IE being removed from Win 10 20H2 and later, effective June 15th 2022

[YeOldeStonecat]

"merde out of luck"..I like that one to keep it sorta clean on a forum!

 

[phaZed]

Well, I can think of about 15 Realtors/MLS people that will be calling me... their MLS sites are all ActiveX/IE only from a bygone era - pitiful.

Also, some of Virginia's state backend services for businesses are still stuck on ActiveX/IE...

Woohoo! 'Bout time!

 

[nlinecomputers]

Calyx Point... right now... uses Active X to install...

You must use IE to install it as a result. I'm overjoyed at this news, because they're FINALLY going to have to fix that stupid installer.

Sadly, I got a little too excited with this news, because there's an IE mode of Edge that's still there, and will be around for sometime yet. But it looks like you need Group Policy to configure it... which means registry hacks to enable specific sites to be insecure. So pretty much a security wash... unless ActiveX is finally dead because it can't get out of the sandbox... need to read some more.

Called Calyx Support, they "claim" they're adapting there installation process to be browser agnostic and are already making changes to that effect. I told them, you have until the end of the year, if we get into 2022 and this crap is still IE dependent we're moving to a competitors product.

They just took over a month past a massive legal change in paperwork to get us the updated forms... So I'm in full on business integrity mode because this company has a documented history of taking too long for simple changes, much less something like this.

As much spearphishing that targets the real estate industry I think I would have already moved on.

 

[britechguy]

As much spearphishing that targets the real estate industry I think I would have already moved on.

The following is being asked without a trace of snark, and is focused on this comment coming in the context of ActiveX: How is spearphishing relevant?

It could be that I completely misunderstand spearphishing, but I don't think so. My basic understanding is that it is very, very custom targeted phishing, with very sophisticated facsimilies of "official" correspondence to make it look real. It still depends, entirely, on the target taking an action they shouldn't based on being convinced by the lure.

I guess the lure could involve ActiveX, but I don't see how that's central. What am I not getting, or not understanding, here?

 

[Sky-Knight]

It's an extra layer of complexity. I wrapped this client up in a VPN, so Point isn't publicly exposed... (no 2Fa... no public access)

Wrapped them up in an M365 tenant, which would be perfect if they didn't use it to get at Godaddy crap mail...

I mean, I hear what he's saying but there are SO many larger fish to fry in this mess! Also, the change away from Calyx Point specifically to anything else say... Encrompass needs to provide additional security, which I have no evidence to support.

IE is just another variable in the mix that I'll be glad to finally be rid of.

 

[nlinecomputers]

The following is being asked without a trace of snark, and is focused on this comment coming in the context of ActiveX: How is spearphishing relevant?

It could be that I completely misunderstand spearphishing, but I don't think so. My basic understanding is that it is very, very custom targeted phishing, with very sophisticated facsimilies of "official" correspondence to make it look real. It still depends, entirely, on the target taking an action they shouldn't based on being convinced by the lure.

I guess the lure could involve ActiveX, but I don't see how that's central. What am I not getting, or not understanding, here?

Only the general lack of regard for security that keeping Active X represents. If they are not bothering with that, what else are they behind on?

 

[britechguy]

Only the general lack of regard for security that keeping Active X represents. If they are not bothering with that, what else are they behind on?

I'd say that most who are the target of spearphishing have about as much direct knowledge of computer systems and the management of same as I have of string theory and quantum computing.

I don't expect end users to have any idea about any of this stuff. And even CEOs are most often "end users" in the big scheme of things. They should have professional IT staff in an organization large enough to contain really tempting spearphishing targets, who are generally big fish in big ponds.

That's why my question arose. And I thank you for having answered it.

 

[Sky-Knight]

@britechguy The spear phishing happens... A LOT. In this case, I'm getting emails probably 3-4 times a week from that site asking for clarification. I've been training them for the last decade to recognize this threat, so they're doing OK.

Fortunately while their tech security is crap, their turnover is low so I've been able to patch the humans as well as they reasonably can be. This is all double true of the owners, because SMB owners have their IDs on flagrant display in the public domain. It's very much a thing they all need to know how to handle or very bad things happen to their bank accounts.

So, for my part it's very much a holistic approach, use tech where I can, patch the human as much as possible, and pray something somewhere catches it.

 

[britechguy]

I've been training them for the last decade to recognize this threat, so they're doing OK.

And, in the final analysis, this is the very best way to prevent spearphishing from being successful. Keep up the good work and good fight!

 

[Sky-Knight]

And, in the final analysis, this is the very best way to prevent spearphishing from being successful. Keep up the good work and good fight!

Yes, but it only works in low turn over, small environments where people actually care and take responsibility. Larger entities have no choice but to fork over for Sentinel One or something similar.

 

[britechguy]

Larger entities have no choice but to fork over for Sentinel One or something similar.

No argument from me. But anything that relies on technology to stop what is primarily the result of human error is bound to have a higher rate of failure than one would hope. I sometimes wonder if they're worse than nothing, as there is no opportunity to develop "sniff test" skills, and without those falling for the lure is just so much more likely.

 

[Sky-Knight]

No argument from me. But anything that relies on technology to stop what is primarily the result of human error is bound to have a higher rate of failure than one would hope. I sometimes wonder if they're worse than nothing, as there is no opportunity to develop "sniff test" skills, and without those falling for the lure is just so much more likely.

The tech in question doesn't stop cryptos, just halts them before they can spread beyond a single machine. So instead of paving an entire network, it's just one box. A good portion of the time it can halt the infection outright, but that's the realm where things don't always go the way you'd expect. It's pretty easy to detect a crypto when you have an unsigned process reading hundreds of files a second!

It's something so brain dead easy you'd think Defender would do it for you... but I'm sure someone was paid to prevent that.

 

[NviGate Systems]

RealEstate Industry relied heavily on Ie; not sure what happens now, but many MLS "official" sites "required" Ie. There are many industries that are lazy and quite essential!

 

[britechguy]

There are many industries that are lazy and quite essential!

Yup. And every time something like this happens, at least 80% of the lazy do the right thing and get off the stick so that things will work correctly "when the time comes." The other 20% whistle past the graveyard, and when the time comes screw their customers over in one of two ways: getting a fix out late, and often not perfectly correct until several iterations occur or by simply closing up shop leaving their client base with nothing. (Of course, in the latter, the clients should really have been keeping their eyes open and if no motion is evident during the early transition period, well ahead of the drop-dead date, they should start looking for something else.)

You can be sure the MLS isn't going away, nor will it be tied to IE only going forward. Either just can't happen.

 

[Sky-Knight]

AZ's MLS website stopped being IE specific 7-8 years ago... as one of the poorest states in the country, I'm left to assume that if anyone else is using IE for an MLS site, they're doing so out of old habit that needs changed.

Because seriously... we're the last to do anything like this, and even we have this crap done! The county sites took a bit longer... but even those are done too!

 

[britechguy]

One way or another, whether by being (how I hate this word) proactive, reactive to warnings that give you sufficient time, or "lack of planning on your part has created your own emergency - deal!" there is no escaping that certain thing in the tech world just die. When they're gone, they're gone, and attempts to keep 'em around are more expensive, and exhausting, than adapting.

I have hated my fair share of changes over the decades. What I wasn't foolish enough to believe, for one second, is that this matters. The makers of software, cars, personal care products, breakfast cereals, yogurts, etc., etc., etc., just stop producing things all the time. Products have life cycles, some much longer than others. But when the entity that makes a thing stops making it, unless it's a physical thing where new old stock will be around for some period of time, if you're smart you let it go and move on. You aren't going to win those wars, ever, as an individual or small entity. And only on the very rarest of occasions does group action of any sort result in a reversal, so don't hold your breath even if there is a "mass uprising" of sorts among customers. There are all sorts of reasons, most of which we as consumers will never be privy to, that drives the decision to discontinue something no matter how much we may love it.

 

[Nathan Igo]

Guess I will have to make sure to keep an install of Win 10 with IE still on saved somewhere for multiple clients that need it for specific sites as well. Ill have to set them up with a legacy system in the office with very restricted access to submit or receive documents. Just in California there are still government run sites that have to be accessed through IE and I don't count on them upgrading at any point. These industries range from:
Psychiatrists patient documents retrieval and submissions
Title 24 submittals for permits for any new building permits
Architectural submittals for permits
Ground survey submittals for permits
Child services checkup documents submittals

These are just the few off the top of my head that I service that can only use IE for certain tasks but I am sure there are plenty more when it comes to any form of government controlled forms.