|
Let's assume that one of these is a common video player and the other is an undetected piece of malware.
When the programs are downloaded using Internet Explorer 10, you will see there's a clear warning for the higher risk program and no warning at all for the program with established reputation.On today's internet it can be difficult to tell when a download is reputable. Since IE8 launched SmartScreen has delivered over 1.5 billion malware blocks to Internet Explorer users. To help better protect consumers from malware downloads, Internet Explorer checks the reputation of downloaded programs and warns users only if the downloaded program does not have established reputation. Application Reputation was first introduced in IE9 and has produced fantastic results.
When Windows SmartScreen (described below) is enabled in Windows 8, IE10 integrates seamlessly with the Windows SmartScreen experience.
Windows SmartScreen
We understand that Internet Explorer isn’t the only way users download programs from the internet, so we have been working to provide this Application Reputation capability to all Windows 8 users. When this opt-in feature is enabled, an Application Reputation check is made on the first launch for programs that are downloaded from the internet. Windows SmartScreen will notify users if they are about to run a program that has not yet established reputation and therefore is a higher risk program. This message disrupts the social engineering aspect of an attack and allows the user to make a more informed trust decision. For programs or publishers with an established reputation, the experience is simple and clean: click and run.
Best practices for application developers
As an application developer, there are industry best practices that will affect your download's reputation. To help establish your application's reputation, consider doing the following:
Digitally sign your programs with an Authenticode signature
Reputation is generated and assigned to digital certificates as well as specific files. Digital certificates allow data to be aggregated and assigned to a single certificate rather than many individual programs.
Ensure downloads are not detected as malware
Downloaded programs that are detected and confirmed as malware will affect both the download’s reputation and the reputation of the digital certificate.
Apply for Windows Logo approval
To learn more about the Windows Logo program visit the Windows 7 Logo Program page on MSDN.