What is "Your Phone" in Windows 10 Advanced Firewall?

Question

I have an Outbound Rule in my firewall called "Your Phone".

Settings:

• All programs.
• In Customize Application Package Settings, it has "Apply to app package..." set with a long identifier starting with "S-1-15-2-1726375552-1729233799- etc. A search of my C-Drive and Registry found nothing.
• Apply to all programs and services.
• No restrictions on computers.
• Any protocol.
• All Local Ports.
• All Remote Ports.
• Any Local IP Address.
• Any Remote IP address.
• Profiles: all three of Domain, Private, Public.
• No restrictions on users.

I'm thinking this is a pretty powerful Rule. Well, the default for Advanced Firewall is to allow all outbound traffic, so its not so bad right?

There is also a "Your Phone" in the Inbound Rules. Same settings, except Public is not checked. I'm guessing it must be something that allows a cell phone to communicate via Windows 10 but I would really like to know what app or service its going through.

Can anyone explain what this is, and in particular that "Application Package" thingy?

Answer 1

It's a Windows Store app, installed by default with at least some Windows editions, that is literally called "Your Phone". I don't know why it needs such a wide hole in the firewall, that seems excessive, but at least that access is specific only to the one app package. It's a handy app, by the way; lets you do things like see phone notifications on your PC and send SMS from a real keyboard.

The long identifier (starting with "S-1-15-") is a text representation of a SID (Security IDentifier), specifically one for an "AppContainer" sandbox (all Windows Store apps, plus a bunch of built-in apps, run in AppContainers and have since Windows 8). Every app on the Store (or built in) has a unique AppContainer SID that is the same for all copies of that app, no matter where they are or whether the app is deleted and re-installed.

SIDs are in the registry but in a part that Regedit cannot read by default unless you change the ACLs or run it as SYSTEM (it's not readable, by default, even to Administrators). Every running process on Windows has a security "Token" and the token contains (among other things) a set of SIDs (for the user, for the user's groups, for the desktop session, for the mandatory integrity level, and potentially for any sandboxes such as AppContainers). Limiting the firewall rule to that SID, rather than to a specific executable, means that if the app ("Your Phone" in this case) has multiple processes running in the sandbox, they are all allowed through the firewall without creating multiple rules.

You can also use the firewall's Block rules to prevent apps from reaching some (or all) of the network / Internet, incidentally, without doing something as brittle as blocking by port or executable name.