This has the potential to become a serious security risk. Picture the following - you're running File Explorer with admin creds, all while invoking a malvertisement.
back
1 comments
FYI: these are in-ecosystem ads (so they all come from MS). The messaging is quite similar what they already do with notifications elsewhere in the system ("Edge is faster than Chrome").
It's still manipulative bullshit, but it's not the gaping security hole that it sounds like it 'ought to be. Even so... this type of behavior is what made me drop Windows over 5 years ago now.
> these are in-ecosystem ads (so they all come from MS).
For now.
I think it's incredibly naive to believe it would stay that way. Or maybe I'm just cynical.
EDIT: Considering the fact that the Start menu displays ads for 3rd party software, nah, I think it's naive to assume the ads in Explorer would always come from MS.
Right? Imagine what happens when a program hijacks it to inject malvertising or smth similarly nefarious...
In the past Microsoft has had issues with subdomain takeovers[0], resulting in spam being distributed by their own domains.
Without strict guarantees and control over the way this content is delivered to end user systems, how can we know that a similar type of attack could not happen? This time in a potentially administrative level file explorer?
[0]: https://www.zdnet.com/article/microsoft-has-a-subdomain-hija...
>Without strict guarantees and control over the way this content is delivered to end user systems, how can we know that a similar type of attack could not happen? This time in a potentially administrative level file explorer?
Sounds like you're not really against ads, but any sort of stuff that can change runtime behavior (eg. feature flagging) or retrieves content dynamically.
I would say that I am not pro-advertisements but I understand things need to be paid for. Software worth using is worth paying for. But I would prefer to pay in currency and not time and attention.
Additionally, a paid Operating System pushing additional premium features on increasingly more and more pixels is a little egregious. My file browser should be boring and not contain surprises.
I don't believe it has yet been established if these ads are downloaded on-demand. If the messaging is instead shipped via Windows Update, I don't think that would create any additional attack surfaces.