Tiered object-related trust decisions
Adware and viruses are examples of objects that may be embedded in a web page or linked to a web page. When such an object is detected to be associated with a web page loading on a browser, an analysis may be performed to determine a trust level for the object. The object is suppressed based on the trust level. A prompt is displayed to advise a user that the object has been suppressed, and to provide an opportunity to interactively accept or decline activation of an action for the object.
1. A method of displaying a web page by a browser at a client device, comprising:
detecting, by the browser at the client device, an object associated with the web page, wherein the object is an activatable object having an action associated with the object;
determining that the action associated with the object was not initiated by a user of the client device;
according, by the browser at the client device, as part of displaying the web page, a trust level of a plurality of trust level security settings of the browser to the object, wherein the according comprises evaluating a content, source, or action of the object; and
suppressing the action associated with the object when the trust level accorded to the object does not reach a threshold trust level based on variable combinations of the content, source, and action of the object and displaying a modeless prompt to advise the user of the suppression of the action associated with the object, wherein the modeless prompt provides a description of the object for which the action is being suppressed;
when the trust level accorded to the object reaches a threshold trust level based on the variable combinations of the content, source, and action of the object, evaluating the content of the object to determine whether the object contains an upgrade for a program already existing on the client device;
upon determining that the content of the object contains the upgrade for the program already existing on the client device, providing an activation opportunity comprising:
displaying a prompt to advise the user that the content of the object contains the upgrade for the program already existing on the client device; and
displaying a selection opportunity for the user to accept or decline the upgrade of the program already existing on the client device; and
upon determining the user acceptance of the selection opportunity, activating the action of the object by reloading the web page.
2. A method according to claim 1 , wherein the object is one of a COM object or an ActiveX control.
3. A method according to claim 1 , wherein the object is embedded in the web page, and includes any one of downloadable code, a popup window, graphic data, a video file, an audio file, and a text file.
4. A method according to claim 1 , wherein the object is a link to an object on a remote server, wherein further the object on the remote server includes any one of downloadable code, a popup window, graphic data, a video file, an audio file, and a text file.
5. A method according to claim 1 , wherein the providing of the activation opportunity further comprises displaying details pertaining to the object.
6. A method according to claim 1 , wherein the prompt is a modeless prompt.
7. A method according to claim 1 , further comprising:
upon determining that the content of the object does not contain the upgrade for the program already existing on the client device, evaluating whether a download flag is set that corresponds to a browser setting, a program setting, or a security setting of the client device; and
upon determining that the download flag is set, providing a further activation opportunity comprising:
displaying a prompt to advise the user that the download flag is set that corresponds to the browser setting, the program setting, or the security setting of the client device; and
displaying a selection opportunity for the user to accept or decline an action of the object.
8. A method according to claim 7 , wherein the prompt is a modeless prompt.
9. A method according to claim 1 , wherein suppressing the object further comprises:
displaying a description of the content of the suppressed object; and
providing the user with a further opportunity to activate the content of the suppressed object.
10. A computer-readable storage medium having one or more instructions that, when read, cause one or more processors on a client device to execute steps comprising:
detecting, by the browser at the client device, an object associated with the web page, wherein the object is an activatable object having an action associated with the object;
determining that the action associated with the object was not initiated by a user of the client device;
according, by the browser at the client device, a trust level security setting for the object associated with the web page to be displayed by the browser at the client device, wherein the object is an activatable object, and wherein the trust level security setting for the object is determined as part of displaying the web page by evaluating criteria based on at least one of a content, a source and an action of the object;
suppressing an action associated with the object when the trust level security setting for the object does not reach a threshold trust level security setting based on variable combinations of the content, source, and action of the object;
when the trust level security setting for the object reaches a threshold trust level security setting based on variable combinations of the content, source, and action of the object, evaluating the content of the object to determine whether the object contains an upgrade for a program already existing on the client device;
upon determining that the content of the object contains the upgrade for the program already existing on the client device, providing an activation opportunity comprising:
displaying a prompt to advise the user that the content of the object contains the upgrade for the program already existing on the client device; and
displaying a selection opportunity for the user to accept or decline the upgrade of the program already existing on the client device; and
upon determining the user acceptance of the selection opportunity, activating the action of the object by reloading the web page.
11. A computer-readable storage medium according to claim 10 , wherein the object is one of a COM object or an ActiveX control.
12. A computer-readable storage medium according to claim 10 , wherein the object is embedded in the web page, and includes any one of a downloadable file, a popup window, graphic data, a video file, an audio file, and a text file.
13. A computer-readable storage medium according to claim 10 , wherein the object is a link to an object on a remote server, wherein further the object on the remote server includes any one of a downloadable file, a popup window, graphic data, a video file, an audio file, and a text file.
14. A computer-readable storage medium according to claim 10 , wherein further the one or more instructions to provide the activation opportunity further comprises displaying details pertaining to the object.
15. A computer-readable storage medium according to claim 14 , wherein the prompt is a modeless prompt.
16. A computer-readable storage medium according to claim 10 , further comprising instructions that, when read, cause one or more processors on the client device to execute a step comprising:
upon determining that the content of the object does not contain the upgrade for the program already existing on the client device, evaluating whether a download flag is set that corresponds to a browser setting, a program setting, or a security setting of the client device; and
upon determining that the download flag is set, providing a further activation opportunity comprising:
displaying a prompt to advise the user that the download flag is set that corresponds to the browser setting, the program setting, or the security setting of the client device; and
displaying a selection opportunity for the user to accept or decline an action of the object.
17. An apparatus, comprising:
an object detector to detect an object associated with a web page as a part of displaying the web page by a browser at a client device, wherein the object is an activatable object having an action associated with the object;
a trust analyzer on the browser at the client device, wherein the trust analyzer is configured to perform a trust analysis for the object, wherein the trust analyzer performs the trust analysis for the object as part of displaying the web page using a trust level accorded to the object based on an evaluation of at least one of: a source, a content, and an action of the object comprising:
suppressing the action associated with the object and displaying a modeless prompt to advise the user of the suppression of the action associated with the object, wherein the modeless prompt provides a description of the object for which the action is being suppressed; and
when the trust level accorded to the object reaches a threshold trust level based on the evaluation of at least one of the source, the content, and the action of the object, evaluating the content of the object to determine whether the object contains an upgrade for a program already existing on the client device;
a suppressor to suppress the action associated with the object when the trust level accorded to the object does not reach a threshold trust level based on variable combinations of the content, source, and action of the object;
a user interface to provide an activation opportunity, the activation opportunity comprising:
displaying a prompt to advise the user that the content of the object contains the upgrade for the program already existing on the client device; and
a user interface to provide the selection opportunity, the selection opportunity comprising:
displaying a selection opportunity for the user to accept or decline the upgrade of the program already existing on the client device; and
an activator to activate the action of the object by reloading the web page upon determining the user acceptance of the selection opportunity.
18. An apparatus according to claim 17 , wherein the object is one of a COM object or an ActiveX control.
19. An apparatus according to claim 17 , wherein the object is embedded in the web page, and includes any one of downloadable code, a popup window, graphic data, a video file, an audio file, and a text file.
20. An apparatus according to claim 17 , wherein the object is a link to an object on a remote server, wherein further the object on the remote server includes any one of downloadable code, a popup window, graphic data, a video file, an audio file, and a text file.
21. An apparatus according to claim 17 ,
wherein the browser at the client device further displays a prompt indicating that the action has been blocked based upon a positive evaluation of any of the criteria.
22. An apparatus according to claim 21 , wherein the prompt is a modal prompt that provides a user with a further activation opportunity.
23. An apparatus according to claim 21 , wherein the prompt is a modeless prompt that advises a user of the action being blocked and provides a description of the object.
24. An apparatus according to claim 21 , wherein the prompt is a modeless prompt that advises a user of the action being blocked and provides the user with a further activation opportunity.
25. An apparatus according to claim 17 , wherein the prompt is a modeless prompt.