IE7 at RSA San Francisco

Extended Validation Guidelines v1 Released!

IEBlog — Wed, 13 Jun 2007 04:57:17 GMT

I’ve talked several times in the past about Extended Validation SSL certificates and how they are a great

re: IE7 at RSA San Francisco

EricLaw [MSFT] — Fri, 09 Feb 2007 01:30:58 GMT

@Alex: Nice catch, and your analysis is spot on.

This bug was only discovered after we shipped IE7; we'll be fixing it in a future version.

Un milion de încercări de phishing pe săptămână

Weblogul lui Zoli — Thu, 08 Feb 2007 15:49:18 GMT

Atât oprește Phishing Filter-ul din IE7 . De la lansarea lui în octombrie, Internet Explorer 7 a blocat

re: IE7 at RSA San Francisco

TMaster — Thu, 08 Feb 2007 09:23:11 GMT

Sandi, thank you!

I wasn't so much surprised the Woodgrove Bank side had a red bar, it made sense to me, since I knew it was self-signed. Sorry if I didn't make this clear.

However, your comment that the certificate revocation has to be enabled solved the problem for me. I doubt this is the default setting anyway, I just cannot remember turning it off.

I guess this was an obvious case of PEBKAC. And thanks to Eric for the reply as well =)

re: IE7 at RSA San Francisco

Alex — Thu, 08 Feb 2007 04:40:12 GMT

I found a very tiny bug in the Address Bar when using EV SSL Certificates, see the image at this url (nevermind the JPEG-corruption):

http://swb.alex-media.nl/photos/C11184B4-C845-E8B2-EB1F-CD4394DB6A82.jpg

What you're looking at: the company name should be 'Charles Schwab & Co., Inc. [US]'. You see: 'Charles Schwab _Co., Inc. [US]'

The problem is caused by the company name having an ampersand in it. It is displayed as a _ because that's Windows mnemonic-key. When you click on the icon, the correct company name is displayed.

re: IE7 at RSA San Francisco

EricLaw [MSFT] — Thu, 08 Feb 2007 01:01:06 GMT

@say2joe: Remove the "Go" button from the Addressbar in your task bar by opening Windows Explorer (not IE) and right-clicking on the "Go" button there, then unchecking "Go button".

@Viktor Krammer: Yes, SecureLockIconConstant would be a good start, but at the moment, we don't expose a good way for extensions to grab the certificate itself, so the constant alone likely would not be enough.

@Jerry Pisk: The issue is that there's no standard for what type of validation is performed for a non-EV certificate. Each CA sets their own policies, and some are stronger than others. In contrast, the EV guidelines that IE7 supports specify the exact bar for vetting the identity information for all CAs.

Implying that non-EV SSL isn't trustworthy isn't exactly correct; it's fair to say that it ensures the privacy and integrity of the connection, but provides only limited verification of the identity of the remote server. At a minimum, it ensures that the registered owner of the domain name (which itself be misleading) is able to respond to certificate registration confirmation mails.

Hence, EV was created to offer a higher and standardized level of assurance of the identity of the remote server.

re: IE7 at RSA San Francisco

Aedrin — Wed, 07 Feb 2007 21:17:09 GMT

"Since I installed IE7 I have had MAJOR hiccups of one kind or another....... now it won't even load up pages of ANY sort...........

I am on Windows XP (home) and do NOT intend to go over to VISTA because it is a wannabe MAC platform and I should have gone Mac instead of staying with windows because it just keeps crashing and crashing and hanging and hanging!"

The obligatory car reference:

If people who owned cars kept buying all these third party components and never got it serviced, how long do you think it would last?

Do you really think a Mac will improve your experience?

Are you a victim of marketing lies?

re: IE7 and Go button (Address Bar)

say2joe — Wed, 07 Feb 2007 19:03:52 GMT

How can the Go button (used with the Address Bar on the Taskbar) be removed now that the option to remove it is no longer included with IE7 Advanced Options? I've already done a few searches of the registry with no success.

I'm using XP Pro with IE7 (/w latest updates).

IE7 is HORRIBLE!

islander — Wed, 07 Feb 2007 15:32:11 GMT

Since I installed IE7 I have had MAJOR hiccups of one kind or another....... now it won't even load up pages of ANY sort...........

I don't know way there is a new UNimproved version of IE for non techies..........

re: IE7 at RSA San Francisco

Viktor Krammer — Wed, 07 Feb 2007 13:41:31 GMT

@IE team

It would be nice if you could add a new SecureLockIconConstant identifying EV SSL connections to the DWebBrowserEvents2::SetSecureLockIcon event so that security add-ons for IE can take advantage of the new EV certificates as well.

Regarding UI flickering: The status bar and the small edge between the tab bar and the actual Web content frame still flickers if switching tabs.

Any plans on allowing us to report bugs we find in IE again? The connect bug database was a good approach, but was unfortunately turned off after RTM.

Besides, congratulations on launching Vista and EV SSL.