Is this intranet zone thing _really_ of any value? Why is there a built-in default assumption that something from a "local" server is more trustworthy? Consider the following situations: 1. A customer of your ISP, netmonger.net, is evil. They have a page that links or redirects to http://www/~evil/evil.html, taking advantage of the fact that your machine is configured with your ISP's domain in the search list. 2. You go to school at RPI. You have a dorm ethernet connection. Your machine is naive.dorm.rpi.edu, and you have dorm.rpi.edu in your domain search list. An evil person gets evil.dorm.rpi.edu, and you know the rest. 3. You work at Giganticorp and have access to high-level trade secrets. Giganticorp has an intranet where employees can put up their own web pages. An evil employee takes advantage of the default security settings to gain access to your secrets, which he sells to the competition. Numbers 1 and 2 ask the question, "Why are we assuming that a non-qualified host name implies intranet implies trust?" Number 3 asks the question, "Why are we assuming that intranet implies trust?" Another question is "How many people who use IE have no intranet?" Considering that there are a quantity of tools available to deploy IE at your company with preconfigured settings, why not default to not having this intranet zone. If Giganticorp needs to turn down the security, they can do so at the same time they're customizing the rest of the settings. I don't personally use Microsoft products, and I am not quite familiar with the specific security precautions that are disabled for the intranet zone, but if they're enough to cause concern on the Internet, the same problems can occur even when the browser isn't malfunctioning at all. -- Christopher Masto Director of Operations NetMonger Communications chrisat_private infoat_private http://www.netmonger.net Free yourself, free your machine, free the daemon -- http://www.freebsd.org/
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:38:20 PDT