Web Security and Commerce

Improving the Security of Downloaded Code

Although this chapter tells many scary stories, there are real protections that both users and developers can employ in order to protect against the dangers of downloaded code.

Trusted Vendors

One way to improve the security of downloaded code is to rely only on code from vendors with a good reputation who follow high standards in writing their programs.^[30]

If you choose to trust the code of these vendors, you also need to make sure that the programs you download are actually the programs these companies have created—and not booby-trapped copies. This is, in fact, exactly the rationale behind Microsoft’s Authenticode system.

Separate Execution Contexts

Another way to run downloaded code safely is to minimize the privileges available to the execution context in which the downloaded code runs. This is precisely the idea behind the Java “sandbox.” Unfortunately, implementing separate execution contexts for executable machine code requires modifications to both the browser and the operating system.

ActiveX controls currently run in the same execution context as the user’s web browser. With Windows 95, this means that the control has full access to the system. But on operating systems like Windows NT, it is possible that a control could be executed within a more restricted context with added security.

To realize added security, it would be necessary for the control to be run in a separate thread that lacked the ability to modify any portion of ...