Sign In
EricLaw's IEInternals
A look at Internet Explorer from the inside out.
Translate This Page
Translate this page
Powered by
Microsoft® Translator
Options
Email Blog Author
RSS for posts
Atom
RSS for comments
OK
Search
Advanced search options...
Search In:
Everything
Blogs
Forums
People
Groups
Places
Pages
Date range:
All Time
Last Year
Last 6 Months
Last 3 Months
Last Month
Last Week
Last Two Days
Tags
ActiveX
add-ons
Best-Practices
BetterInIE10
BetterInIE9
caching
design
dev
fixes
http
https
ie8
ie9
interop
limitations
networking
performance
problems
Q&A
Security
standards
troubleshooting
webdev
Win7
Zones
Archive
Archives
May 2012
(3)
April 2012
(2)
March 2012
(4)
February 2012
(1)
January 2012
(1)
August 2011
(7)
July 2011
(3)
June 2011
(5)
May 2011
(10)
April 2011
(8)
March 2011
(13)
February 2011
(7)
January 2011
(2)
November 2010
(2)
October 2010
(2)
September 2010
(6)
August 2010
(2)
July 2010
(3)
June 2010
(4)
May 2010
(3)
April 2010
(7)
March 2010
(3)
February 2010
(1)
January 2010
(2)
December 2009
(4)
November 2009
(4)
October 2009
(8)
September 2009
(11)
August 2009
(6)
July 2009
(9)
June 2009
(18)
May 2009
(3)
June, 2009
MSDN Blogs
>
EricLaw's IEInternals
>
June, 2009
Posts
Subscribe via RSS
Sort by:
Most Recent
|
Most Views
|
Most Comments
Excerpt View
|
Full Post View
EricLaw's IEInternals
The Privacy Impact of Add-ons: New APIs for IE8
Posted
over 3 years ago
by
EricLaw [MSFT]
6
Comments
By default, when starting a new session using IE8's InPrivate Browsing feature, toolbars and Browser Helper Objects are disabled. This is done to help protect the user's privacy: many toolbars and extensions maintain their own navigation/search/etc history...
EricLaw's IEInternals
Internet Explorer and Custom HTTP Headers
Posted
over 3 years ago
by
EricLaw [MSFT]
0
Comments
Someone recently asked me for a list of custom HTTP request and response headers introduced by the IE team over the years. Here's the list I've come up with so far (including a few that were introduced before I joined the team): Request Headers ...
EricLaw's IEInternals
Cool deal: Windows 7 Pre-orders half price for a limited time
Posted
over 3 years ago
by
EricLaw [MSFT]
0
Comments
Not exactly IE related, although IE8 is included in Windows 7: Until July 11th, Windows 7 upgrade pre-orders are available for half-price . Home Premium is $50, and Professional is $100. -Eric
EricLaw's IEInternals
Thoughts on Declaring Security Policies
Posted
over 3 years ago
by
EricLaw [MSFT]
2
Comments
My thoughts about Mozilla's Content Security Policy proposal were just published over on the IEBlog. I actually have quite a bit more to say (at even greater length :-) about declarative security mechanisms, and some more technical feedback specific to...
EricLaw's IEInternals
User Account Control in Windows 7
Posted
over 3 years ago
by
EricLaw [MSFT]
0
Comments
It isn't directly related to Internet Explorer, but Mark Russinovich's Inside Windows7 User Account Control article over on TechNet provides an illuminating explanation of why UAC isn't a security boundary, but why it helps protect against malware anyway...
EricLaw's IEInternals
Handling Mixed (HTTPS/HTTPS) Content
Posted
over 3 years ago
by
EricLaw [MSFT]
123
Comments
Update: IE9 includes improved handling of Mixed Content. Click to learn more... Background As we developed Internet Explorer 8, we spent quite a bit of time pondering what to do about IE7’s infamous “Mixed Content” warning prompt...
EricLaw's IEInternals
WebOCs, popups, and the default browser
Posted
over 3 years ago
by
EricLaw [MSFT]
1
Comments
Applications which host the WebOC (Web Browser control) may choose to support popups and new windows by hooking the NewWindow3 event and returning in ppDisp a pointer to a new, hidden, non-navigated WebBrowser object or InternetExplorer object. If such...
EricLaw's IEInternals
Windows 7 adds support for TLSv1.1 and TLSv1.2
Posted
over 3 years ago
by
EricLaw [MSFT]
3
Comments
Windows 7's updated crypto stack (schannel.dll, etc) offers support for TLSv1.1 and TLSv1.2. While disabled by default in IE8 (for compatibility reasons; some legacy sites will fail to connect when the updated TLS version is offered) the new protocol...
EricLaw's IEInternals
IE8 Problem Reports: ASP.NET Menus show blank/white
Posted
over 3 years ago
by
EricLaw [MSFT]
0
Comments
Q: My ASP.NET site's menus show as blank/white when my page is rendered in IE8 standards mode. The menus only work if I turn on compatibility view. What's up with that? A: This is actually a standards-compliance bug in the ASP.NET framework. A fix...
EricLaw's IEInternals
Enhanced Security with SEHOP
Posted
over 3 years ago
by
EricLaw [MSFT]
2
Comments
Windows Vista SP1 introduced an interesting new memory protection known as SEHOP, which works with other memory protection techniques (like DEP/NX , ASLR, etc) to help prevent exploitation of a specific type of memory-related vulnerability known as SEH...
EricLaw's IEInternals
Good news: Security innovation spreading...
Posted
over 3 years ago
by
EricLaw [MSFT]
0
Comments
Version 4 of the Safari web browser now supports the HTTPOnly directive for cookies introduced by IE6 SP1. Now, all major browsers support the directive, which can help mitigate the impact of XSS exploits. Safari 4 also now supports the X-FRAME-OPTIONS...
EricLaw's IEInternals
Vary with Care
Posted
over 3 years ago
by
EricLaw [MSFT]
16
Comments
About the Vary Response Header As described in the HTTP/1.1 specification ( RFC2616 ), the Vary response header allows a cache to determine if a cached (still fresh) response may be returned for a subsequent request, based on whether or not the new...
EricLaw's IEInternals
HTTP/HTTPS Port-Blocking in WinINET
Posted
over 3 years ago
by
EricLaw [MSFT]
0
Comments
Internet Explorer (actually, WinINET, the network stack beneath IE) prohibits use of certain ports for HTTP(S) connections. The intent of this blocking is to prevent Cross Service/Protocol Request Forgery attacks. For instance, an attacker could use a...
EricLaw's IEInternals
CSS History Probing, or: "I know where you went last week"
Posted
over 3 years ago
by
EricLaw [MSFT]
5
Comments
Background One of the interesting attacks which makes the rounds every few years concerns the ability of web pages to use CSS to detect whether or not certain URLs have been visited. Given a sufficiently large set of URLs to probe, a website may be able...
EricLaw's IEInternals
Building Safer ActiveX controls: DOM Bridging
Posted
over 3 years ago
by
EricLaw [MSFT]
0
Comments
Over on the BlueHat blog, security researcher Manuel Caballero wrote up an interesting post on how Silverlight avoids exposing unsecured private browser APIs to abuse from RIA content. Anyone building ActiveX controls that take untrusted input should...
EricLaw's IEInternals
Think of the children!
Posted
over 3 years ago
by
EricLaw [MSFT]
0
Comments
Another question from the audience today: Q: I like IE8's InPrivate Browsing feature , but I'm worried that it won't let me see what my kids are up to. Can I prevent them from using it? A: Yes. When you enable the Windows Parental Controls feature...
EricLaw's IEInternals
IE Cumulative Update shipped today
Posted
over 3 years ago
by
EricLaw [MSFT]
0
Comments
The latest IE cumulative update shipped today ; download it from WindowsUpdate when you get a chance. Over on the Security Research and Defense blog , there's an in-depth discussion of the security bug discovered in IE8 at the Pwn2Own contest at CanSecWest...
EricLaw's IEInternals
Slowing Down: Disabling the Accelerator icon
Posted
over 3 years ago
by
EricLaw [MSFT]
9
Comments
We've had a few folks write to the IEBlog asking " How can I disable the little blue accelerator icon that appears when text is selected in a HTML page? " For end users, the answer is straightforward: Click Tools > Internet Options > Advanced...
Page 1 of 1 (18 items)