3 ms·
I wonder what an Internet Explorer 0-day does for these people? Maybe that's all they had? Is it supposed to be a "sign" to us that they are capable of developi
by meibo 6y ago
I wonder what an Internet Explorer 0-day does for these people? Maybe that's all they had? Is it supposed to be a "sign" to us that they are capable of developing exploits?
Surely no security researcher would open a link in IE as their "burner browser"?
- koolba 6y agoIsn’t the latest IE just a thin veneer atop Chrome anyway?
- thephyber 6y agoInternet Explorer is an older browser. Edge is the Microsoft browser whose newer versions are based on Chromium.
- gundmc 6y agoEdge is Microsoft's new browser that is based on Chromium. It is distinct from Internet Explorer which is effectively deprecated but still used somewhat widely as many legacy enterprise applications still require it.
- wlesieutre 6y agoThe recent versions of Edge are based on Chromium, but originally it used Spartan (which was the successor to IE’s Trident)
- tape_measure 6y agoIt's basically required in South Korea for online shopping. The link to the IE 0 day is written in Korean. More on IE in South Korea: https://www.nationthailand.com/Startup_and_IT/30321025 https://www.nationthailand.com/Startup_and_IT/30321025
- meibo 6y agoThis is probably it, thank you for clarifying - I've got a few friends in SK and they always complain about this, should have thought of that!
- tape_measure 6y agoDo you know the latest on IE use? The article I posted is from 2017 and promises modernization. I submitted the article here, hopefully we get an on-the-ground update. https://news.ycombinator.com/item?id=26656052 https://news.ycombinator.com/item?id=26656052
- easton 6y agoLooks like it was abolished last year: https://10mag.com/the-end-is-finally-near-for-koreas-infamous-digital-id-certificate/ https://10mag.com/the-end-is-finally-near-for-koreas-infamou...
- thephyber 6y agoI remember IE was required for the South Korean government issued digital certificate (required for all internet-based retail transactions and likely others). I guess I had assumed that the standard was compatible with newer versions of Windows or MS browsers. Really sad if it isn’t.
- freeone3000 6y agoIt's ActiveX-based, which essentially runs nowhere but IE. Edge's support for ActiveX is running it in an IE tab.
- thephyber 6y agoYes, I roughly understand the limitations of the existing implementation. but it is not the only browser or platform and it’s not like the S Korean government is not capable of noticing the market share / cybersecurity trends of the past decade+.
- coldcode 6y agoI was under the impression that SK was a technologically advanced country. I guess not the government then.
- bawolff 6y agoI wonder why they needed an active x control for that. TLS/SSL client certificates have been supported by all browsers since basically forever, going back even further than active x.
- thephyber 6y agoIf I had to guess, HTTPS / SSL was governed by US export restrictions above a certain strength so S Korea managed to use the existing extensibility built into the browser the government wanted to support.
- neom 6y ago
- ronsor 6y agoIf Microsoft suddenly disabled all IE installations in South Korea, they'd have no choice but to change. Sometimes I wonder if the Apple-style "this just won't work at all anymore" attitude isn't that bad.
- eptcyka 6y agoIt has its places, given the correct trade-off, it works well. Not allowing flash was good because iOS was a growing market with no preexisting businesses relying on flash on iOS to work.
- fshbbdssbbgdd 6y agoSounds like a great way for Microsoft to lose a lot of market share fast.
- mimsee 6y agoThere's no ActiveX on macOS or Linux either.
- cmeacham98 6y agoNo longer required by the government as of recently: https://www.theregister.com/2020/12/10/south_korea_activex_certs_dead/ https://www.theregister.com/2020/12/10/south_korea_activex_c... Unsure on whether major sites have gotten around to removing it though, perhaps a Korean HN reader could comment.
- williamchangnpu 6y agoNot in SK, but in China Here basically all banks require ActiveX, and if you don't have an Windows computer(Mac), what you can do is to use their app, which of course is super sluggish.
- thephyber 6y agoMy understanding (not sure how accurate or up-to-date) is that Windows still opens some file formats using Internet Explorer (possibly depending on other OS/domain settings). The Windows Help File (.chm) or something similar comes to mind. Also worth pointing out that security researchers targeting specific platforms/applications (say a specific version of older Windows where one particular organization has applications which require a specific version of IE) might be a valuable stack for the researcher to spend time on. That said, those stacks/environments should be treated like a meth lab: you want to be very careful what you do with it and it shouldn’t be commingled with where you live and play.