Originally posted by Shane
i have active x set for "prompt" and i always deny unless it's some ***'d site that i want to use that "needs" it.
Shane has the right idea. You get the security of not running activex unexpectedly with the flexibility to enable it on demand. Skuzzy's approach gives little (if any) extra security unless it is to protect the user from making poor decisions.
In some ways, it may be less secure if, upon encountering a broken website of some sort, a user just turns off ALL security to get it to work instead of realizing it's that one component that's switched off that needs to be altered.
I've seen plenty of people just turn their firewall off to play games, for example, instead of creating specific rules. Why? Because it's easier, even though they are placing themselves at risk. Is is the fault of the game? Is it the fault of the user for installing the firewall? Not really. The root cause of the problem is the manufacturer of the firewall making it too restrictive at the cost of actual realized security.
Another example of the above, when a company changes its security policy so that all passwords must look like abD!fF#098 (case sensitive) plus requires the user to change it every few weeks. Actual security goes down because more and more users will resort to physically writing the password down on paper.
Just my $.02 based on years of experience in the computer security industry.