IE8 Security Part VIII: SmartScreen Filter Release Candidate Update

End to End Trust and Windows 7

Windows Security Blog — Tue, 21 Apr 2009 20:53:14 GMT

I attended Scott Charney’s keynote this morning at RSA – Moving Towards End to End Trust

re: IE8 Security Part VIII: SmartScreen Filter Release Candidate Update

EricLaw [MSFT] — Tue, 24 Mar 2009 18:26:14 GMT

@Manoj: This is a limitation introduced by IE8's multiple-process "LCIE" architecture. The user's choice to accept an invalid certificate is not brokered to new processes as they are created for popup windows or new tabs.

We broker most other state (including cookies, HTTP authentication, etc) but unfortunately did not have a chance to fix this corner case.

re: IE8 Security Part VIII: SmartScreen Filter Release Candidate Update

Manoj — Tue, 24 Mar 2009 09:25:03 GMT

I open a HTTPS URL in IE8 which uses invalid cert(expired/CA not trusted/subject name mismatch), I get "There is a problem with this website's security certificate" message which gives me option to continue or to close the web page. if I continue, I get the webpage loaded in the browser. if I open a link in this webpage in a new tab or if that webpage opens a pop-up, IE8 is again presenting me the 'There is a problem with cert..' message. this never used to happen in IE7. is this a change in behaviour? or a bug in IE8?

Internet Explorer 8 Final Available Now

IEBlog — Thu, 19 Mar 2009 19:35:18 GMT

Today we’re excited to release the final build of Internet Explorer 8 in 25 languages. IE8 makes what

re: IE8 Security Part VIII: SmartScreen Filter Release Candidate Update

Rob Parsons — Thu, 12 Feb 2009 08:29:05 GMT

FWP - The Add/Remove Programs block turned out to be part of the XP virtual machines original settings.

Use SCF in conjuction with Untrusted sites lists to protect your users and networks.

Just goes to show that security is n-tier. The weakest link is the keyboard nut.

re: IE8 Security Part VIII: SmartScreen Filter Release Candidate Update

Ron — Wed, 11 Feb 2009 18:54:58 GMT

<<I am so glad that Firefox is my default browser>>

you know that firefox has addons that cannot be uninstalled without hunting down obscure config options, right? thats why they provide a step by step list of files and folders to manually mess with: //kb.mozillazine.org/Firefox_:_FAQs_:_Uninstall_Extensions

IE and firefox aren't that different. Don't install junk addons you don't want, and everythings just fine.

re: IE8 Security Part VIII: SmartScreen Filter Release Candidate Update

Oliver — Wed, 11 Feb 2009 18:49:10 GMT

Sage and Will have apparently been living under a rock for the last few decades. Guys, Gooogle for "Microsoft anti-competitive" and learn why it might not be such a bright idea to deliberately block other ppl's non-malicious software, even if lots of ppl want them to.

If Rob can show that Group Policy changes are made (instead of making a bold unproven claim here) I bet that the MS guys will block that junk right away.

re: IE8 Security Part VIII: SmartScreen Filter Release Candidate Update

gerald — Wed, 11 Feb 2009 17:58:37 GMT

Indeed.

If an addon/toolbar/program does not have a built in (un-hindered) uninstall that registers in the add/remove programs dialog then IT IS UNFIT for installation, PERIOD.

If Rob Parsons' comments are correct, and the uninstall is blocked, then this software is officially malware.

Every time I read this stuff I am so glad that Firefox is my default browser and where I install my addons.

re: IE8 Security Part VIII: SmartScreen Filter Release Candidate Update

Rob Parsons — Wed, 11 Feb 2009 14:55:50 GMT

FunWebProducts - Seems like I started a bar fight.(unintentional)

Guys & Girls (and Will) - give Eric and MS a brake. The bad guys are continually testing the waters to fend off critisism or denial of credibility of their products. It is a continual catch-up game. Lawers aren't cheap. Politicians are useless.

Eric - MS or somebody needs to review these borderline Addon publishers on a regular basis. It would appear that the latest offerings from FWP now meet the critera to be classed as malware - Group Policy changes are made to block access to the Add/Remove Programs applet making it impossible for novice users to remove their products.

I don't know how you are going to Police sites like this. You can't be always adding or removing them from you listings. Perhaps public or peer opinion may be the best indicator.

I am sad to see that castlecops.com has closed.

The Addons Mangers' "Search for this Addon via defaut Search Provider" could be improved if it used a a dedicated IE Addons database.

FWP hijack the Search Provider and don't incriminate their own products. It takes you directly to their site instead.

Live returns no results.

http://search.live.com/results.aspx?FORM=DNSAS&q=%2522My%2bWeb%2bSearch%2522%2bMWSBAR.DLL

I can see opportunities here for an Addons developer to improve upon what you have done so far. How is HW progressing?

Regards.

re: IE8 Security Part VIII: SmartScreen Filter Release Candidate Update

war59312 — Wed, 11 Feb 2009 11:47:11 GMT

I'd say block it too!

If your users are asking you to block it, screw the "standards" and keep your users happy. ;)