1 What’s New In Internet Explorer 7? Chris Wilson PRS203 Group Program Manager, IE Platform & Security Microsoft Corporation

2 Internet Explorer Many different things to many different people End users Web designers Web application developers Commercial developers of IE add-ons Infrastructure: network admins, CAs, etc. U D A C I

3 Pillars of Internet Explorer 7 Amazing User Experience Secure and Trustworthy Browsing Powerful Web Developer Platform

4 Amazing User Experience Browse…Search…Subscribe Tabbed Browsing High-quality page zoom Great new print experience Integrated subscription platform U

5 Demo IE7 User Experience

6 Amazing User Experience Flexible Subscription platform We provide… Feed Discovery (in IE) Common Platform Feedlist, storage, parser, sync engine List extensions to RSS U D A

7 Amazing User Experience OpenSearch 1.1 and extending search An open way to describe search providers Developed in cooperation with A9.com Provided under Creative Commons license OpenSearch 1.1 Description Document Allows search output in HTML as well as RSS Script API prompts user to add provider: window.external.AddSearchProvider( “ ) U D I

8 Secure and Trustworthy Browsing Security is job #1 Dynamic protection against web fraud Full user control over add-ons Advanced malware protection U D A C I

9 Anti-phishing service integrated into IE User experience highlights security Clear secure connection user experience Pop up windows identified with their URL “One Click Cleanup” feature to wipe history, cache, etc. Integration of Parental Control (Vista ) U D AI Secure and Trustworthy Browsing Dynamic protection against web fraud

10 Demo IE7 Trustworthy Browsing – Web fraud protection

11 Explicit user consent is required on first run of installed ActiveX controls Users can easily enable pre- installed controls through the same Info Bar as new controls Add-ons Disabled Mode for recovery U D A C I Secure and Trustworthy Browsing Full control over add-ons

12 Special characters complicate URL parsing, e.g. URLs are often passed as strings, and some components parse inconsistently In IE7, we have a single URL parsing object This API (IURI) is exposed for other apps to use Also adds International Domain Name (IDN) Secure defaults to prevent spoofing U C I Secure and Trustworthy Browsing Impeding critical exploits – URL handling

13 javascript: protocol now runs in-page Now, doesn’t navigate – we strip “javascript:” off and run as script inside the page context Objects handling data by reference must understand HTTP redirects We’ve always had redirect notifications – but now we lock the data if the object doesn’t understands redirects. Objects that aren’t redirect-aware can’t get access to the data. I Secure and Trustworthy Browsing Impeding critical exploits – cross-domain

14 Malicious web pages often install malware or modify files by exploiting buffer overruns or other critical security exploits in IE or add- ons Solution: Protected Mode Reduces the severity of threats to IE and add-ons running in IE by eliminating the silent install of malicious code on the user’s system Protects registry, file system from silent malware installs Does NOT prevent running Win32 code U C I Secure and Trustworthy Browsing Advanced malware protection

15 Protected Mode restricts IE from writing files outside of the Temporary Internet Files folder IE’s process has fewer write privileges than normal User Protected Mode builds on the Windows Vista Mandatory Integrity Control (MIC), which restricts writes This means Protected Mode is Windows Vista only! When IE needs to write outside of the TIF folder (e.g. File…Save As), we have a broker process with appropriate privileges to do so Compatibility layer for add-ons to elevate privs U C I Secure and Trustworthy Browsing Protected Mode summary

16 Same as XPSP2 with a new UAP credential prompt U C I Secure and Trustworthy Browsing Protected Mode changes ActiveX install

17 Same as XPSP2 with a new UAP credential prompt U C I Secure and Trustworthy Browsing Protected Mode changes toolbar install

18 Architectural Overview C I

19 Intranet/Trusted Sites/LM don’t run in PM Add-ons can restore impacted functionality In-proc add-ons (ActiveX controls, toolbars) File writes get re-routed to the TIF via compat layer Registry writes get re-routed to a virtual registry Can call “Save As” API to save files outside of the TIF Out-of-proc add-ons (DocObject servers, etc) Get Protected Mode’s restrictions by default Can elevate privilege if user allows U C I Secure and Trustworthy Browsing Protected Mode – compatibility features

20 Identifies features blocking app functionality In the Windows App Compatibility Toolkit 4.0 Blogged on IEBlog in March: D AI Secure and Trustworthy Browsing IE Compatibility Evaluator in XPSP2

21 Powerful Web Dev Platform “Don’t break the Internet” “Quirks mode” stays the same - many platform changes are only in “strict mode” We do change behavior under strict mode prolog doesn’t prevent strict mode prolog doesn’t prevent strict mode D AI

22 Fixed some serious issues in IE 6 layout Incompatibilities with the latest CSS standard, as well as some nasty bugs in the engine We’ve knocked out the top bugs on quirksmode.org and positioniseverything.net, as well as other problems D AI Powerful Web Dev Platform Fixing the top problems

23 Peekaboo Bug Quirky Percentages In IE6's Formatting Model IE/Win Line-height Bug IE6 Border Chaos Disappearing List-Background Bug Guillotine Bug Unscrollable Content Bug IE 6 Duplicate Characters Bug Doubled Float-Margin Bug Duplicate Indent Bug Three Pixel Text Jog Creeping Text Bug Missing First Letter Bug …and many more issues. positioniseverything.ne t D AI Partial bug list Powerful Web Dev Platform Layout issues in short…

24 Added top requested standards features PNG alpha channel support All CSS 2 Selectors First-child, adjacent, attribute, child etc. CSS 2 fixed positioning CSS 2 :hover pseudo-class works on all elements Polished HTML 4.01 support element, fallback element, fallback D AI Powerful Web Dev Platform Adding the most requested features

25 Native XMLHTTPRequest Better enables DHTML/Atlas applications No longer subject to ActiveX being enabled element now windowless element now windowless Can be visually layered w/ other elements Even more complete documentation D AI Powerful Web Dev Platform Adding the most requested features

26 Demo IE7 Web Platform Advancements

27 IE toolbar providing a rich tool set for exploring DHTML and CSS with object model and visual tools Downloadable Beta available shortly Runs on IE6+ D A Powerful Web Dev Platform Web developer toolbar

28 Demo IE Web Developer Toolbar

29 Key Takeaways We thought this Internet thing would be big one day… We’re providing more containment as well as better arming users to make informed decisions about their system security We’re working hard to improve our web platform We want your continued feedback to put out better and better versions of the platform for you My address is (Please put “IE feedback” in the title, and please DON’T – he’s not the same guy)

30 Call To Action What should you do? Make sure your IE components (ActiveX, BHOs, toolbars) are prepared for changes Give us feedback - Build web applications! Use the rich platform of IE, DHTML, Atlas and WPF

31 Community Resources At PDC For more information on RSS, go see DAT320: Windows Vista: Building RSS Enabled Applications 14:15) Hands-on Lab: DATHOL08: RSS in Longhorn For more on IE in general, or other specific issues: PNL06: What’s Next for Microsoft’s Web Platform? 8:30) Presentation Track Lounge: IE team members are hanging out there Ask The Experts event: stop by the IE table After PDC IE Dev Center on MSDN: IE Team Blog: - #1 on MSDN! IE feedback alias: If you missed these related PDC sessions, watch them on the DVD PRS200: Choosing the Right Presentation Technology FUNL03: Case Study: Building a More Secure Browser in IE7

32 © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

33 Appendix

34 IE7 Vista vs. IE7 XPSP2 IE7 will be available on Windows Vista (with some additional features such as Protected Mode) Windows XP SP2 Windows Server 2003 SP1 …including 64-bit

35 Servicing Internet Explorer Users Servicing the software users use the most is a huge commitment Huge increase in quality and responsiveness of IE Servicing 40% hotfix regression reduced to ~0% Zero recall class GDRs since February 2004 Hit our days-to-solution targets for hotfixes ZBB’d Critical vulns, down to last Importants Major strides in security IE 6 in XP SP2 reduced exploits by 40%+ “SP2 is tough as nails...” – Greyhats Security Group