Internet Explorer settings

[Diancecht]

Hi all.

I'm feeling somehow guilty for cross-posting, but I think this is really a cross issue.

My background is a web application accessed from some XP machines with IE6.0 installed. The application has some static elements that are downloaded once and stored as temporary internet files so the next time the application is called, they don't need to be downloaded again.

Now there are some more web applications accessed from there that, for security reasons, need the cache to be deleted every time the browser is closed.

The problem I'm facing is how to make all these requirements live together.

My first thought was having a kind of IE launcher for the first application with different settings for cache so they won't interfere, but as these settings are stored in the registry, I'm not so sure I can launch two instances of IE with different settings.

Could anyone give some light in this point?

Cheers,
Dian

 

[smah]

If your sensitive data is accessed by some session based system, the data should not get cached. What is the sensitive information? - is it a static image or some other specific file type? Or is it just data displayed in a web page?

 

[Diancecht]

Hi smah, thank you for your reply.

The information that I want to be cached is not sensitive, it's just a bunch of static content as images, scripts or static webpages.

As you said, the sensitive information managed in the PCs should not be cached but, a a security measure, the data from temporary internet files is erased everytime the browser is closed.

I've never seen this as a security measure. I think that if something is sensitive, it just shouldn't be cached, but who tells that to my customer's security chief?

So I think my approach will be setting the static content as offline content. That way, it won't be deleted at browser close time and it will be accesible for cache.

Anyway, any other hint would be appreciated.

Cheers,
Dian

 

[smah]

My point is that if the sensitve info is just data inside a web page, it's the web page that needs to be changed, not the client browser. Although changing the settings of the client computer will tighten down the security, it's still not foolproof & may affect normal web browsing. Also, what happens during browser updates or if the user uses a different browser? It would be better to set the web page up correctly. Here's an easy example & test:

Using a normally configured recent web browser, read some mail at hotmail.com (create an account if needed). Now, find the text of the mail on your computer - You won't. You can find some of the images, history links, etc, but not the session based content.

(And before anyone points it out: yes I know that keyloggers & screen capture & monitoring tools can still get all that info.)

 

[Diancecht]

Sorry for late reply, it was weekend time

Well, I agree in that hotmail case, but imagine you're surfing a bank web, you access your account data and get a pdf with your last movements. The pdf is opened in a browser window, delivered over SSL.

If you have the incorrect settings in your browser, the file will be in the hard disk after you close the browser, so anyone could just open it and access sensitive data.

That's the kind of information I'd like to get erased after browser closing. I'd also like it to be deleted for security reasons and to be a little more clean.

But I will be executing some applications that rely on a lot of client side scripting that I don't want to download everytime the client is accesed. I want it to be cached.

So I think my approach will be deleting the cache everytime the browser closes and add the application files as offline content, that will be cached but not deleted.

Cheers,
Dian

 

[smah]

That's what I was after - it is more than just data in a web page. It's an entirely seperate file (that just happens to be displayed in a browser). You might have better luck with this problem in forum253, there are people there that do this sort of thing all the time.

 

[Diancecht]

I don't think I get your point now. This also happens, lets say with Yahoo! webmail. If you read your mail and don't empty your temp files, anyone can access the data you saw.

My concern, anyway, is not about security but cache. I'm just after a way to have some data cached even if the "Empty" cache feature of IE is activated.

Thank you for the link to the other forum, but I'm at client side, no chance of changing the web application now.

I think I've found the sollution with offline content, if I can assume IE use the offline data as cache when connected.

Cheers,
Dian