On Windows 8 and plugins

Tags: Windows 8, Metro, plugin, e-ID

The views expressed in this blog post do not represent Signicat or any official or unofficial Signicat policy or standpoint.

"We are taking bold steps at Microsoft", Ballmer said during a presentation of Office in San Fransisco the other day. And it's hard to disagree.

While Windows 8 definitely brings several improvements and nice features to the table, it also brings an operating system designed for tablets (my words) to our powerful business machines that we use to carry out work and everyday tasks on. Personally, I think there's a reason why MacBooks don't run iOS, but maybe that's just me.

Going tablet on the desktop Metro carries with it a set of challenges that we need to face immediately — before casual users start carrying their new Windows 8 laptops home from RadioShack. Specifically, I'm talking about plugins. If we head over to the Internet Explorer Developer Center site at MSDN, then this is what we see:

Get ready for plug-in free web

"Get ready for plug-in free browsing"? I don't mean to be rude, but we know all about the plug-in free web — we've had smartphones and tablets for years and we understand the reasons and reasoning behind it, but trying to make it sound like not supporting plugins is some kind of feature introduced with IE10 is a bit of an eyebrow raiser. The word that comes to mind is "removed", not "reimagined", in this particular case.

I don't enjoy polluting the environment, but sometimes I'm required to contribute to the global carbon dioxide emissions in order to transport myself to places where I need to be. I don't love cars and I also don't love fast food for that matter, but sometimes I have to drive and get something quick to eat. I don't love plugins either, but I recognize that they have been around for a long time and that I sometimes have to use them when there are no better options.

Why does this concern me? Because I've got a feeling that it's going to be a problem. This is the most disruptive, non-backwards compatible change in Windows since... well, some other change, I don't know.

I'm going to talk a bit about Europe in general and Scandinavia in particular for a minute. In this part of the world, it's common for countries to provide authentication methods that enable you to use your real identity online (think SSN and unique identifiers), usually with very high national coverage. The EU is pushing hard in that direction as well, working towards a European e-ID.

Solving the e-ID problem is not that easy — how do you implement a high security client which can be used to identify the user without resorting to plugin technology? How are you going to do two-way SSL with specific certificate requirements, how are you going to encrypt, transmit, decrypt and verify critical security information securely using CSS3 animations (or whatever your idea of HTML5 is)? If you look at the Scandinavian e-ID situation, you'll see that all available methods use either Java or an executable to do their thing. That's not because applets and GridBagLayoutManager are cool, it's because the requirements for secure end user authentication can not be sufficiently fulfilled (cross browser) using HTML and Javascript. It's kind of like DRM for internet video — if your requirements say "DRM", then plugin it is. You can hate it all you want, sure, count me in, but that's the way it is.

Microsoft seems to be unaware of plugin use cases other than video and games, if I may say so. In addition, they seem to have revised the definition of "the plugin-free web" when they recently published this blog post describing how certain types of pre-approved Flash content can be allowed to run in Metro (if your request to be added to the Compatibility View-list is granted). As far as I know, that's just Flash though. For other types of plugins, Microsoft provides us with this table of how to make the transition to the almost-plugin-free web:

Get ready for plug-in free web

Not so helpful. (On a side note, it's a bit curious that the "Graphics" row doesn't mention WebGL, but I guess there's a reason for that.)

Anyway, so what do we do, what's our best option when it comes to plugins in Windows 8? Well, Microsoft provides us with what they refer to as a "last resort" when plugins must be used. It's a one-liner, here it is:

<meta http-equiv="X-UA-Compatible" content="requiresActiveX=true" />

The idea of the tag is that IE10 is going to read it and suggest that the user opens the page in Desktop mode instead of Metro. Problem solved. Or is it? What about the session you had in Metro IE, what about cookies, what about the other tabs in Metro IE that had information you needed, what about the user experience? What about Chrome and Firefox for Metro, should they try to switch to their desktop counterparts as well?

The casual user won't have any idea of the desktop vs. Metro differences in Internet Explorer (a good thing), and it's quite likely that he/she is going to have a suboptimal experience when visiting her internet bank in Metro and suddenly is prompted to "open Internet Explorer on the desktop". What does that mean to normal people? In the case of online banking, insurance and other places where e-ID is commonly used, it's not like entire web sites are made up of Flash and applets — generally you interact with the applet or executable only when authenticating or signing a document — but jumping to desktop means you stay on the desktop. In other words, you will not be able to use Metro with pretty much any of the internet banks, government services, health- and insurance sites that require strong authentication and that rely on plugin technology to achieve that (that would be all such services, in this part of the world).

Microsoft is putting in some effort in trying to get us all to move forward. That's good. And when "moving forward" means "please stop using the browsers we used to make", I'm fine with that. But to me, it seems that the changes introduced with Windows 8 will require a significant amount of work for a large number of organizations. In addition to that, the end users will have to "grok" Windows 8 as well, meaning that they in some sense will need to understand the technical aspects of the operating system in order to be able to use it properly.

I've prepared a video for you where we look at several different scenarios and how they will behave in Metro. I recommend that you watch it since it will allow you to prepare for the changes that are set to arrive this fall.

You may download the video in MP4, WebM, Ogg or WMV. Please feel free to comment below or send me an e-mail if there's something I misunderstood or need to know. Thanks. /Marcus



  • Sahil Malik said

    I just tweeted your link, I think this is an excellent post. HTML5, good as it may be, doesn't offer a replacement for a large percentage of things that we absolutely need. You've identified one here - that is plugins. There are many more.

    As far as Win8's decision to disable plugins in Metro IE, time will tell if Win8 is a good tablet, or a good desktop or both or neither. I have my opinions on this of course. :)

  • Marcus Almgren said

    By the way, as of right now, there is no way to detect and distinguish between Metro and Desktop IE -- the User Agent string is the same. http://blogs.msdn.com/b/ie/archive/2012/07/12/ie10-user-agent-string-update.aspx

  • Geert Doornbos said

    It doesn’t make sense to brag about plugin-free ‘as a feature’, that I can follow. But I like the main idea behind plugin free browsing.
    The possible problems you’re talking about (EU identity, etc.) should not be implemented by some company’s plugin. That should be a good solid design that is based on a standard (most likely worldwide) and implemented in the browser (and/or OS). Otherwise, every European that wants to access such site should first download and install a plugin? And the plugin-maker should make a version for every available browser?
    Why are plugin’s handy? F.i. because one can add functionality/features without waiting for new releases of the browser. In case of visual additions by plugins, it feels (sometimes looks) like a Christmas tree. Or plugins that modify webpages, f.i. like skype does? A designer can create a beautiful website but looks bad when the user sees it because of all the chrome.
    Do you see that side of it too?

  • Marcus Almgren said

    Geert, if there was an open standard to securely authenticate users (and I mean secure, not username/password), then this blog post would not have been written. This is not about visuals, not about installables that modify the web site -- it's all about security. The solution you are suggesting is the exact solution that everybody wants. Only problem is, it doesn't exist.

Add a Comment