Re: 'cross site scripting' CERT advisory and MS

From: flynngnat_private
Date: Thu Feb 17 2000 - 03:54:09 PST

  • Next message: Damir Rajnovic: "Re: snmp problems still alive..."

    David LeBlanc wrote:
    >
    > What I recommend specifically for using Outlook (probably also applies to
    > other mail readers using IE as a HTML viewer) is:
    > 1) Set it to run in the Restricted Sites zone
    > 2) Edit the Restricted Sites zone into what I call maximum paranoia mode -
    > turn EVERYTHING off.  IIRC, cookies are off to begin with, but this gets
    > them turned off for sure.
    
    Wouldn't it be better to set the Internet zone for high security and
    then set the browser to use the Internet zone? The restricted zone requires
    entering the list of untrusted systems while the Internet zone says
    "everything that is not in the trusted zone gets the default security
    settings".
    
    Here is what I've been recommending:
    http://www.jmu.edu/info-security/engineering/issues/apps/outlook.htm
    
    Gary Flynn
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:35:49 PDT