fingerprintjs / external-protocol-flooding

Scheme flooding vulnerability: how it works and why it is a threat to anonymous browsing
https://schemeflood.com
MIT License
644 stars 47 forks source link

Some applications don't deregister protocol handlers when uninstalled #8

Open bershanskiy opened 3 years ago

bershanskiy commented 3 years ago

Summary

Some applications, e.g. Steam, leave behind their Windows registry records when uninstalled. Therefore user can install an application, then delete it and still have protocol registration which is picked up by the demo. Since the demo produces results which appear as false positives (reporting that an application is installed when it ctually is not), users might dismiss the demo thinking it is inaccurate. It would be nice if you could add a note or a mark (e.g., asterisk) to programs prone to false positives.

Repro steps

  1. Install Steam so that it registers protocol handler in HKEY_CLASSES_ROOT\steam.
  2. Uninstall Steam and note that the registry record is still present.
  3. Run demo and see Steam among "installed" applications.
spalt08 commented 3 years ago

You should probably file it as a Windows bug. The demo is designed to detect if the custom protocol is supported by the system. Fancy UI is made to make the demo less boring.

ericlaw1979 commented 3 years ago

So, the demo isn't "designed to detect if the custom protocol is supported by the system" but rather "designed to detect whether the browser /thinks/ the protocol is supported by something on the system."

spalt08 commented 3 years ago

@ericlaw1979 Good points. I've jumped to conclusions, sorry.