06-13-2019 01:56 PM - edited 06-13-2019 03:31 PM
06-13-2019 01:56 PM - edited 06-13-2019 03:31 PM
I asked this in another thread, but I believe this is worth making a new thread over. So I've been seeing reports on other websites that IE mode is now available in dev/canary edge chromium, but if I try it out, it just says I need to update my version of internet explorer. I've also heard that it only works right now with those who are 20H1 insiders. Is that true? Can someone from the development team or someone who is a windows 10 insider shed some light on this confusion?
06-16-2019 06:02 PM
I am using 18.104.22.168 on Windows 10 1803 x64 Enterprise.
I have enabled flags following this :
I am still getting same error
Can't open this page in Internet Explorer mode
The version of Internet Explorer on this device doesn't support integration with Microsoft Edge. Updating your PC might solve the problem.
So I guess its still not available yet or not complete yet !?
06-17-2019 04:49 AM
And at the same time, I have heard rumors that those who are part of the 20H1 insiders program have had success in opening a page in IE. I am hoping someone that is part of the 20H1 program can give an insight if that is true or not. If it works in 20H1, then it's not that far off from completion.
06-22-2019 09:32 AM
@Drew1903 "See where things stand after you bring that machine up to 1903."
We know that IE tabs works in 20H1. It does not work in 1903 Build 18362.175, as you confirmed in the other thread. That might change if Microsoft issues a July or August monthly update that incorporates the changes apparently made to the embedded IE code in 20H1.
I know that IE tabs is important to enterprise customers, and I'm hoping to find a technical paper on how security is implemented for IE tabs.
06-23-2019 12:57 PM - edited 06-23-2019 01:05 PM
@He-Man84 @tomscharbach @hiren1610
No wonder superficially, instinctively, this made no sense...
I owe y'all a HUGE apology:exclamation_mark: The suggestion of ONLY Windows Insider Builds giving IE Mode is 100% rubbish. I am SO sorry, I don't know how I forgot that I did have it because of a flag. Plum forgot grabbing it back whenever. I, now, have it on Dev & Canary on BOTH my Insider W10 AND my Windows 10... because of doing the flag w/ the W10 installs, as well.
Forgive me for saying I had confirmed this theory as valid, it is not. IE Mode works on BOTH Insider Win10 & regular Win10 with a flag. Indeed, it has not, actually, 'arrived' in Edge C, yet. Excuse me for supporting misleading people.
Yes, currently IE Mode requires flags. Period. Applies to any & all Windows 10 Versions or Builds.
And, @hiren1610 , your 1803, still, must be brought up to 1903.
06-23-2019 01:51 PM - edited 06-23-2019 03:09 PM
@Drew1903 "IE Mode works on BOTH Insider Win10 & regular Win10 with a flag. Indeed, it has not, actually, 'arrived' in Edge C, yet. Excuse me for supporting misleading people.
Yes, currently IE Mode requires flags. Period. Applies to any & all Windows 10 Versions or Builds.
And, @hiren1610 , your 1803, still, must be brought up to 1903."
If I understand you correctly, a user wishing to test IE tabs must be on Windows 10 1903 or higher (that is, one of the Insider builds) and one or both "IE integration" flags (see below) must be enabled. Is that correct?
06-23-2019 04:24 PM
Yes, Tom but, there's a more than that... In regard to W10 & my saying be on 1903, that is because fundamentally 10 should, now, be on 1903 and definitely not be on 1803, anymore. But, the flags are needed for IE Mode in Edge C no matter what Windows OS is involved (7, 8, 8.1, 10 or 10 Insider Build) or even if on a MAC OS . Dev & Canary will run on all of the above, now, btw.
06-23-2019 06:13 PM
@Drew1903 You seem to suggest that works on Windows 10 builds other than Windows 10 1903 and Windows 10 Insider builds (e.g. earlier Windows 10 builds, Windows 7, 8/8.1). I hope you are wrong about that, but I assume you've tested and are right.
If IE integration works on legacy builds, that fact suggests that the engine behind the flag is similar to Blackfish Software's "IE Tab" for Chrome, running IE within Edge Chromium without running the tab in a mini-VM, sandbox or other security container.
Running Edge Chromium is risky enough (it can be run in administrator mode, granting the browser and every program that inherits rights from the browser a relatively high level of system privileges), and running IE and the legacy components that are embedded in IE in such an environment compounds the risk.
That does not inspire confidence in Chromium's built-in security.
06-23-2019 06:36 PM - edited 06-23-2019 07:04 PM
Maybe, I am wrong, Tom. I reckoned since one can run Dev & Canary on systems other than 10... that IE Mode could be used in Edge C while it's on those other OSs, too. Someone who has something other than 10 would have to test that, try it; I only have 10 available to me.
Regarding 10, I just don't think or talk about versions prior to 1903 because (in theory) they are not in use anymore, at this point in time or shouldn't be.
I am going to disagree about how safe IE Mode is. With Edge, if & when you run a site in IE, that opens, actually, as IE in its own, separate browser window. If there is or will be any security issue that's it, right there. This approach of an IE Mode within the default browser is supposed to be safe(r) & not have IE's (poor) level of performance.
06-24-2019 04:56 AM
@Drew1903 "Maybe, I am wrong, Tom. I reckoned since one can run Dev & Canary on systems other than 10... that IE Mode could be used in Edge C while it's on those other OSs, too."
Well, I hope you are wrong (that is, I hope that IE Mode implementation requires changes made at the OS level, such as some form of containerization), but I'm afraid that you are not.
"I am going to disagree about how safe IE Mode is. With Edge, if & when you run a site in IE, that opens, actually, as IE in its own, separate browser window. If there is or will be any security issue that's it, right there. This approach of an IE Mode within the default browser is supposed to be safe(r) & not have IE's (poor) level of performance."
That would be a fine theory (a) if browser IE tabs were individually containerized in such a way that a security risk could not escape the tab instance into the browser, or (b) if the browser itself were running in a container (e.g. EdgeHTML's separate kernel) so that a security risk could not escape the browser into the OS. But (as far as I understand it so far, absent definitive information from Microsoft) neither is the case with Edge Chromium.
The risks would be mitigated somewhat if Edge Chromium could not run with administrator privileges, but (unlike Edge HTML) Edge Chromium can do so, inheriting privileges from apps opened in the browser and passing inherited privileges to apps opened by the browser. What that means, stripped down to the basest essentials, is that a risk coming into the browser can exploit administrator privileges and migrate into the OS. That's not good.
IE is required for websites that either (a) run on depreciated legacy code that will not run properly on modern browsers (hence Blackfish Software's IE Tabs extension in Chrome), or (2) use depreciated legacy engines (e.g. Active X, Silverlight, etc.) that pose inherent risks.
Displaying an "IE required" website or web app in Edge Chromium IE Mode drags legacy code and/or engines into Edge Chromium.
I know that because I did a simple test: I do not allow IE on my computers. I turn off Internet Explorer 11 as a "Windows Feature" on install, and have done so since 2009-2010. With IE turned off (my default mode), IE tabs doesn't work, displaying the standard "Can't open this page in Internet Explorer mode. The version of Internet Explorer on this device doesn't support integration with Microsoft Edge. Updating your PC might solve the problem." error message. I took one of my computers (the throwaway laptop) and temporarily enabled Internet Explorer 11 as a "Windows Feature". With Internet Explorer 11 enabled, IE Mode worked. That suggests that IE Mode in Edge Chromium is running IE legacy code and/or engines in Edge Chromium.
That would be fine if Edge Chromium were running IE legacy code and/or engines in a way that exploits could not escape (a) the tab, or (b) the browser, and (c) if escaped, could not inherit administrative privileges. As I noted above, that doesn't seem to be the case, based on what I know so far.
A caveat: My statements are based on what I understand at this time, an understanding that is not based on definitive information from Microsoft at this very preliminary stage of IE Mode design/implementation. Microsoft is more likely than not to put protections in place. We can but wait and see. The intended user base for IE Mode (enterprise customers with legacy web apps) is not going to implement IE Mode without a full understanding of the security risks and in-built mitigation efforts. That means that we will see Microsoft technical information documenting IE Mode (security risks and mitigation efforts) before Edge Chromium is released.
06-24-2019 12:54 PM
Certainly, there is lots that can be said about (IE Mode) at this point in time. However, you bring me to a very 'intense', very fundamental concern of mine which, transcends it all & is a serious underlying issue. I am referring to people continuing to use pre-10 systems and especially those which are or are soon going to be unsupported. The prudence of being on 10 is a message that needs to be accepted without hesitation, balking or clinging (longer) to pre-10 OSs.
06-24-2019 02:48 PM
@Drew1903 "The prudence of being on 10 is a message that needs to be accepted without hesitation, balking or clinging (longer) to pre-10 OSs."
Do you suppose that porting Edge Chromium to Windows 7, 8 and 8.1 sends that message to users "balking or clinging"? It wouldn't seem so to me.
06-24-2019 02:59 PM - edited 06-24-2019 03:16 PM
06-24-2019 03:06 PM
@Beau Mersereau I tested on Windows 10 1903 Build18262.175, with "Internet Explorer 11" enabled in "Windows Features" and both "IE Integration" flags (see below) enabled. I didn't go beyond looking to see if the "Settings, More Tools" menu showed the "Show this page using Internet Explorer" menu item.
This was a three-minute test, and I removed Internet Explorer 11 from "Windows Features" immediately after the test was finished, so I can't attest to how well IE integration works at this point. Drew1903 seems to have done more complete testing, so he might have more information.
06-24-2019 03:31 PM
Do you know what build of Edge Chromium you were using? I tried Dev and Canary with no luck. Dev just pops the error message about Windows version issues. Canary pops the same error message and then launches IE in a new window. Is that expected behavior? It thought it would launch into a tab in Edge Chromium.
06-24-2019 03:45 PM
My earlier response: "I didn't go beyond looking to see if the "Settings, More Tools" menu showed the "Show this page using Internet Explorer" menu item."
Well, as it turns out, I should have gone further.
Clicking on the "Show this page using Internet Explorer" menu item returns the standard error message: "Can't Open ... The version of Internet Explorer on this device doesn't support integration with Microsoft Edge. Updating your PC might solve the problem."
Windows Version 1903 Build 18362.175
Edge Version 22.214.171.124 (Official build) dev (64-bit)
IE Version 11.175.18262.0
Sloppy testing on my part.
06-24-2019 05:43 PM - edited 06-24-2019 05:47 PM
@tomscharbach @Beau Mersereau
Oh geeez:exclamation_mark: Maybe, I did the same & didn't, actually, try it. Sure, thought I had or would have. I think I may have seen it in More tools & thought, ok, there you go, same as you did, Tom. But, yes, I am receiving the same message in 18362.175. I guess "sloppy testing" on my part, too. Another time where one should not assume anything; like because it's there doesn't mean it works, apparently.
I, even tried it with Edge C as the default browser, same thing.
Seems that puts it back to working on Insider Builds, only. Grrr, that's weird & sad. Rather leaves all the non-Insiders up a creek. And MANY maybe even most are, indeed running Edge C on 183672.175
Oh well, someday it'll work & we'll look back & laugh. "Fun with Betas or Previews". ;)
06-24-2019 06:35 PM
@Drew1903 "Seems that puts it back to working on Insider Builds, only. Grrr, that's weird & sad."
No, it is not. It is good news because it suggests that Microsoft is making changes to the OS as part of the implementation of IE tabs into Edge Chromium.
I hope that the changes are related to security, effectively containerizing the IE tab to keep both the browser and the OS isolated from IE's depreciated legacy code and legacy apps.
Unless Microsoft makes those changes, IE integration will be no more secure than using Blackfish Software's IE Tabs in Chrome. Zip, to put it in a word. That won't do.
06-24-2019 07:00 PM
"suggests that Microsoft is making changes to the OS as part of the implementation of IE tabs into Edge Chromium.
changes are related to security, effectively containerizing the IE tab to keep both the browser and the OS isolated from IE's depreciated legacy code and legacy apps."
Tom, this ⬆ relates back to exactly the point I made earlier. In the current scenario with 10, Edge & IE... When one tells a site to open with IE, it opens its own, separate, actual, IE browser window. Whereas the approach with 10, Edge C & IE is completely different. As I said back then, it, instead, is giving an IE (tab) within the contemporary browser. Ergo, with all the performance & security of the/a modern browser. Sure call it containerized; point is it's a better, much improved approach that means (especially) Enterprise can work with IE with good performance and peace of mind.
06-25-2019 08:21 AM
Thanks. I'll go back to lurking and waiting for this feature to come. I hope Microsoft is going to require people to be on a specific version of Windows 10. I hope they support 1807, 1809, and 1903 from the start.
They also need to support IE tab in Windows Server 2012 R2 (or newer), or this will be a non-starter for our organization. Without that support, Citrix users are screwed, we'll have to switch to Chrome with Legacy Browser Support.
06-25-2019 12:05 PM
Yes, it will have to be in the Server, as well.
I'm having a hard time with one thing you said, though... "I hope they support 1807, 1809, and 1903 from the start." It would have to apply right across the board because the Major Updates come every 6 months. so, things have to cover every current version & every next version. Maybe, you meant 1803 not, 1807. And, also, we don't stay on previous versions; we're only on a version for 6 months at a time.
The whole point here is/was to provide safe, secure access to IE with good performance to & for Enterprise customers, like your organization, & their legacy software. Ergo, whatever that requires will be.
06-25-2019 03:32 PM - edited 06-25-2019 05:14 PM
Y'all might find today's discovery interesting... :thinking_face:🤨 This is new & different behavior today in Canary. Dev is okay.
This is, even, after running Canary as Admin as per the note. Dev is giving IE Mode. Canary is saying it can't do IE Mode and opens IE the same as Edge does, now... in its own separate browser window. Canary 200 was doing this today and 201 has the same behavior.
I have reported this to Feedback.
I took this snip such that you can see the clock. It is VERY customisable:exclamation_mark: May perk someone's interest.