Comodo Secure Shopping not so secure in ver 10.0.1.6209 [M2209]

I don’t think it’s software specific…i think it’s symptom specific. Have you checked this to confirm my findings?

Quite disappointed to see that in 6 months since this thread was started not even a Proof-of-Concept
fix was developed… not even a workaround.

Maybe the devs don’t consider it as a real “bug”. Or maybe it is still in development. Or maybe
more tries have been made but no fix has been found in 6 months.

Quite sad for me is that I felt more like the one re-engaging in this conversation… offering to help if
necessary or send information. But to date no solutions have been offered. Not even hopes…

I guess I will leave this as it is and move on …

Maybe one day you will find a fix for it eventually… :slight_smile:

Hi cocalaur,
We have yet to support these video software.
There is lot of work on that.

Something we are planning for next release.

Thanks
-umesh

Please then… tell me why on previous version of that same software, tested in CIS 10.0.0.6092 the screen was blank?

I mean… are you 100% sure it’s specific to the recording software’s version/vendor?

I can take the time to test several recording software with version 10.0.1.6294
and do the same with 10.0.0.6092. Just to see if this is supported or not.

Can you give me an example of a recording software which is supported (protected) in 10.0.1.6294 / latest Secure Shopping version?
I will take that into consideration too in my tests.

As per team, specific video software was not supported in the past either.

Quite possible that some version used some APIs that somehow were intercepted by generic method used currently and you observed supported behavior.

I clearly remember that I have tested even an earlier version of CIS with oCam and the Secure Shopping
of that version was keeping the window protected too. Also with other software (OBS, Camtasia, etc.)

So that’s why I was curious about… my findings reveal that several recording apps are protected (window blank)
in earlier secure shopping / cis versions. And with the version detailed in this thread, with same apps - all of them
are able to bypass the screenshot protection.

That is what triggered me to believe that it may be something related to the Secure Shopping changes in between the mentioned versions
in the original post…

so you are telling that maybe the recording apps have changed APIs after updates and they ar enot supported by COMODO Secure Shopping?
OK, I understand that… just that i don’t know why it seems to me more like a bug.

I also remember that, during my tests while recording, there were split seconds while the window was shown blank. either by moving the window
or trying to do different things.

It was not a consistent behaviour in my tests - that’s why it has let me believe it may be a bug, not related to software support.

But I will wait for future updates and try to test them as updated Secure Shopping / CIS becomes available.

Regarding the tests, I was referring to this:

Please allow us to cover this in next release of Secure Shopping, we can investigate further.

Thanks
-umesh

OK Thank you for the update.

And thanks for making me understand about the bigger picture… as I was unaware of that.

I could only compare the results i have tested, but now that you have mentioned different APIs or
capture methods that can be used I am starting to understand more.

Hopefully there wouldn’t be many future cat-and-mouse chases with the recording APIs.

We really appreciate all the time and efforts you have invested.
We just could not have enough time to make it part of upcoming release.

It’s going to be analyzed in next sprint and we will be in touch.

Thanks
-umesh

OK… One more question and then I will get to the patiently waiting queue ;D

[1]If you test let’s say the latest version of oCam as of today with a previous version of Secure Shopping
(the last one I reported that worked), do you get a black window or a window that could be seen?

[2]Also, if you test the latest CIS version’s Secure Browser and you film it with any software of your choice
(one that is 100% supported), did you get a black screen in CIS?

Because in case [1] you should see an unprotected window as the software os not supported/uses different APIs
But in case [2], with known APIs in the latest version of CSS, and supported software, if you can still see the window,
you can reasonably agree that there has been a bug somewhere and is not related to software support only.

That’s what I am unable to test because of my Windows build (currently upgrading to Fall Creators Update as we speak,
so I fear incompatibilities with CIS).

Anyway I will wait for the latest updated version and test again to see if the issue is fixed. I just wanted to lay these things here off my mind :slight_smile:
Thank you.

I will let QA respond to it.

As umesh has stated about API usage, I noticed that with oCam setting capture method to GDI API a secure browser recording is shown as a black screen while using Desktop Duplication API (Fast) I was able to see the secure browser in the recording. see attached. Note this was done using oCam v421.0 on Windows 10 RS3/Fall creators update, CIS 10.0.2.6350 beta/ CSS 1.3 115.

By default oCam uses desktop duplication API this can be changed under menu->options->performance->screen recording->capture method.

Hi.

Thank you for the update.

So do you think Secure Browser can be protected against the methods that reveal the window (Desktop Duplication API)
or the implementation prevents Secure Browser from hiding the window in this mode?

Sure they could implement protection for other API sets e.g. DirectX(inc. DirectDraw, Direct2D, Direct3D)/OpenGL/Vulkan but for now Secure Shopping only prevents screen capture by applications that use GDI/GDI+ API. But it will take time to develop such implementations so that it works properly without breaking applications the use those API’s like video games. So if OBS and other screen recording software switch from GDI to a more modern API then SS won’t be able to stop recording of the secure browser/environment.

Hi,

Thank you very much for the information. Currently secure shopping does not support screen recording protection feature.

Based on the information provided in the issue ticket, we checked the screen recording protection by using Ocam 421 and CSS 99 and 79(Both 99 and 79 are official release) on window 10 and window 7 and found the behavior on these 2 OSs are different. Screen recording on Window 10 does not work however it works on Windows 7. As far as we know there are many methologies to take screen video, and we will investigate it and implement this feature in future.

Hi. Thank you for the information.

Do you think teaming Secure Shopping with HIPS (Direct Screen access) solve all those problems
transparently or is it needed to manually input each capture method protection into CSS?

Hi Cocalaur,

It is hard to answer the following question:
Do you think teaming Secure Shopping with HIPS (Direct Screen access) solve all those problems transparently

What we will do for the next step is to investigate the screen recording methodologies and fix the issue based on the methodologies we found. Currently, it is hard to indicate how long it will take to support this feature but we will support screen recording step by step. And we will release the roadmap with the feature to product manager once we have the plan.

Yes i understand that now and there is no problem for me waiting for methods implementation now that i know the cause for this behavior.

Thank you.