SSL, TLS and a Little ActiveX: How IE7 Strikes a Balance Between Security and Compatibility

We’ve been talking for a long time about making sure IE7 is as secure as possible but still compatible with the Internet. The principle that helps us balance security and compatibility is to not impact existing websites unless we need to change IE to help protect end users. As we asked web developers and server administrators to make changes, they spoke frankly with us about what they could and what they couldn’t change. Today, we’ll look at a couple timely examples of how this principle played out in IE7.

1. Improved security to mitigate threats may impact some web sites

SSL 2.0 deprecated

One place we faced a tough decision was with SSL 2.0. Contrary to what we expected, SSL 2.0 is still in use on a number of web servers around the world. The problem is that if a site chooses to use SSL 2.0 an attacker could decrypt a transaction between IE and a SSL 2.0 web server. We’ve never heard any reports of SSL 2.0 sites or users being exploited but we decided to keep SSL 2.0 disabled in IE7 to protect users from that threat. When we did hear of web servers running SSL 2.0, we contacted server administrators about upgrading to newer servers.

It’s important that your web server admin upgrade from SSL 2.0 if you haven’t already. If for some reason you still need to use SSL 2.0, you can ask your users to re-enable SSL 2.0 on the advanced tab of the Internet options control panel.

Obsolete controls disabled through ActiveX opt-in

An important part of the ActiveX opt-in feature is doing good housekeeping of the ActiveX controls that come with Windows.  Many sites will benefit from IE7’s new native XMLHTTP control and sites can continue to use the MSXML 6.0 and 3.0 controls. The MSXML 5.0 control will not be enabled by default. The WMP 6.4 player is also disabled because its been replaced by the WMP 7+ generation controls. As we can infer from HD Moore’s month of browser bugs, using the newer controls and leaving older controls disabled helps reduce the chances of user being exposed to a security or stability issue in an older control.

Since this should be a straightforward change for most sites, we’re asking for your help in moving your pages towards the native object XMLHTTP, the latest version of MSXML or the newer WMP control. In the best case scenario, the change might be to simply swap in the native object for XMLHTTP or the newer CLSID for the current WMP control.

2. In many cases though, we can make security features that are still compatible with today’s web applications

Warning rather than blocking for mixed content for compat with web applications

Mixed content refers to a secure page, hosted over https that also includes unsecured http content. Since the plain http content isn’t protected with encryption, browsers have to warn users about the unencrypted content because it could be hijacked rewritten by an attacker. In practice, many websites still mix http content into https pages, typically to carry non-confidential information such as logo images.

In previous Betas of IE7, we blocked the unencrypted http content outright to give users the most secure default experience, to not even make users decide if they wanted the protection. Pages with mixed content showed the information bar and the http content simply didn’t come through unless the user clicked the information bar to reload the full page. We’ve spoken with many major commercial websites and explained the problem with the user experience. As a result you should see many fewer sites hosting mixed content.

At the same time, many of today’s blog publishing packages depend on the ability to mix http content into an https-based outer page. Blocking the plain http content on page load forced the blogger to reload the page and many folks lost draft posts. Getting updated blog software isn’t an easy task and blogging is now common practice for folks who aren’t necessarily part-timing as web server admins.

Because mixed content is important for some web applications, and straightforward fixes are not always available, we made a hard decision to revert to the warning prompt for mixed content in RC1. That means your banking site, your blog software or other secure site might show a modal prompt for mixed content as they did in IE6.

The responsibility for using mixed content wisely, if needed, rests on web developers and web server admins. We still hope to address to the mixed content prompt in a future release. As TLS improves the performance and economy of HTTPS web servers, we hope the industry can move away from mixed content all together.

TLS 1.0 can fall back to SSL 3.0 for compatibility with legacy web servers

One of the new features in Windows Vista is support for TLS 1.0 extensions. Web servers that support TLS extensions open up new scenarios in HTTPS like the ability to have multiple hosts on a single server and will allow servers and clients to negotiate more secure connections with improved performance. The problem we found is that some legacy web servers will simply reject connections that include a TLS 1.0 extension. Server patches are usually available to correct this problem but those patches need to be deployed extensively and that can take time.

Rather than have end users locked out of important websites because of TLS extensions, we worked with the Windows Networking team on a simple fallback mechanism that will allow the legacy servers to keep working. In the final RTM version of Windows Vista, if the server hangs up the connection after IE sent TLS extensions, IE will simply retry the connection using SSL 3. SSL 3 remains a secure fallback and we found the workaround to be effective.  Server operators should still ensure that they are running the latest updates on their servers for best performance.


Rob Franco
Lead Program Manager

edit:  adjustment in title

Comments (50)

  1. AGMW says:

    At what time can we expect Final to be released by Microsoft?  Yahoo has already released their optimized version for Final!

  2. sonu27 says:

    Yeah, please release it as soon as possible, I do have to go to sleep, but I want it today. I’m in the UK.

  3. F. Gaertner says:

    And I live in Germany. Here it’s now 8pm but in Redmond it’s 11am (nearly 13 hours remaining, until October, 11th ;-)). and some other pages say, that the IE7 is already released – but always with the "warning" that IE7 _RC1_ only works on XP SP2. So, this isn’t the final, is it? Why do they tell "lies"? That’s stupid.

    OK, let’s wait… Maybe Bill Gates is sleeping until 12pm :-/

    Grettings from Germany

    F. Gaertner

  4. Fduch says:

    As I always said: the testers are the last to get the products.

    When I was testing Windows Vista there were situations where you could get working Vista from some illegal server or wait days before it appears on connect.

    Now we see how important for Microsoft Yahoo users are. They are much more important than Microsoft customers. I know this strategy. You do everything to attract new customers while forgetting about their existing customers. ("They are already our customers. They are unlikely to run away.")

  5. Marc says:

    Will you include a registry setting to change the handling of mixed content from the default to the more secure method you reverted from with RC1?

  6. joe user says:

    IE 7 is out. Yahoo is bundling it here. You can manually unbundle it and just get IE 7 if needed.

  7. sonu27 says:

    You can download the Yahoo version, then using WinRAR extract the IE7 setup, without the branding. But I would rather wait for the offical version.

  8. Baowoulf says:

    Weird. I would have thought that Microsoft wouldn’t let any third parties release it’s browser until after it had already official released it.

  9. Jerry says:

    Thats just crazy the Yahoo has IE7 before Microsoft does. I have been waiting all day to get it pushed it out.


  10. Michael W says:

    I have to agree with the last post . But then i like the fact that yahoo as it on there website for full download . But like this last post was saying . I’m going to just wait for it in the windows updates.

  11. steve says:

    I usually type IEblog in the title bar to get the site, but now it goes to and incorporates your content.

    Anyhow, no change of getting the "height=100% inside a TD bug" fixed, eh? Sigh..

  12. Singh400 says:

    I know this is offtopic, but is there anyway way to slipstream IE7 into an XP SP2 installation CD? The normal methods don’t work for me (using the /integrate or -s switch).

    Nice work on IE7, I love it! I seem to be in the minority lol.


  13. Brian McMahon says:

    I want to compliment everyone involved in the development of IE7. It is a vast improvement. You, and the rest of MS, also deserve praise for the openness shown through the involvement of the public in the betas and the open blogs.

    But it’s just for those reasons why I am disappointed that I had to get the final version of IE7 through Yahoo and there was not a single mention of it on this page. Despite this gaffe, please keep up the openness (and suggest to the Vista team that they reopen the RC2 program to everyone who had been sent a product code).

  14. IEBlog : SSL, TLS and a Little ActiveX: How IE7 Strikes a Balance Between Security and Compatibility Obsolete controls disabled through ActiveX opt-in An important part of the ActiveX opt-in feature is doing good housekeeping of the ActiveX controls that..

  15. jace says:

    x64 version? I can get the 32-bit final from the yahoo file, as mentioned, but whither the x64?

  16. Jerry says:

    I tried that IE/Yahoo hack and I don’t have tabbed browsing or a search bar. It looks alot like IE6.

  17. steve says:

    I know this if off topic, but after IE7 goes out, it would be great if you could package up IE6 as a single standalone file so we can do testing on it. I know the only supported method is to use VPC (which is now free), but for those of us that do not work at Microsoft, we don’t have original XP discs around. My 7 month old HP came with disks that will only work with their own machines, and VPC doesn’t fake that part, so the only way for me (or anyone else) to have both IE6 and IE7 is to buy another copy of Windows. Want to send me a copy?

  18. If you already had the release candidate, Yahoo’s installer first rolls back to IE6; you have to then run the Yahoo installer again to get their customized version.

  19. Pari says:

    ….as secure as possible but still compatible with the "Internet".


    I’m tempted to make /. style comment, but won’t.

    Read. Edit. Post.

  20. Jerry says:

    @Lewis Francis  

    That was strange, the version was still showing IE7.

    /Thats what I get.

  21. David William Wrixon says:

    So what time to tomorrow is the Senior Management butt kicking contest?

  22. Fduch says:

    Thiking that they’ll post here on IEblog when IE7 comes out was stupid.

    Go, get it at MS site.

    Cry looking at crushing browser with unfixed bugs. Rememer: "That’s what you have asked for."

  23. Fduch says:


    As I thought. No improvement.

    All the bugs are still there.

    Broken unicode (Win95 era anyone?)




    Almost forgot. Despite the bugs on connect are often closed "randomly" there are still more than 1700 bugs. !!! It’s much more than in Windows Vista. Compare the sizes. 1 bug for every 8kb of the installer. And to think how many important bugs were closed "just because"…

    Overall I’m very disappointed with IE7 beta process. It looked like war between IE users/testers/web-developers vs. MS&IE7 team. Testers open bugs – MS closes them. Who wins?

  24. Baowoulf says:

    It’s still the RC1 on the MS site.

  25. Fduch says:

    I think this page links to RTM. Can’t confirm because it says I already have IE7.

  26. Baowoulf says:

    You’re right it is up now. I’ve just been putting IE7 into my search engine and RC1 page had always been the first page up but going through I see the final version is available now.

  27. goose says:

    I trust MICROSOFT with my security because they care about what I search for; unannounced connections (picked up by my non-Microsoft firewall) connecting to in Windows XP everytime I do a LOCAL search on my drive, they show they care in their own special way!!!

    I love Microsoft!!!! I am sure IE7 has the my best interests at heart and strikes the RIGHT balance where others have come & failed!!!!!

    Remember only Microsoft can protect us on the net. IE7 makes that possible!!!!

  28. EricLaw [MSFT] says:

    @Goose: The request returns an XML file about search providers.  

    If you’re curious to see the data, you can view it in Fiddler, a free HTTP monitor available from

  29. IEBlog says:

    Quite a bit has been written about the Secure Sockets Layer (SSL) protocol and its successor Transport

  30. Jeff says:

    But seriously, anyone have info about slipstreaming ie7 into an xpsp2 install?  not that I’m chomping at the bit to turn the world over to Microsoft, but i’m repacking my unattended install and figure this would make a good side project.  is the genuine authentication cr** that holds up the switches?  

  31. John Hrvatin [MSFT] says:


    IE7 cannot be slipstreamed into XPSP2.  For deployments, you have to boot into XP, install IE7, and then use sysprep to repackage the machine or an imaging solution.


    John [MSFT]

  32. Jeff says:

    @John (MSFT)

    Ah so…..thank you 🙂

  33. I’ve been working closely with the IE team leading up to the release of IE7 and looking at the use of

  34. PSchuetz says:

    Hi there,

    lol, you must really shame, that is really lame!

    You complain about webpages/webmasters which configured to loading mixed content (secure and not secure), but your very own webpage (this blog) does mix content, if I want to connect through an secure connection on this blog:

    That is very bad!

    You should fix that very soon and fast or you can’t complain about others..

    best regards,


  35. EricLaw [MSFT] says:

    @PSchuetz: Perhaps you might want to read the article again.  The entire point is that there are cases where there’s no ready workaround for mixed content:

    <<many of today’s blog publishing packages depend on the ability to mix http content into an https-based outer page.>>

    <<straightforward fixes are not always available>>

    In this particular case, there’s a very easy workaround: Don’t use HTTPS to access the IEBlog.  There’s no private data here, and hence using HTTPS just results in wasted cycles and overhead.

  36. IEBlog says:

    Some of you may have noticed the following goldbar on some websites: Our friend Adam on the XML team

  37. Billy says:

    Hi there,

    I don’t understand what Microsoft’s deal is with that popup of mixed content. Mixed content is ok.

    There is nothing wrong with having some mixed content, like css, js, images. Where there is a problem is when FORMS are submitted using a http address when a user navigated to a https url. A user does not know that the content that is being submitted is submitted "unsecurely". This is when a message needs to be displayed.  Poping up that message when an image like your logo is on http not logical. It’s like saying I’m going to secure my house by putting a lock on the front door. Now everything I access must have a lock, why would you need to lock everything in your house if the front door is locked?  Secondly, for a site to be secure in needs to be, I stress again, needs to be both https and have an authentication system on each entry point. Meaning, if you are going to use ssl on a site you must have authentication validation on it’s entry points. Just having authentication is not enough when you are running on http and just having ssl on you urls is not enough. Someone can still access your information.  

    That’s my idea, I hope they change it because right not it just doesn’t make sense to me.

  38. EricLaw [MSFT] says:

    @Billy: You should read

    The danger of mixing insecure JS into HTTPS is that a man-in-the-middle could replace the insecure HTTP script with script of his choosing.  Javascript can completely rewrite the page, meaning that it’s no longer secure.

  39. Billy says:


    Ok, I didn’t think of that. However, the message is too scary for "regular" users. As you point out there are two vulnerabilities. The html page and the javascript, these are the things that need to be secure, when they are not then popup the message. What about the images and the css and other content that can’t rewrite the page, are they vulnerable for attack?

    Thanks for the link

  40. beezus9 says:

    Is there a quick way to determine which elements on the page are not secure?

    I am maintaining a site developed by someone else. The forms have mixed content (according to IE). I would like users to not get the warning pop-up.

  41. EricLaw [MSFT] says:

    @Beeszus9: In some cases, you can determine what’s insecure by simply clicking "No" to mixed content and determining what content is missing.  The more rigorous approach is to use Fiddler (, and watch for the HTTP requests.

    @Billy: Well, CSS can materially alter the display of a page, and while images can’t rewrite the page, they can be used to fool the user.  The problem is that the browser has no way of knowing "Hey, this image is meaningless and it doesn’t matter if a bad guy tampers with it" vs "This image is a snapshot of the user’s stock portfolio, and if a bad guy were to tamper with it, the user may take an unsafe action (e.g. selling all of his stock or whatnot).

    Mixing insecure content into HTTPS pages simply is not safe.

  42. Frank Smith says:

    Promotion on Microsoft 7 Looked intresting, did

    not research SSL TLS Etc enough to give an openion.

    Anxious to find out where my end will end UP.


  43. Frank Smith says:

    I really dont know how to respond to no responces. Never had any experiances talking to people with Cronic LockJaw and very poor writing instructions. I am here because of having a Deep intrest in what makes things work and how i may make them better and

    boredom of retirement. Should you Folks ever deside to come out of the Closit, i would be pleased to Know what your plans are. I think you have been FUNNING me about my Micro’s so we don’t have to worry about that Issue. The BLUE Grass Pastures are the best and where I need to be.   Frank

  44. IEBlog says:

    This blog post frames our approach in IE8 for delivering trustworthy browsing. The topic is complicated

  45. 我参与了IE7的开发过程,看到了在IE浏览器中形形色色使用MSXML的方法。显然有一些东西困扰着开发者:MSXML“混乱”的版本以及如何创建“正确”的实例。下面是一段非常常见的代码: if (Web.Application.get_type()

  46. 我参与了IE7的开发过程,看到了在IE浏览器中形形色色使用MSXML的方法。显然有一些东西困扰着开发者:MSXML“混乱”的版本以及如何创建“正确”的实例。下面是一段非常常见的代码: if (Web.Application.get_type()

  47. SQL Server says:

    我参与了IE7的开发过程,看到了在IE浏览器中形形色色使用MSXML的方法。显然有一些东西困扰着开发者:MSXML“混乱”的版本以及如何创建“正确”的实例。下面是一段非常常见的代码: if (Web.Application

  48. 안녕하세요! 저는 인터넷 익스플로러 보안 프로그램의 책임자인 에릭 로렌스라고 합니다. 지난 화요일, 딘(Dean)이 신뢰성 높은 브라우저 에 대한 저희의 생각을 포스팅했었죠. 오늘