Is Sandboxie useless on Windows 10?

Since Windows 10 uses appcontainer and is more safer than Sbie's untrusted integrity level, give me the one reason why should I use it?
There is also incompatibility with Metro apps and with Microsoft Edge.
What should I do, I'm in great dilemma, I'm not even sure if Sbie can help vwith privacy, since the entire Windows 10 is like a no-privacy platform, so even if Sandboxie deletes cookies, you still have the entire Windows 10 to make it private, I myself use Windows 10 64-bit, unless somehow Sandboxie manages to make compatibility with Metro apps and Edge, and especially that Appcontainer issue, I just don't see using Sandboxie again.

For example Google Chrome on Windows 10 is protected by Appcontainer, what happens when you run it and surf inside Sandboxie, who's integrity level is higher and therefore more risky to use, than without it?
I mean appcontainer will just mix up with untrusted integrity level and than what?

 

Not everything uses Appcontainer. For example, Firefox doesn't. So, people that use firefox-based browsers can still use sandboxie.

Only when you enable it at Chrome://flags. The default is untrusted.

I checked this in the past using process explorer.

Chrome default = untrusted
Chrome (with appcontainer enabled) = appcontainer
Chrome (with appcontainer enabled) + sandboxie = untrusted

 

Only Metro Apps uses AppContainer, others 3rd party softwares don't ; hence using Sandboxie (or other sandboxes) is still useful , not saying Sbie other features.

About Chrome you use it either with Appcontainer enabled or in a sandbox (which is even debatable), not both.

 

Well, this only means that Chrome with appcontainer and Sandboxie are less secure than Chrome with appcontainer without Sandboxie?

 

Well, I truly hope that Sandboxie will be able to fully resolve all compatibility issues with all apps, not just Metro apps-since you never know what will Windows 10 creators put inside appcontainer?

And how do you turn on Appcontainer in the first place?
Also, what's the point of having Sandboxie if you can't sandbox Microsoft Edge and all other web-browsers in the first place?

 

Yes, that seems to be case.

Go to - chrome://flags/#enable-appcontainer
And set it to enable.

Warning: If you use Emsisoft, it will cause your browser to crash. You will have to make exclusions for Chrome on Emsisoft before enabling the flag. However like stated here this will disable parts of the behavior blocker as well as the surf protection for the Chrome process
http://support.emsisoft.com/topic/1...h-experimental-appcontainer-mode-on/?p=145861

So far, I'm not aware of any other antivirus/security product that has an issue with appcontainer.

 

There are many reasons to use Sandboxie on Win 10. Here's some of mine:

- Easy way to flush away the detritus gathered against your will during the average surfing session

- Runs non-AppContainer apps (which I personally find rather limited from a functional perspective) as untrusted lowering the threat for things like media players, office apps, PDF, P2P, Firefox (and other browsers that don't employ AppContainer)

- Easy way of running apps in a RAM disc (setting SBIE container on Ram Disc)

- Easy way of restricting Sandboxed apps access to my personal files

- Ability to sandbox anything running in a specific folder or location reducing the risk of opening malicious downloads, infected USB/Discs etc.

- Can still test some software in it and configuration changes to apps at no risk

I do run Chrome sandboxed because I'm yet to be convinced that overall AppContainer is any better/safer for my threat model than how I run it in the Sandbox. I don't dispute AppConiner restricts the ability of exploits to do damage and imposes a further reduction in privilege from Untrusted. However I'm not convinced that overall I don't lose out by not running Chrome in SBIE. My thinking is as follows:

Firstly all the Chrome processes run Untrusted in SBIE whereas with the AppContainer switch only some run with that integrity level. Others run at Medium. Is that an issue? Don't know and no-one has been able to explain it properly. Guess I need convincing all running Untrusted is worse than some running at Medium.

Secondly AppContainer allows applications certain 'Capabilities'. These are enforced rather than customisable as they are with SBIE and, for example, allow Chrome to see my personal data and start other applications (that don't run with restrictions - office and PDF readers for example) that my SBIE set-up won't allow.

Thirdly SBIE clears away the rubbish when I close without relying on third party cleaners or less than trusted (by me at any rate) extensions to the job.

I value those three things above the further reduction in rights imposed by AppContainer. Of course YMMV.

Cheers

 

UAC protects higher IL objects from lower IL objects, but allows side by side infection. So all processes having same Integrity Level is not an improvement. On top of that Sandboxie parent runs with high IL, which opens more doors than broker process of Chrome running medium IL.

All your other remarks are valid (for you). We are not talking about good or bad, but discussing fractional differences in regard to top notch security (both Chrome and Sandboxie) heavily influenced by personal preferences.

When you use an insecure browser, then it is smart and secure to use Sandboxie. As for myself, i have plenty sandboxes around Chrome using Windows mechanisms only, so I have no need for Sandboxie.

 

Personally I would use SBIE on Windows 10 for same reasons that I use it on Windows 7:
- clear browser data when I close a browser. On my system, Macrium incremental daily images of system partition are usually 20 - 30 MB bigger when I run browser outside SBIE.
- redirect all browser activity to RamDisk.
- prevent browser from accessing my personal data.

 

Due to Firefox, I also use SBIE with Windows 10.

 

Thanks for that. Too much already said about the likelihood (or otherwise) of using sandboxed apps to exploit SBIE itself to get to that high IL. No need to go over them again but I do appreciate this and other responses you've given me on this subject in the past

Yeah, if we all gave each other space to make our own decisions and realise that because we're enthusiasts we talk at the edges, rather than seeking some absolute truth in terms of home user security (that doesn't exist) this would be a more useful forum in my opinion. As it is too many 0s a 1s wasted on minutiae that in terms of real world scenarios makes statistically irrelevant differences. Anyway............

 

Those running at medium IL are generally the GUI process, not much a risk.

Those capabilities are harcoded during the apps creation because they are needed by the apps to function (accessible folders/areas, etc...), those capabilities are the core of the sandboxing mechanism of Appcontainer; Sandboxie does the same, if not any softs ran in Sbie won't work.

 

Listen, my colleagues, I would personally use Sandboxie if it fully support and be fully compatible with all those Metro apps, including Microsoft Edge.

 

Of course, if it doesn't work as you wish, don't use it.
Since you asked "Since Windows 10 uses appcontainer and is more safer than Sbie's untrusted integrity level, give me the one reason why should I use it?" in OP, I described reasons why I would use it. But of course, if you know what you want, those reasons might not be important to you.

 

The IL of Edge is safer , but Sandboxie compensates with its others nice "locking" features.

 

One thing I do not understand: It is easily possible to use Google Chrome with appcontainer enabled under Sandboxie's protection, and yet you cannot do the same with Microsoft Edge-but Microsoft Edge and Google Chrome as very similar sandboxes, so why than Sandboxie cannot sandbox Mixrosoft Edge under the protection of Appcontainer?

 

you asked this question already in the Chrome thread https://www.wilderssecurity.com/threads/chrome-sandboxed.377440/page-25#post-2566593

Sbie's dev just said that they working on it and it is difficult task: http://forums.sandboxie.com/phpBB3/viewtopic.php?f=4&t=22380 because it is like implementing a sandbox in a sandbox.

 

appcontainer for chrome does prevent various security apps from monitoring chrome. I saw this happen with Hitmanpro.Alert, and I saw a post about Malwarebytes AntiExploit, on their forum.
So with appcontainer, you gain on one side, and lose on the other side.

 

appcontainer for chrome will block hitmanpro.alert and malwarebytes antiexploit from functioning in chrome.
I suspect it will do the same with other security softs

 

HMP.A supports AppContainer-processes, and the hmpalert.dll is properly injected. But MBAE isn't able to inject into these AppContainer-processes.
There is a post in the MBAE-Thread about this:

 

On Windows 10 I don't think exploit protection is a big issue link , so I would not mess with Chrome's sandbox. On Windows 7 and 8.1 I have added MemPortect link

 

well, I tried it, and I don't see HMPA's green border and the stuff in the lower right corner

 

do you mean that on win10, you would not enable appcontainer, or that on win10, you would not use third-party apps like HMPA?

 

The latter, not use third party like: HPMA or MBAE, I use HenryPP's chromium already with CFG enabled.

Don't want to turn this thread into is HPMA useless on Windows 10, but Edge is also limiting DLL injection (link), Chrome developers will match this type of hardening soon (or maybe they already have, since you don't see green border of HMPA with Chrome).

 

Do you have this setting enabled?
https://i.imgur.com/92VE9vW.png
Show colored window border around protected applications

Besides the border issue. What other features of HMP.A do you know that don't work? I know that the keystroke encryption works fine.