IE security patch nixes some apps

TalkBack 19 of 52:

Next »

« Previous

• Thread View
• Flat View

So did you.

"Why can't you give MS just a little bit of credit. They have
made a baby step toward improving security, but they are
still lambasted for the "way they have done it." Huh? What
were they supposed to do?"

Gosh. I don't know. maybe they could have done what every
other browser maker in the world has done since the end of
time. The problem isn't the "@" in the URL. It's that they
can't handle a nonprinting character. It causes the whole
rest of the URL string to disappear in the address field. All
other browser handle this problem effectively.

"Oh, I get it, fix the program so that something else does
not break. Sounds easy. Fix the program to allow the
ridiculously insecure practice of including log-on
credentials in the very insecure URL and yet prevent
possible negative security implications."

You don't understand. Basic authentication is equally
insecure whether you include the authentication
information in the URL or not, but under many
circumstances, basic is good enough, and much better than
nothing. Furthermore, IE STILL DOES allow authentication
information to be included in the URL. That's what happens
if it's part of the query string. It's less safe than using post
with encryption, but, again, sometimes it's good enough.

Posted by: Immanuel Tranz-Mischen   Posted on: 02/05/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Driving Business Agility through SOA Connectivity & Integration Whitepaper from IBM IBM In this whitepaper, you will learn how to work smarter so you can solve ... Download Now
• Busting the myths about QuickBooks Enterprise Solutions and IBM Smart Business IBM So you already know there aren't actually any alligators in the New York ... Download Now
• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now