I don't agree with the many in the web development community that this will be crushing blow to online development, frankly it is not that big of a deal (instead of browser plug ins installing without asking your approval you will be prompted to install them). I do agree that the implementation will take a while for people to get used to. Just as the web development community moved on from Windows XP Service Pack 2 they will adapt to IE after the Eolas agreement. Enough of that lets continue to look at the various zones in IE and how they will change in IE7.
Intranet Zone Possible Liability Why is it There?
The first problem you probably noticed with my description of these zones is that not all these zones are useful to everyone. Seriously at home how often do home users set up a intranet with an internal website that they then regular use to access resources from the network, overwhelmingly the answer is probably not often. Hence this zone is not really useful to home users, so Microsoft changed the default behavior of IE to treat the intranet zone as it would treat the Internet zone. While the benefit of this is not readily apparent it can help forestall some spyware that uses this vulnerability in IE to install their software on you computer without your knowledge. This particular attack called Zone-Spoofing basically tricks your browser into treating their bad site as one you trust. For more information on zone spoofing read this article below:
So what happens if you are on a Domain, well in that case Internet Explorer will auto detect the intranet sites on your domain and apply the appropriate zone settings to these sites. If however a Site Administrator wants to change the default behaviors they can do so by adjusting the settings in the Group Policy editor much easier than if they wanted to do the same thing for IE6.
Trusted Zones Not So Trusted Anymore
The biggest change in the zone setup in my mind is the trusted site zone. Users of online software such as MLS Platforms (multiple listing service), CMS portals (Content Management Systems) and other online applications may need to tweak their settings for this zone after updating to IE7. Previously Trusted Zone sites were given a lot of freedom, like with your doctor until they do something really wrong you generally trust their judgment. With IE7 the default zone setting has been changed from low to medium now while that does not sound like a lot that is the difference between an acquaintance on the street and your doctor in our human relationship example. The part that confuses me is that Microsoft is saying that users can lower security settings for this zone if they need (recognizing they probably will) so why do it? Or better yet why not users adjust the security for specific sites in the zone rather than applying templates across the entire zone?
Link: IEBlog : Dude, where’s my intranet zone? (… and more about the changes to IE7 security zones).
