Use the links below to jump directly to information about the main security panels, or read the next section first for a general overview.
For example, you might want to control if and when the browser writes small bits of information (called cookies) on your machine about the web sites you visit or the actions you perform at a particular site. Or, you might want to make sure that the information you send during an online shopping session can only be read by the intended receiver.
Another security issue is how much access you want to give to programs included on web sites you visit. &browser.name.prefix;TM &browser.name.suffix; can run executable content in the form of JavaScriptTM commands or JavaTM applets, which are programs that can be included in an HTML page, much like images can be included. You can be sure that JavaScript and Java applets running in &browser.name; cannot inspect or change any of the files on your local system or otherwise violate your system privacy without your permission. By default, &browser.name; provides a secure environment for Java applets and JavaScript to run in, but you can allow more permissions and thus give the programs more power to do interesting things if you trust the program's source.
The security options provided on the Security Preferences dialog box depend on whether you are using the Basic or Advanced Security Administration Mode, as specified at the top of the Security Preferences dialog box. The Security Administration Mode tells &browser.name; how much and what type of security information you want to control. Basic mode allows you access and control over security information that you normally need to use your browser. Choose Advanced if you need more fine-tuned and detailed control over security features such as applet and JavaScript permissions, certificates, and SSL ciphers.
For example, if you're using a web site to read newsgroups, that site might use cookies to remember where you last left off reading. A stock page might use cookies to note what stocks or mutual funds you want to see information about.
Some cookies are saved in memory only for the current browser session. Other cookies are persistent, meaning they are saved to disk for a specified period of time, which may extend past your current session.
Although cookies can be sent to the server where the web site that set them resides, only the cookie information set by that web site can be sent. Cookies do not allow web servers to access other files on your system.
Many web sites that request cookies can still be viewed without setting the cookies, but some cannot. If you choose not to set any cookies or a particular cookie, you may be blocked from viewing some sites, some sites might look incomplete, or you may have only limited access to some sites.
Use the options in the Cookies section to tell &browser.name; which of the following options you prefer:
If you choose to be notified when cookies are set, you'll see a dialog box each time a server wants to set a cookie. It includes information about the cookie, including when the cookie will expire. If you select the check box "Don't show this message in the future," &browser.name; will accept all cookies in the future without notification. You can change your mind about this at any time by changing the Cookies option on the Security Preferences dialog box.
At any time, you can click the Discard Cookies button to delete all information you currently have stored in cookies. All cookies will be deleted at once.
For more information about Java applets, including demos and free
applets you can use on your web pages, see the Sun
MicrosystemsTM, Inc.
Applets page.
For information about writing your own Java applets, see
The Java
Tutorial.
For comprehensive information about the JavaScript language, including
how to use JavaScript in your web pages, see the
NetscapeTM
JavaScript Guide.
For technical information on how &browser.name; handles JavaScript and Java
applets, see the administrator's documentation set shipped with &browser.name;.
|
&browser.name; can prevent Java applets and JavaScript commands from affecting your system in any way. You can grant applets and JavaScript code more relaxed permissions, thus allowing them to do more interesting things but opening the door for potentially insecure actions such as reading or writing files.
Use the settings on the Security Preferences dialog box to set a default security level that will apply to JavaScript code and unsigned applets, and one that will apply to all signed applets. You can also completely disable unsigned applets, JavaScript, or both.
Signed versus Unsigned Applets
Signed applets contain a digital signature, which is a sequence of characters embedded in the applet's code. It is placed there by the originator of the applet, and it can't be altered or duplicated. It tells who the applet comes from, and that the applet has not been tampered with. A signature doesn't tell you anything about the content or quality of the applet, just that it comes from a particular source.
The majority of applets currently on the World Wide Web are unsigned applets. JavaScript code and unsigned applets are probably reliable, but you have no way to know their source. An unsigned applet could also have been tampered with in such a way that it does things its author didn't intend.
Note: If your version of &browser.name; does not support SSL (Secure Sockets Layer), signed applets are treated as unsigned applets. That is, signed applets take on the security level you assign for unsigned applets. This is because without SSL &browser.name; has no way to verify the certificates of signed applets. You can tell if your version of &browser.name; supports SSL by setting the Security Administration Mode to Advanced. If the only Advanced Security Mode options presented to you are for Cookies and Applets and JavaScript, your version does not support SSL. If your Advanced Security Mode options also include Web Sites and Certificates, your version does support SSL, so signed and unsigned applets can be given different security levels.
Setting Security Levels
Use the Applets and JavaScript panel to set a security level for unsigned applets and JavaScript code. You might want a more restrictive security level on unsigned applets and JavaScript, since you can't always know their source.
Use the Signed Applets panel to set a separate security level for signed applets.
Use the Special Cases panel to set a security level for applets and JavaScript from a particular web site or applets signed with certificates from a particular source.
The security level settings are:
There are a few exceptions to this rule of thumb. Applets and JavaScript with the Ask First Security setting cannot exit &browser.name; or access the system clipboard or print queue, even with a warning.
If you would like to see a side-by-side comparison of what each security level allows, see the Security Table.
Use Special Cases to override the global default security levels you set for JavaScript, signed applets, and unsigned applets.
You can set a security mode for all signed applets with a particular certificate. You can also set a security level for all applets and JavaScript from a certain web site server, but you should use caution when doing this. In general, this is only recommended for a site inside a trusted firewall, because unsigned applets and JavaScript cannot be completely protected from tampering.
Note: You cannot set special permissions for a particular applet or script. You can only set special permissions for all applets or scripts coming from a particular site, or all signed applets with a particular certificate.
There are various reasons that you might want to grant applets from a particular site or signed with a particular trusted certificate more permissive access to your system than the default. You might want to allow a downloaded word processor from a trusted site, for example, to save a file to your hard disk. Or you might want to allow applets that originate within your company firewall to have full access to your system.
Use the New button to add special security permissions for a particular web site or certificate. The New Special Case dialog box enables you to set the basis for the special case to be either:
The list of available certificates to choose from consists of certificates for all the signed applets you have previously run. Therefore, to add a certificate to this list, run a signed applet that is signed with that certificate in &browser.name; (for example, by loading a page containing that signed applet).
For each web site or certificate you specify, you can set any of the security modes described above.
Secure web sites start with https:// (as opposed to http://), and are available to you if your version of &browser.name; supports SSL (Secure Sockets Layer).
When you connect to a secure web site, information that passes between your site and the https secure server may be encrypted while in transit. Only your computer and the server can make sense of that information. This is important because it allows you to securely transfer private information, such as credit card numbers and passwords.
In addition to encrypting information in transit, SSL support means that the https secure server can authenticate itself to &browser.name;. This means that no other computer can pretend to be the secure site, and thereby intercept information you send to that site.
When &browser.name; connects to a secure site, the icon at the left
of the status bar (typically at the bottom of the browser) appears
locked:
Otherwise it appears unlocked:
You can click the lock icon at any time to display information about where the current page comes from, whether it was encrypted before it was transferred, and if it was encrypted, what cipher was used to encrypt the page.
In addition to the visual clue (the lock) that the page you're currently viewing allows secure transactions (or not), you can have &browser.name; display a warning, in the form of a pop-up confirmation notice, before either or both of the following actions:
The default is to provide both warning messages.
When entering a secure web site, the message displayed isn't really a warning as much as it is a notice. That is, there is really nothing to be worried about. Even when leaving a secure site, think of the warning as a notification just to keep you alerted to the status of pages you're viewing or sending data to. You may decide to disable the warning notices altogether, in order to access pages more quickly and with fewer keystrokes.
SSL Ciphers (Advanced Mode Only)
When you access a secure web site, (a site whose address, or URL, starts with "https://"), information that passes to and from that web server is encrypted during transmission, so there is no risk of having a third site intercept and read that information. This is important, for example, when sending credit card numbers.
Ciphers are algorithms that the are used to encrypt and decrypt this information. Ciphers with higher numbers are generally more secure than those with lower numbers.
Use the SSL Ciphers scrolling list to tell &browser.name; which ciphers you'll accept when accessing secure web sites.
Note: The Certificates options are also only available in versions of &browser.name; that support SSL (Secure Sockets Layer). If these options don't appear on your Security Preferences dialog box in the list at the left side, your version of &browser.name; does not support these features.
Certificates are digital documents (also known as digital IDs) that are used to attest to someone's identity over a network, much like a driver's license is used to attest to the identity of someone who can legally drive.
Certificates are issued by Certifying Authorities (also known as Certificate Authorities, or simply authorities). These are trusted third parties, such as Verisign, Inc., that verify identities and issue certificates.
There are three basic types of certificates that &browser.name; tracks: certifying authority certificates, web site certificates, and software publisher certificates.
If &browser.name; doesn't recognize the certificate or the certifying authority that issued the certificate, a dialog box gives you the option to connect to the site anyway just for this session, to connect and add the new certificate to the list of Web Site Certificates that &browser.name; always trusts, or not to connect. If you're running in Basic Security Administration Mode, you'll be given the option to connect for this session only, or not to connect.
If you access a page with a signed applet whose certificate (or the certifying authority of the certificate) is not recognized, a dialog box gives you the option to accept the certificate for this session only, to add the certificate to the list of trusted Software Publisher Certificates, or not to run the applet at all. In Basic Security mode, you'll only have the option to trust the certificate for this session, or not to connect.
Verifying Certificates
When you encounter a new certificate from an unknown source, you should verify that the certificate is valid. The certificates that are shipped with &browser.name; have already been verified.
When you encounter a new certificate, the dialog box that asks if you want to trust the new certificate contains a View Certificate button. In addition, each list of known certificates on the Security Preferences Certificates panels contains a View Certificate button.
To verify a certificate, click the View Certificate button to see more information about the selected or recently encountered certificate. The certificate's Fingerprint is a mathematical representation of the certificate that is difficult to forge. If you confirm that the sequence of numbers in the Fingerprint field matches the fingerprint given to you from the certificate owner, you can be confident that the certificate is valid. You need to contact the owner of the certificate (or the authority that issued the certificate) to verify the fingerprint. For maximum security, this confirmation should not happen using the Internet. Use the telephone, a fax machine, or regular mail.
Table of Contents | INDEX |
Copyright © Sun Microsystems, Inc.