Restricting Insecure Applications

Back in August I wrote about a free security program for Windows XP called DropMyRights. It comes from a trusted source, requires no maintenance and incurs no overhead.

DropMyRights works by front ending an application. To use it with Internet Explorer for example, you make a shortcut to DropMyRights and modify the shortcut include the full path to the IE executable. When DropMyRights runs, it, in turn, invokes Internet Explorer. But, as the name implies, it first lowers the "rights" for IE.

Thus, even if you are logged on to Windows XP as an Administrator, IE will run with the restricted rights of a limited user. Windows prevents restricted applications from doing a whole host of dangerous things, the most important of which being modifying the system itself and installing software.

For the ultimate in safety, you would, of course, log on to Windows as a restricted user in the first place. But, that brings along it's own set of problems and has proven unworkable for many people. With DropMyRights, we try to hit a happy medium. Although logged on to Windows as an Administrator, we can run the most dangerous programs in restricted mode. But which applications should be run in restricted mode?

As a given, I suggested web browsers (each one, if you have more than one installed), email programs and Microsoft Office. It turns out that two organizations publish lists of the most insecure applications. Let's go see.