Security issues: Sandbox

[galschia]

Hi, I'm a newbie. I have a question that would cover both support and the rules. Is it possible to run FG sandboxed? I'm concerned about security issues. Has anyone tried it? Search results don't seem to answer this issue. And I've seen that programs such as Sandboxie don't necessarily work with all Steam games. P.S. I'm not a GM, just a player. Thanks.

[Zacchaeus]

Hi galschia welcome to Fantasy Grounds.

Fantasy Grounds isn't a Steam Game (in fact it isn't a game at all), it is downloaded from Smiteworks no matter where you buy it.

For FG to run there needs to be one player who hosts a game (the Gamemaster) and several players connected to them. The closest thing to a sandbox game would be something like a West Marches style game where several GMs run games in the same location with each game possibly changing the shape of the landscape or the quests/tasks available. Other than that I'm not sure what kind of game that you are imagining.

[galschia]

Sorry, English isn't my first language so maybe I haven't been clear. I don't want to play a "sandbox style" game. I know FG runs a VTT for DnD and similar games. I want to run FG on a Sandbox, like Sandboxie, or Avast Sandbox. I've seen maybe one person here who mentioned it on a thread, mentioned having the program. But I don't know if this program can run on Sandboxie as of 2019, since some forum threads on SandboxIE claim that not all Steam games work. I know one of the alternatives is to have the Web Installer so I wouldn't necessarily require Steam.

[pindercarl]

Zacchaeus — galschia is asking about running the application in a "sandbox," i.e. isolated from the OS.

galschia — Fantasy Grounds runs in client-server architecture and communicates only over port 1802. I've never heard of any malicious attacks being perpetrated through FG. Even if it were possible, you are only connected to trusted computers. Which is to say, you choose who you are connected to by joining a game.

[galschia]

Thanks, pindercarl.

[Galbadine]

If I understand you correctly, you are concerned that FG may have access to things on your computer it shouldn't, and or is potentially malware? And you are looking to run the application in a secure environment on your computer?

Theoretically, this would work. You need something to create the sandbox, as although it is in the pipeline for windows I don't believe its available just yet (tho I may be wrong, I haven't checked recently). And a way of securing your connection to the GM.

As thousands of people have used FG without any issues, I would suggest you are being paranoid. The advantage of that paranoia is that you probably already have the tools and determination to put them to use and test that they theoretically will work for FG?

What "security issues" in particular did you have in mind?

[Zacchaeus]

I see. Another thing i’d never heard of

[galschia]

Galbadine: Yes, especially malware since it requires me to write on the admin directory only, no matter if I change the data and apps folder into a non-admin account, it will ask to do this with the updater, and so the installation will be broken. I'm not accusing potential users or anything, since I know the people I'll play with won't purposefully send me anything, but with exploits and such one never knows. It just seems strange to me that p2p technology is still being used knowing its risks.

[Galbadine]

FG is basically 2004 technology. FG: Unity is coming "Soon™" and will hopefully address a whole host of issues and shortcomings.

I understand the source of your concern. But personally, I consider it one of many minor security risks that come with online interaction. On a soley personal computer I consider the risk potentially extremely inconvenient, but unlikely.

[LordEntrails]

I don't think FGU is going to change the p2p architecture. Unless FGU were to use a SaaS architecture, which it has been stated it won't, it will need to continue to use p2p architecture. There are distinct advantages, and disadvantages to both architectures. One of the strong appeals to me for FG is the p2p architecture.

I've run FG in a virtual environment, so I don't see why you couldn't run it in a sandbox. Of course, you can't totally isolate your sandbox as you will need to allow TCP traffic both direction to port 1802 to your sandbox.