can i sign a jscript activexobject? 
Author Message
 can i sign a jscript activexobject?

When an ocx activexobject is placed on a page you can sign it so when
the warning comes up in ie4 or ie5 the user sees a signed certificate
and decide wether or not to trust the prog according to the
certificate.  I am trying to implement a function in javascript that
uses a jscript to define a FileSystemObject and a warning message comes
up recommending the user not to continue with the running of activex
controls, it does not state that they are unsigned or even give a hint
that the activex could be signed.  Is there anyway to assure the user to
continue such as a signed certificate???


Tue, 17 Dec 2002 03:00:00 GMT  
 can i sign a jscript activexobject?

Quote:
> When an ocx activexobject is placed on a page you can sign it so when
> the warning comes up in ie4 or ie5 the user sees a signed certificate
> and decide wether or not to trust the prog according to the
> certificate.  I am trying to implement a function in javascript that
> uses a jscript to define a FileSystemObject and a warning message comes
> up recommending the user not to continue with the running of activex
> controls, it does not state that they are unsigned or even give a hint
> that the activex could be signed.  Is there anyway to assure the user to
> continue such as a signed certificate???

Hi,

The reason you don't get the signing dialog is because the FileSystemObject
is already on your computer (it is in scrrun.dll). The code signing *only*
gets checked when you download something off the web. Once it is on your
computer, there's not much point checking it for signatures any more.

You get the warning about the FileSystemObject because it is *NOT* safe for
scripting. It can do things like create, modify, and delete files on your
computer, and hence it's NOT the sort of thing you want hackers to be able
to do on their web sites (or in e-mail they send to you).

There is no way you can get this message not to appear without changing the
security settings of Internet Explorer on every machine that you wish the
control to run on, _AND THAT IS A VERY BAD IDEA!_

The way to get people to say "Yes" is to educate them. You need to let them
know what you are doing, and what they need to do to load your page. IF THEY
TRUST YOU then they might say "Yes" to the warning; if they don't trust you,
they will (or should) say NO. You should also make it VERY CLEAR that, in
general, they should NEVER say yes to this warning unless they know exactly
what they are doing, where the code / web page came from / etc.

Peter

--
Peter J. Torr - Microsoft Windows Script Program Manager

Please do not e-mail me with questions - post them to this
newsgroup instead. Thankyou!



Tue, 17 Dec 2002 03:00:00 GMT  
 
 [ 2 post ] 

 Relevant Pages 

1. Getting classID from Jscript or VBS created ActiveXObject ???

2. How to get ActiveXObject Events in Jscript

3. ActiveXObject in JScript

4. Authenticode to sign JScript - Microsoft please reply!

5. Can you sign Jscript?

6. how to sign JScript scripts

7. Signing JScript

8. ActiveXObject location question

9. ActiveXObject does not work from another machine !!!

10. ActiveXObject

11. ActiveXObject Mac IE 5

12. ActiveXObject - CreateObject

 

 
Powered by phpBB® Forum Software