Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This question is linked to my post Downloading file and internet security issue however this is more abstract.

Consider the following:

Website "www.example.com" added to trust zone.

  1. Navigate to a website using internet explorer, download a file (No problem)
  2. run application as administrator, the application navigates to the web site, download a file ( Windows Internet Explorer blocked this site from downloading)

What is the different between 1 and 2? For me, Internet Explorer runs under admin rights and the application as well. Then why does Internet Explorer block the file from downloading via the application?

share|improve this question

migrated from stackoverflow.com Dec 6 '12 at 8:01

This question came from our site for professional and enthusiast programmers.

add comment

1 Answer

For one thing, the application layer here adds an additional level of risk.

In option #1 to modify the file itself, a potential attacker will need to have access to your data structure.

In option #2 the attacker may also harm you by modify the application itself (injecting it so it will send you a wrong/harmful file instead) which is somewhat easier to do than to gain full access to the websites files. (generally speaking)

I see your point. Granted, both options are somewhat risky, but the second one is simply more "hacker prone".

In the end, this boils down to risk management and calculated chances.

Finally, for executable files, IE should provide a warning - one way or another.

I stopped using IE several years ago, so maybe I wrong about this... Still, FF and Chrome will warn you, even if its "just" PDF.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.