3

Question:

I'll put this as concretely as I can: For a small business-owning user of a Windows 10 PC who's highest-security-risk activities involve opening plenty of email attachments of PDF and Office documents from sources on the Internet, would uninstalling the traditional desktop Adobe Reader and Microsoft Office 2013 suite programs now used to open & work with those documents and replacing them with the MS Reader and Office for Windows 10 apps from the Windows Store constitute make a sizable difference in the security of that user's PC? (Assuming the user would go along with that.)

Follow-up question: If so, does that have more to do with Windows Store apps (ie. new Windows 10 and arguably Windows 8.1 apps) inherently having stronger security characteristics in the new Windows app model, or with there being so much more attention and effort put into finding weaknesses in & attacking the legacy desktop programs because they are still much, much, much more widely used?

Some Elaboration

Was writing an email to a client of mine (a small business owner) answering a question about matters related to starting to move the PCs in the back offices of the his three stores from Windows 7 to Windows 10. I was mentioning just a bit about the security improvements that might come from that upgrade when I starting trying to describe the possible benefits of using new Windows Store apps to do higher risk things like open documents that arrive in email attachments vs. using traditional Windows legacy desktop programs. I wrote this:

Using Windows Store applications to do risky day-to-day things is much safer than doing them with legacy desktop programs, because a security measure called AppContainer constrains apps that contain programming flaws [ie. security vulnerabilities] and might be hijackable by bad guys from doing a lot of bad things on your PC if that happens, because the new apps are often written in more secure ways [ie. meaning with managed languages like C# and html5/JavaScript, although C: and C++ are certainly still available choices], and because Microsoft verifies the identities of developers and screens the code of apps before they become available in the Store.

I wrote that paragraph, then stopped, thought for a second, then deleted in from my reply. Partly because I was getting more off-track about what the conversation started off being about (Windows 10 compatibility with a creaking old l.o.b. inventory program. Fun.), but also because re-reading it I wasn't totally sure it was correct.

I mean, the P.R. from Redmond certainly has been that they're a big improvement re. application security issues in the new model apps vs. legacy Windows programs. And I haven't read about major attacks occurring against say, Microsoft's official's pdf reader app in the Windows Store or the Office for Windows 10 apps, which obviously is far from the case with the legacy Adobe Reader and Office suite programs. But on the other hand there are a lot fewer installs of the new apps out there than the utterly ubiquitous traditional versions. But on the other, other hand having that AppContainer sandbox + other security technologies & mechanisms that the Windows Store apps probably has to do some good..... Huh.

Improve this question
5
  • 2
    You should narrow down the scope of your question.
    – Stephane
    Commented Nov 10, 2015 at 8:42
  • one can easily run other other EXEs and Batch files using C#. I've never used it in an App though, so it might not work there.
    – JOW
    Commented Nov 10, 2015 at 10:07
  • Why should C C++ or C# based programs be more sucessible to exploits, than say Java or PHP based!
    – Ken Mollerup
    Commented Nov 10, 2015 at 13:47
  • @KenMollerup I was trying to get at the distinction between C/C++ vs. the variety of languages that have some elements of built-in enforcement of type safety & memory safety (like C#, Java, and many, many others do). C & C++, at least as traditionally implemented, put more faith in and reliance on the skills of the programmer to do things like manage details of memory allocations himself or herself. Oftentimes with unfortunate results re. security vulnerabilities.
    – mostlyinformed
    Commented Nov 11, 2015 at 5:55
  • @Stephane Took your advice. Well, tried at least.
    – mostlyinformed
    Commented Nov 11, 2015 at 7:42

2 Answers 2

Reset to default
1

The main purpose of the store apps is to enable users to use the same set of apps wherever they go, by using their Microsoft account as the login credentials. So, as far as the password is secure and that the user account is properly signed out/locked when the PC is not in use, the user information remains secure. Further, it lets the app publisher to verify the legitimacy of the license of the software being used. So there is no possibility of cracks/hacks, making the application secure from the backdoors created by cracks/hacks.

Improve this answer
1

Adobe Reader is old code that was not written with security in mind, and opinions differ as to how much improved it is. Both the MS Reader and the Chrome browser built-in PDF reader were written to improve security, and so you'll likely see fewer exploits against either than against Reader. So that move is highly worthwhile.

Office 2013 includes a sandbox for the Viewer apps. The sandbox is not as robust as AppContainer, but Office 2013 has undergone very substantial security review and improvement, and so the gain from that change is likely smaller.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .