486731 - Drop admin rights on Windows as standard

Status: NEW

(Firefox :: Security, enhancement)

Description

[ARF]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16

Most users on Windows run with administrator privileges because this was the default setting until Windows Vista for the principal user after installation. Also, often it is difficult to work without admin rights in a Windows environment.

Any program executed then inherits these administrator privileges opening the system to security-related exploits, e.g. in plug-ins, etc.

The Windows security system allows dropping certain privileged for a given program. E.g. a program can be executed with "normal user" privileges even when run by an administrator.

It would be a great step towards safer surfing if Firefox would drop its admin privileges (if given) automatically for normal operation.

Michael Howard from Microsoft has shown in 2004 how this can be accomplished with his tool "DropMyRighs" which allows running any application with restricted privileges. (Source code provided with tool.)

Further details on:
http://blogs.msdn.com/michael_howard/search.aspx?q=dropmyrights&p=1



Reproducible: Always



Expected Results:  
If Firefox is run by an administrator, it should automatically revert to "normal user" privileges.

For automatic updates, etc. where administrator rights may be required, it should temporarily restart with admin rights for the duration of the update.

The start menu could contain an icon "Firefox (Admin rights)".

Also, the options dialogue could contain an option to change the default back to keeping the admin privileges provided by an admin user.

Comment 2

[Daniel Veditz [:dveditz]]

I couldn't find it, but we've talked about wanting to do this for so long that I can't believe there isn't already a bug on it.

Comment 3

[Suzanne Smedberg]

Related to a Thunderbird bug - bug 486732