Ivan Fratric, a security researcher at Google Project Zero, made note on Twitter of various examples when whitelists, equivalent to the Enterprise Mode Site List, have been abused. Promised security improvements that come with the shift over to Chromium, for instance, may eventually feel pointless if a user whitelists a site that only works on a legacy browser (and one which is generally more susceptible to exploits). This may sound like a gift to anyone that uses dated apps, but some independent experts are less than certain this should be “the next chapter in web browsing”, as Microsoft has put it. “If I encounter a site that requires backward compatibility in IE11, and it is on your Enterprise mode site list, or on your intranet, it will automatically render the site in the Microsoft Edge frame.”Įdge features a changed Chromium browser engine under the hood while adapting the technology for backward compatibility with sites only capable of working with IE. “By introducing Internet Explorer Mode we’re effectively blurring the lines between the browsers,” Pullen said. “Having all these doc modes means you have a much bigger attack surface than you would if you were running a modern browser without backward compatibility,” Pullen admitted.Īn Enterprise Mode Site List was released in 2018 so that users with Edge as their default browser could automatically launch IE11 for any legacy sites or apps that were needed. This support now comes built in to Edge, ironing out any bumps in the road while adding a tariff.
In a presentation posted on YouTube earlier this week, Pullen explained how Microsoft had previously offered Edge compatibility with older versions of Internet Explorer through various binary extensions that supported legacy web apps. “Internet Explorer Mode, or IE Mode for short, provides compatibility for legacy websites, so that Microsoft Edge with IE Mode now has compatibility for modern websites when using the Chromium Engine and compatibility for legacy web apps using IE Mode,” said Fred Pullen, principle program manager at the Microsoft Edge team.
While Microsoft has continuously urged its customers to stop using legacy browsers like Internet Explorer – a practice that stores up “technical debt” – ongoing demand from enterprise has prompted Microsoft to abandon any immediate attempt to force organizations to revamp their intranets and improve their web security practices. The next version of Edge will support functionality on Internet Explorer through a single browser, offering “the best of both worlds”, the tech giant said.
The move, made in response to its customer demands, will be a disaster for security, critics warn. Microsoft has reversed its stance on support for out-of-date browsers and unveiled plans to release an Internet Explorer Mode for Edge. Security concerns raised over Redmond’s efforts to support legacy web apps
0 kommentar(er)
