I want to use KeyScrambler (http://qfxsoftware.com/) with Sandboxie. For KeyScrambler to work I understand that I need to add the following change my sandbox setting as follows:

Sandbox Settings | Resource Access | File Access | Full Access
Leave the box that says "The list above applies to" alone - so that 'All Programs' shows.

Then click EDIT, and put in the window that opens:
\Device\NamedPipe\KSTIPipe*

Then click OK a couple of times.

This adds the following line to my sandbox settings:
OpenPipePath=\Device\NamedPipe\KSTIPipe*

See http://sandboxie.com/phpbb/viewtopic.php?t=3943.

I have a number of queries as I do not really understand what this instruction is doing (I have looked at the page for Open Pipe Path (http://www.sandboxie.com/index.php?OpenPipePath), viz:

1) Given that Sandboxie allows programs to access unsandboxed information (unless access is denied) why is this instruction needed??
2) If this instruction is required, why does it need to apply to "all programs" rather than just to KeyScrambler??
3) What is this instruction actually doing?? Is it allowing access to a file or a device??
4) Why Full Access rather than Direct Access??
etc, etc

Many thanks

#1: Sandboxie disallows communication between programs that are running sandboxed and unsandoxed . That has nothing to do reading information from drives. If you want one program to be able to communicate with the other, you must specifically allow the two to exchange information.
#2: When I gave you those instructions it was because you mentioned using Opera, IE, and Firefox Portable along with KeyScrambler.
As far as I know, the Personal version of KS works only with Firefox, IE, and Flock. It does not support Opera unless you buy the Pro or Premium version of KS.
The paid versions also support many other programs besides browsers, including email programs, password managers, etc:
http://www.qfxsoftware.com/index.html
hence my advise to allow all sandboxed programs to access KS.

So if you want only the Personal version, use
OpenPipePath=firefox.exe,\Device\NamedPipe\KSTIPipe*
to use it with Firefox, or
OpenPipePath=iexplore.exe,\Device\NamedPipe\KSTIPipe*
to use it with IE.

or both.

Thanks for that information.

Which 2 programs are communicating??

KeyScrambler is a Browser Add-on (I am using Explorer).

Thus if Explorer is sandboxed then KeyScrambler (as an add-on) is also sandboxed.

Hence what program (unsandboxed) is Explorer (sandboxed) trying to communicate with??

What is KSTIPipe?? What does * in KSTIPipe* do??

Many thanks for your help.

PS: Do you require any particular settings in Zone Alarm to allow KeyScrambler to work??

I can understand your question about why an add-on to a browser would need to have a resource designated as 'allowed' in Sandboxie, if both the browser and an add-on were running in a sandbox. Unfortunately, I don't know that. Some people needed that resource setting added, and some did not, when KS was only available as an add-on. Personally, I did not need it until I moved to the KS Pro version that was installed as a normal program, and not as a part of a browser or email program.
I do know that it is the resource that dlguild and tzuk identified as needed in order for KeyScrambler to work, in versions that were all installed as add-ons.
http://sandboxie.com/phpbb/viewtopic.php?t=1851
dlguild identified the resource as 'KSTIPipeDan', and tzuk later recommended using KSTIPipe*

On dlguild's computer the full name of the resource is KSTIPipeDan, and I'm sure that tzuk shortened the name by adding a wild card asterisk, because the resource name seems to change on different computers - such as KSTIPipeRay, or KSTIPipeJohn. Sandboxie's (*) wild card character will match anything that changes after 'KSTIPipe'. Whether this particular resource is a part of KS or a part of Windows, I can't say.

I tend to get hung-up on talking about sandboxed to unsandboxed program communications while using KS, as I did here, because the Pro version that I use (and I believe the Premium version as well) are not browser add-ons but are installed normally - outside of the sandbox. These versions are used with a large number of other programs (currently:60 for Pro), not just browsers, and thus are not installed as add-ons. Sorry about the confusion that created.

Which brings us back, full circle. Try the add-on without the resource setting with Firefox and IE. You may not need it with the add-on Personal version. Sometimes tzuk adds resource access for a popular program to Sandboxie's default settings. I don't think that the KSTIPipe* resource was added as a default setting for KS in Sandboxie, because I need it in my SB configuration with version 2 of KS Pro. Since you wanted to use it with Opera, though, it looks like you need to use the Pro or Premium version of KS, from what I can see.
P.S. No, nothing special in Zone Alarm - just access to Trusted and Internet - I allowed Internet, so it can automatically check for program updates.

Just for clarification. I am wanting to use KeyScrambler Personal (ie free version) with Internet Explorer.

Does that change anything in your last post??

Many thanks.

No, with IE and the Personal version of KS just install it as an add-on and try it with IE sandboxed. If KS doesn't show as active, then add
OpenPipePath=iexplore.exe,\Device\NamedPipe\KSTIPipe*
to the sandbox settings and try it again.

OK I'll try that.

Could I also ask you how you have found KeyScrambler:
- how long have you used it??
- any problems??
- does it seem to do what it "says on the tin"??

Actually I didn't, the default exclusion is for precisely KSTIPipe with no wild card. Which is probably a mistake, I see. I'll change it to KSTIPipe*.

I was using the v 1.x add-ons for Firefox and Thunderbird for a while, and can't say that I ever noticed any problems.

There were a couple of problems when I was testing the Pro v1.9 Preview version, prior to v2's release:
- KS didn't notice the loss of focus when minimizing the program window, and continued scrambling keystrokes in any program that you used.
- Uninstalling the paid version also deleted your registration info, though it shouldn't have.
- When using Password Safe's Auto-Type feature it wouldn't send a <space> character, to check an option box when logging into a site. Frankly, I'm not sure they fixed that one since I stopped using Password Safe.

Then I bought the Pro v2 in Jan 2007 and uninstalled the add-ons.
With v2 installed as a 'normal' program, instead of an add-on, the KSTIPipe* setting in Sandboxie was needed since KS is running unsandboxed.

I don't have any way to test it in a real world situation. I have to depend on reviews.
They seem to have gotten their act together. The time it took them to fix things was a bit trying, though. They didn't have fixes ready nearly as fast as they predicted, for the Preview version: definitely not as fast as tzuk.

tzuk

Not sure which you are saying is required:

1) OpenPipePath=iexplore.exe,\Device\NamedPipe\KSTIPipe*

OR

2) OpenPipePath=iexplore.exe,\Device\NamedPipe\KSTIPipe


Do you think that this OpenPipePath instruction (whichever one it is) should be required if KeyScrambler is an add-on to Explorer (ie I am using KeyScrambler Personal - the free version)?? As presumably in this case both Explorer and KeyScrambler are sandboxed as Explorer is opened sandboxed.

Many thanks

I have been looking for KeyScrambler reviews but they are a bit thin on the ground. I would be interested in any independent KeyScrambler reviews you have come across.

Many thanks

I don't speak for tzuk, but what he said was that he had previously added "KSTIPipe" as a default exclusion in Sandboxie, but he will be changing that to "KSTIPipe*" in new versions of Sandboxie. That means that anyone who currently needs that line in order to allow KeyScrambler to work, will no longer need it when that new version of Sandboxie becomes available.

For now, I need to keep the line with "KSTIPipe*", because my sandboxed programs need it to communicate with the unsandboxed KS, but soon I will be able to delete that line from the configuration file, for each of my sandboxes.
As to whether or not you need that line with a sandboxed IE and a browser add-on KS - well, try it and find out. If KS shows that it is active without that line, then you don't need it. Even if you need it now, you will not need it when the new version of Sandboxie becomes available, because the default exclusion will allow KS to work without you making any changes to Sandboxie's configuration.

PS: have you read this:
http://www.sandboxie.com/index.php?DetectingKeyLoggers

Again thanks for your help. I will try and see what happens.

BUT I still do not understand what KSTIPipe actually is - can you help please??

Are you saying that tzuk intends to build the necessary instructions for KeyScrambler to work into the default version of Sandboxie??

Are these "default exclusions" listed somewhere??

#1: Yes; #2: No, not really. Some programs that have not had any default exclusions added to Sandboxie are listed under "Known Conflicts", but a list of those programs that are used commonly, and have default exclusions built into Sandboxie's source code, is not available. I'm thinking that we wouldn't want the bad guys to get that list.
As I said before, I don't know what KSTIPipexxxx is, but since it starts with "KS" I'm assuming it's a part of KeyScrambler. I doubt if they would tell you what it is, though.

Is a "default exclusion" an instuction that is hard coded into Sandboxie that replaces the need to include such instruction within the Ini file??