Samuel D. Leslie

Exempt Recycle Bin group from empty group deletion

@kibinimatik: I'm pretty confident that the protections applied by a restrictive process DACL can provide some but not all of the protections of integrity levels. Specifically, while they can limit certain operations from being performed directly on the process (e.g. Read Memory, Create Thread), they can't limit the window messages being sent to the process. This is what UIPI addresses which in turn relies on integrity levels. Restricting window messages is important as they can be used to compromise...

Hi Dominik, Thanks for the response. It sounds like this is a candidate for future development, but not a priority, which I feel is entirely reasonable. Just in regards to a few of your points: 1) I understand the point you're making here, but the counter-point is that while a sufficiently determined attacker will almost certainly succeed, it's entirely reasonable to make it hard for attackers. If the only way to successfully attack a correctly configured KeePass setup is through the usage of sophisticated,...

Hi Dominik, Thanks for the response. It sounds like this is a candidate for future development, but not a priority, which I feel is entirely reasonable. Just in regards to a few of your points: 1) I understand the point you're making here, but the counter-point is that while a sufficiently determined attacker will almost certainly succeed, it's entirely reasonable to make it hard for attackers. If the only way to successfully attack a correctly configured KeePass setup is through the usage of sophisticated,...

@dreichl: Any thoughts on this? As always, keep up the great work!

Paul: That's not true as the disclosed information (password or otherwise) is by request of the user and so not a "leak". The goal here is to harden the KeePass process from manipulation by external processes, which is not what your example is illustrating. You make a valid point re: compromising the config file, but that can be mitigated already by KeePass's support for an "enforced configuration" (i.e. where the configuration is stored in the application directory and thus not writeable by unprivileged...

Just having a quick think about implementation here. The main issue to handle is we can't typically directly launch a high IL process as you can't launch a process with a higher IL than the launching process. On a system with UAC enabled the shell (explorer.exe) runs with medium IL, and so child processes also launch with medium IL (or low IL if requested). Launching an elevated process works as there's extra machinery involved which handles the process launch. Below suggested logic assumes a user...

Just having a quick think about implementation here. The main issue to handle is we can't typically directly launch a high IL process as you can't launch a process with a higher IL than the launching process. On a system with UAC enabled the shell (explorer.exe) runs with medium IL, and so child processes also launch with medium IL, or low IL if requested. Launching an elevated process works as there's extra machinery involved which handles the process launch. Below suggested logic assumes a user...