Click here to Skip to main content
15,881,559 members
Please Sign up or sign in to vote.
2.94/5 (3 votes)
When users start my application for the first time they get a warning like this[^].


Will signing the application prevent this?
Posted
Updated 1-Mar-13 7:45am
v3

After some research using Google search using search key "windows smartscreen prevented an unrecognized app from starting", it looks like signing with a code signing certificate doesn't get rid of it immediately. Based on some of the information in the Google search results, it looks like a Microsoft database is checked (via an Internet connection) and updated with each install of your program. The reputation score for your signing certificate increases over time and eventually the SmartScreen warning goes away. Below are a few of the search results that explain this. The last one shows how to disable the SmartScreen feature although that is not recommended.

MSDN Blog
Windows SmartScreen prevented an unrecognized app from running. Running this app might put your PC at risk[^]

Stackoverflow.com
How to pass the smart screen on Win8 when install a signed application?[^]

How to disable
How to Disable SmartScreen Filter in Windows 8?[^]
 
Share this answer
 
v2
Signing of the application (I hope you mean signing the application to make it strong named) never modifies its behavior, at least if the application is not modified. This answers your question: it won't help you.

However, I recommend to sign all your assemblies if you ever deploy them.

The purpose of signing is absolutely different. To some extent, it protects application from modification. If some virus tries to modify the original file, the application won't be executed by the system. However, one can reverse-engineer, recompile and sign the application again, replacing the original one. The signing cannot protect from this, but it's possible to detect the trick if you store the strong name of its public key hash value separately and can compare. This signing uses public-key cryptography:
http://en.wikipedia.org/wiki/Public-key_cryptography[^].

Also, strong name is used for assemblies of the Global Assembly Cache. The strong name can be considered as world-unique assembly identity. Please see:

http://en.wikipedia.org/wiki/Strong_name[^],
http://en.wikipedia.org/wiki/Global_Assembly_Cache[^],
http://msdn.microsoft.com/en-us/library/wd40t7ad.aspx[^],
http://msdn.microsoft.com/en-us/library/yf1d93sz.aspx[^].

—SA
 
Share this answer
 
Comments
Yvan Rodrigues 1-Mar-13 14:20pm    
It doesn't modify the application's behaviour, but it the past it has modified how Windows warned users about your application. Specifically, in Windows 7 the UAC warning is not shown if your application is signed. I was hoping this was the Win8 equivalent, but apparently not.
Sergey Alexandrovich Kryukov 1-Mar-13 14:24pm    
I don't understand your question. When in the past? What scenario do your consider. Anyway, I'm telling a simple thing: develop and application, compile. Sign it, compile again. They will do the same, exactly.

However, I must admit it's not 100% accurate statement. For example, application can output its own string name, then the behavior is "different". :-)
—SA
Sergey Alexandrovich Kryukov 1-Mar-13 14:25pm    
No matter how the page "Windows 7 the UAC warning is not shown if your application is signed" is named, do you think this is the true statement? No. Who told you so? It would defeat the purpose of UAC. Try it, to see what happens...
—SA
Sergey Alexandrovich Kryukov 1-Mar-13 15:04pm    
[OP commented:]

Agreed, allowing certain applications to bypass UAC would be a bad idea and can't be done through white hat methods. The difference is that the UAC message in Win7 shows a yellow "warning" dialog if the application is signed and a friendlier blue one if it is signed.

I was wrong, it is drivers that will not require user intervention if they are signed, not applications.

My application doesn't need write access to any system directories, so UAC isn't an issue, but it looks like SmartScreen will be.
From the IE Blog archive[^]

Desktop Apps

Desktop applications remain an important part of the Windows experience and Microsoft remains committed to the safety of the desktop experience and our users. We recognize that Internet Explorer (IE) isn’t the only way users download applications from the Internet, so Windows 8 now uses SmartScreen to perform an application reputation check the first time users launch applications that were downloaded from the Internet.

This evolution of SmartScreen from IE-only to system wide is a significant improvement for Windows users. We have seen incredible results with this feature in IE9 (more here & here). Hundreds of millions of users have avoided malware infections due to these new experiences and we’re happy to bring this protection to Windows users, regardless of browser choice. For more details on the IE9 application reputation feature and the data models read this post. For more information on security & safety features in Windows 8 (including Windows SmartScreen) read this post.

The deeper integration of SmartScreen Application Reputation also means that desktop app developers have an additional motivation to sign their code and establish reputation. We’ve talked in the past about the importance of digitally signing code for both establishing reputation and proving the authenticity of programs. I’m happy to say the development community has responded to this call to action. Since the release of SmartScreen Application Reputation in IE9 we’ve seen a 10% global increase in signed downloads, from 73% at IE9 RTM to >83% today.

As we’ve discussed in the past, SmartScreen builds reputation for both individual programs and for the certificate used to sign that code. Code signing is important to our reputation intelligence because this higher level identity allows us to build reputation across multiple programs signed by a publisher. It is also important for publishers because signed programs inherit the reputation of the certificate with which they are signed; this means every program a publisher distributes doesn’t need to build reputation individually.

EV Code Signing

Today we are announcing our support for an important advance in code signing - the availability of EV code signing Certificates. We’re also announcing that EV code signing certificates will integrate with the SmartScreen Application Reputation technology in Internet Explorer 9, Internet Explorer 10 and in Windows 8.

Microsoft has been working with the CA industry over the past year to help make EV code signing certificates available. This code signing standard has a couple of key advancements from a safety and identity perspective. First, they require a more rigorous vetting and authentication process similar to that of EV SSL certificates that are in use today. This process requires a comprehensive identity verification and authentication process for each developer. Secondly, the EV code signing certificates require the use of hardware to sign applications. This hardware requirement is an additional protection against theft or unintended use of a code signing certificate.

Programs signed by an EV code signing certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher. Other factors are considered when generating reputation and determining product experiences and EV-signed programs will be closely monitored over time. We think the improvements in the vetting and security of these certificates are a great development for both users and developers.

Starting today, EV code signing certificates are now being issued by Symantec and DigiCert, and the integration with SmartScreen is already live (IE9, IE10 & Win8).

Detractors may claim that SmartScreen is “forcing” developers to spend money on certificates. It should be stressed that EV code signing certificates are not required to build or maintain reputation with SmartScreen. Files signed with standard code signing certificates and even unsigned files continue to build reputation as they have since Application Reputation was introduced in IE9 last year. However, the presence of an EV code signing certificate is a strong indicator that the file was signed by an entity that has passed a rigorous validation process and was signed with hardware which allows our systems to establish reputation for that entity more quickly than unsigned or non-EV code signed programs.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900