Most of us are familiar with Sandboxie and the protection it provides. However, Sandboxie is currently not able to sandbox applications from Windows Store. The solution for Sandboxie users is to download the desktop version of the application and sandbox it. An example for this is Skype. Now, if you look at Skype in the Windows Store it is only allowed to do 'certain' actions in Windows. I suppose you could say that all apps downloaded and installed from Windows Store are sandboxed by Windows, correct? To the big question; What provides the best protection when you choose between either the Sandboxie'd desktop app or the Windows Store app?
Windows' "sandbox" mechanism is called Appcontainer , which is one step safer than Sbie in term of integrity level because, as you said , the apps is restricted to selected system areas based on its needs. At the moment Sbie (and any other sandboxes) is limited to "untrusted" level. Appcontainer exist since Win8 and AFAIK , i didn't see a Metro Apps being exploited yet. so to answer your big question, i would rather use the metro apps version. If you use Chrome , you can set it to Appcontainer via a tweak.
Thank you. I read your post here and will try it now. I'm currently using Metro apps for everything except Spotify (which doesn't exist as Metro but I use Sandboxie on it). Chrome was the only process except Spotify which I was worried about. But it's great that I now have it in AppContainer. Why isn't it enabled by default? Too risk a few % of the users will run into problems of the millions in total?
