Reply to thread

Message

<blockquote data-quote="ForgottenSeer 97327" data-source="post: 1054361">[USER=98994]@Pico[/USER] use case for running a contained application with restrictionsRun a portable version of a webrowser in a container with additional restriction to block access to ring-0, allowing this sandboxed portable only write access to the (real system) download folder.&nbsp; Being a portable application it should in normal circumstances never touch elevated processes and UAC protected folders nor registry. Enable HIPS, allowing everything except execution in the download folder.Pretty strong hassle free security. Can&#039;t imagine any malware to break through these additional containment levels.[USER=7463]@cruelsister[/USER] always removes access to real system, but maybe she could show a version which only allows access to the downloads folder of the real world system and let the HIPS protect this &quot;gateway&quot; to the real world.</blockquote>

[QUOTE="ForgottenSeer 97327, post: 1054361"] [USER=98994]@Pico[/USER] use case for running a contained application with restrictions Run a portable version of a webrowser in a container with additional restriction to block access to ring-0, allowing this sandboxed portable only write access to the (real system) download folder. Being a portable application it should in normal circumstances never touch elevated processes and UAC protected folders nor registry. Enable HIPS, allowing everything except execution in the download folder. Pretty strong hassle free security. Can't imagine any malware to break through these additional containment levels. [USER=7463]@cruelsister[/USER] always removes access to real system, but maybe she could show a version which only allows access to the downloads folder of the real world system and let the HIPS protect this "gateway" to the real world. [/QUOTE]

Verification