Old news init? Thought this was announced at IO a month or so back.
Announced at IO. Releasing now.
Google's "Chrome Frame" plugin for IE no longer requires admin rights
11–20 of 24 posts
Re: Google's "Chrome Frame" plugin for IE no longer requires admin rights
#12Nice to see a bit more of the tech behind how they did it, albeit it's admittedly not much. Side note, from their FAQs: Is Google Chrome Frame open-source? Google Chrome Frame is built from open source code in the Chromium project just like Google Chrome. Does this sound like a non-answer to anyone else, or is it just me?
It does sound like a non-answer to me, because it’s a yes-or-no question and you could read either one into the answer. (Try prefixing it with “Yes! In fact, …” or “No, but …”.)
EDIT: Of the two replies before mine, one seems to have read the answer as “no, but…” while the other read it as “yes! In fact…”, and neither considered the answer particularly evasive.
One of them looked at the Chromium source code, which has evidence for “yes” being correct. Of all the reasons to need to read the source, you’d think we could avoid it when we already have a FAQ covering that exact question.
Re: Google's "Chrome Frame" plugin for IE no longer requires admin rights
#13Yay for clever technical hacks that help users circumvent ossified IT bureaucracy. But I'm a little astonished that this is possible. They're running a second process that detects new instances of IE starting up and injects Chrome Frame into them. Doesn't that make a mockery of "admin rights"? Couldn't this technique be used to do just about anything?
Re: Google's "Chrome Frame" plugin for IE no longer requires admin rights
#14Can you get Chrome itself without admin rights? That would probably be as beneficial or more for circumventing draconian (and short-sighted) IT policies.
You can download nightlies of Chromium from http://build.chromium.org/f/chromium/snapshots/Win/
While not entirely the same thing, it's a start.
Re: Google's "Chrome Frame" plugin for IE no longer requires admin rights
#15Yay for clever technical hacks that help users circumvent ossified IT bureaucracy. But I'm a little astonished that this is possible. They're running a second process that detects new instances of IE starting up and injects Chrome Frame into them. Doesn't that make a mockery of "admin rights"? Couldn't this technique be used to do just about anything?
> Couldn't this technique be used to do just about anything?
Yes. As long as the processes are all run with the same rights/users. I created an app in .Net for my old job which would detect if the F8 key is pressed while a specific database app is active/in-focus. If so, it creates a new search window (that belongs to my app, not the db app) and changes the parent handle to that of the db app window. So now I've created my own 'search' feature within the db app. For the users of the db app, they don't even know F8 feature is homebrew. It works great and people use it all the time.
Re: Google's "Chrome Frame" plugin for IE no longer requires admin rights
#16Yay for clever technical hacks that help users circumvent ossified IT bureaucracy. But I'm a little astonished that this is possible. They're running a second process that detects new instances of IE starting up and injects Chrome Frame into them. Doesn't that make a mockery of "admin rights"? Couldn't this technique be used to do just about anything?
Yes but...
Under standard Windows "idiot" mode users can download and install executables in user space and those apps can read, subvert, or destroy anything in user space. I don't really see how the way admin rights typically work in any way addresses this. Valuable stuff is generally in user space, not admin space. (I can get a copy of your OS anywhere, but your banking details and personal documents are in user space.)
One way to address this is to change the computing model away from file/folder-based to use-based (which is what Apple has done with iOS and is moving towards in Lion). I'm sure there are others, but I don't see anyone attempting to implement them at scale.
Re: Google's "Chrome Frame" plugin for IE no longer requires admin rights
#17"Awesome! Do you have any stats on how many people have installed Chrome Frame?"
I found this question interesting, does anyone know of any viable source for this kind statistics? Is the user-agent for chrome frame distinguishable?
Edit: Found the user-agent from the dev docs; "GCF reports that it is available by extending the host's User-Agent header with the string chromeframe"
Re: Google's "Chrome Frame" plugin for IE no longer requires admin rights
#18Yay for clever technical hacks that help users circumvent ossified IT bureaucracy. But I'm a little astonished that this is possible. They're running a second process that detects new instances of IE starting up and injects Chrome Frame into them. Doesn't that make a mockery of "admin rights"? Couldn't this technique be used to do just about anything?
No. A bunch of windows processes typically run under users other than the current user, and at higher integrity levels, specifically to prevent this.
IE is also intentionally run as the current user at a low privilege level, which makes it possible to do things like this to the IE process, but makes it impossible for the IE process to do things like this to other programs.
Re: Google's "Chrome Frame" plugin for IE no longer requires admin rights
#19Nice to see a bit more of the tech behind how they did it, albeit it's admittedly not much. Side note, from their FAQs: Is Google Chrome Frame open-source? Google Chrome Frame is built from open source code in the Chromium project just like Google Chrome. Does this sound like a non-answer to anyone else, or is it just me?
Not really. You can view the source code for both Chrome, Chrome OS and Chrome Frame in their repo: http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame... As a side note, after having looked at the code for a few minutes, it appears they're doing some clever things with the Chrome Frame helper program: (tidy) DLL injection into Internet Explorer, together with dynamic BHO loading using the windowing API and…
Restricting DLL injection and 'API interfacing' (if that's even a thing) to administrative users would provide no security benefit. People would just have to run as admin. DLL injection is used all over in windows to provide useful features like alternate input methods, icon overlays in explorer, etc. You aren't allowed to inject DLLs into processes owned by other users or processes of higher integrity level, so it's not really a significant security threat under the current windows model. IIRC Chrome and IE both run their processes at low integrity so those processes won't even be able to inject DLLs into other processes unless those other processes are also low integrity.
Re: Google's "Chrome Frame" plugin for IE no longer requires admin rights
#20Nice to see a bit more of the tech behind how they did it, albeit it's admittedly not much. Side note, from their FAQs: Is Google Chrome Frame open-source? Google Chrome Frame is built from open source code in the Chromium project just like Google Chrome. Does this sound like a non-answer to anyone else, or is it just me?
Not really. You can view the source code for both Chrome, Chrome OS and Chrome Frame in their repo: http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame... As a side note, after having looked at the code for a few minutes, it appears they're doing some clever things with the Chrome Frame helper program: (tidy) DLL injection into Internet Explorer, together with dynamic BHO loading using the windowing API and…
I don't think they would install a service to start the helper program. Service and desktop interaction has been changed since Vista. IIRC this was to prevent the shatter attack that allowed Window messages to be passed between services and applications. I haven't looked but I think it could add the helper to the startup items for a user, or create a scheduled task.
You don't have to use regsvr32. Registration-free COM (http://msdn.microsoft.com/en-us/library/ms973913.aspx) has been around for a while. I wonder why this was not used, or if there is a limitation with certain types of COM objects.