fingerprintjs/external-protocol-flooding

Some applications don't deregister protocol handlers when uninstalled

bershanskiy opened this issue · 3 comments

Summary

Some applications, e.g. Steam, leave behind their Windows registry records when uninstalled. Therefore user can install an application, then delete it and still have protocol registration which is picked up by the demo. Since the demo produces results which appear as false positives (reporting that an application is installed when it ctually is not), users might dismiss the demo thinking it is inaccurate. It would be nice if you could add a note or a mark (e.g., asterisk) to programs prone to false positives.

Repro steps

  1. Install Steam so that it registers protocol handler in HKEY_CLASSES_ROOT\steam.
  2. Uninstall Steam and note that the registry record is still present.
  3. Run demo and see Steam among "installed" applications.

You should probably file it as a Windows bug.
The demo is designed to detect if the custom protocol is supported by the system. Fancy UI is made to make the demo less boring.

  • It's not a Windows "bug" that an application can leave registry entries behind on uninstall, that's just how it works.
  • /Arguably/ a browser could do work to verify that a protocol registration is still valid (by e.g. checking for the target executable before prompting) but this would be error prone for a variety of reasons, so I don't think you're likely to land such a change in browser.

So, the demo isn't "designed to detect if the custom protocol is supported by the system" but rather "designed to detect whether the browser /thinks/ the protocol is supported by something on the system."

@ericlaw1979
Good points. I've jumped to conclusions, sorry.