Security threats Toolkit
Story: eEye releases IE patch
Posted by: anon (Monday 3 April 2006, 8:16 AM)
Most web sites cannot be used with active scripting disabled. Disabling active scripting means turning off the javascript feature which has been a part of web browsers since the 90s. All mainstream browsers now support javascript, and most large commercial sites (eg online banking, government and online retail) require its operation to use the site. So MS are recommending returning to the primitive days of basic html, and no javascript? Should they perhaps recommend as a temporary workaround switching to another browser, since this flaw is IE specific?
A decently secure browser would allow the user to start with all sites in a high security bucket - no scripting, no images, no downloads etc. Then when one of these features is required by a site, the browser lights up a button on the toolbar to selectively enable these features for this site - user only enables if they know the site. User has control, browsing is secure. (This idea is patented, licensing rights price on application - any browser manufacturer which actually uses this ideal scheme will be sued)
Full Talkback thread
