New WinRAR Version Strips Windows Metadata In Privacy Push (bleepingcomputer.com) 48
WinRAR 7.10 now lets users remove potentially sensitive metadata from downloaded files while preserving core Windows security features. The file compression tool's latest release introduces a "Zone value only" setting that strips download locations and IP addresses from Windows' Mark-of-the-Web security flags during file extraction.
The new privacy control, enabled by default, maintains only the basic security zone identifier that triggers Windows' safety prompts for downloaded files. This change prevents recipients of shared archives from accessing metadata that could reveal where files originated. The update from win.rar GmbH, whose compression software claims 500 million users worldwide, also adds performance improvements through larger memory page support and introduces a dark mode interface.
The new privacy control, enabled by default, maintains only the basic security zone identifier that triggers Windows' safety prompts for downloaded files. This change prevents recipients of shared archives from accessing metadata that could reveal where files originated. The update from win.rar GmbH, whose compression software claims 500 million users worldwide, also adds performance improvements through larger memory page support and introduces a dark mode interface.
Re: (Score:3)
That was WinZip (Score:2)
Different company, now owned by Corel, err, Alludo.
Alludo is a stupid name it sounds like they are doing something illegal. I mean, I know the original Corel guy was literally up to no good, but Alludo is worse in every way.
Huge in China (Score:3)
For some reason, RAR is the de facto standard compression format in China. Don't ask me why. Probably some coincidence.
Re: Huge in China (Score:2)
Maybe because their CPUs are slower ;)
Re: (Score:2)
Is the implementation verifiable? (Score:4, Informative)
There are lots of ways to encrypt a binary. Using open source utilities from a reputable project, or using proprietary utilities that use some third party auditing are the bare minimum we should accept.
There's 7zip of course, but the obvious one is just using the openssl utilities and your own script to wrap the set of command-line options you want. That lets you select from a wide range of algorithms and use larger keys instead of simply using a passcode. You can also automate backups with standard utilities and a keyring.
for non-cloud backups I prefer Restic, as I generally want incremental backups. It does have encryption too, but not as flexible as above. Again, it's open source and independently verified. But a popular project so it's a big target for attackers and potential state-sponsored attacks.
BE VIGILANT!
Re: (Score:2)
I also really like that one can add a "recovery record" (error detection/correction data to correct for bitrot or other errors) during archive creation and that record is integrated into the single archive file. While other options exist (e.g. using PAR2 files that are separate from the archive), I find them a bit clunky. Having everything in a single archive managed by a single program is nice.
Also, I've used WinRAR for decades and the user interface is familiar to me. That's a big factor.
First (Score:5, Interesting)
Re: (Score:1)
Re:First (Score:5, Insightful)
Nobody uses WinZip. Most people switched to 7zip.
Re: (Score:1)
Re: (Score:2)
Corporations are not people despite what the supreme court wants you to believe.
We use the software we want to.
Yeah but who *wants* to use WinZip? That would be like ... okay I remember there are people who like to dress in gimp outfits and have others kick them in the balls repeatedly so I guess someone out there wants to use WinZip.
Re: (Score:2)
Actually most people stopped caring about a zip program when Windows started natively supporting zip archives. Most *nerds* use 7zip (myself included). I've yet to see it on another machine.
Re: (Score:2)
Does it already strips Windows Metadata?
Re: (Score:2)
In before the idiotic comments of "people still use WinRAR? HAW HAW HAW!"
Yes, I still use WinRAR. It's interface is MUCH better than WinZip (whose interface borders on the insane). And Windows built-in zip support is sucks ass and is limited.
$ tar cvjf foo.tbz2 files...
Re: (Score:3)
It must be nice only having to use Linux. Some of us actually deal with more than one OS.
You can install WSL almost as easily as finding and installing those 3rd party zip tools. Then as a bonus you'll also have plenty of other tools to easily get all sorts of real work done.
Re: (Score:1)
Re: (Score:2)
You can install WSL almost as easily as finding and installing those 3rd party zip tools. Then as a bonus you'll also have plenty of other tools to easily get all sorts of real work done.
If you're installing WSL and a distro for the purposes of extracting an archive you should really consider checking yourself into a psychiatric clinic.
Re: (Score:2)
Re: First (Score:2)
Some of us know how to do that on Windows too
Re: (Score:2)
If you want to, you can use winRAR on Linux via the terminal.
I don't recommend it (use PeaZip) but you can do it.
Re: (Score:2)
Why anyone would use WinRAR when 7Zip is a thing is beyond me...
7Zip is superior to WinRAR in basically every way that matters in 2025 (including its cost since its free and open source)
how meany paying users do they have? (Score:3)
how meany paying users do they have?
Re: (Score:3)
Probably more than Slashdot, yet here we are
Re: (Score:2)
how meany paying users do they have?
(Narrator) We suddenly find our curious reader resisting the urge to break out the CD-ROM archive just to see if the ol' trusty **CRAAACK3D** version of 'RaR loads up on Win10...
Re: (Score:2)
NOVI, MI — Local man Greg Hartford just made history by becoming the first person in the world to purchase WinRAR. Previously, no one had bothered to buy a license since the software's free trial can be used perpetually, essentially making it free.
"Wait, it's free?" Hartford said when asked for a comment. "But it said I had to buy a license."
WinRAR, a file archiver and data compression utility, launched in 1995 with zero sales. It is currently sold by win.rar
"strips" what shouldn't be included anyway?! (Score:4, Interesting)
There is a lot of file-system level data that shouldn't be included in the first place, at least by default, starting with the owner of the file. Now of course everyone would like to have a way to get as much as possible: all permissions, owner, all (at least 3 in NTFS?) time stamps, alternate data streams and so on, but that's generally unwanted: you'd need to be an admin or similar to properly unpack it and set everything, and then you'll just need to find a way to fiddle with permissions/take ownership to be actually able to access the files you just unpacked! The default should just be the file name/content/directory if there is one and a time stamp. The archival/backup mode should get everything of course, but that shouldn't be the default.
Re: "strips" what shouldn't be included anyway?! (Score:2)
Both tar and info-zip on Linux store owner/permission fs metadata by default.
These are admin tools, why shouldn't they default to storing things like origin metadata? Archives of your filesystem are not normally shared with the public, or am I missing something here. Is a zip of your filesystem something you normally share with people, and the url you downloaded an internal file from is a concern? Software publishers use installers take care of setting permissions when the internal archive is extracted. MSI
Re: (Score:2)
"Mark of the web" metadata is used to indicate if a file was downloaded.
7zip inadvertently stripped the metadata which meant it disabled some additional security scanning that takes place - if you decompressed the file it didn't get applied to the inner files.
This trait was exploited by several pieces of malware to silently install themselves because Windows believed the file was obtained from a trusted source.
7zip now properly respect the flag and sets it on files unpacked from 7zip archives with the flag
Re: (Score:2)
WinRAR stripping it just means all the malware moves to RAR files now
WinRAR is not stripping it. RTFS.
Re: (Score:2)
They're leaving the MotW with only the security zone, like that it came from the internet, and removing the exact url and stuff like that. So it should trigger the same response from security tools.
I want to know the bigger story, someone got caught pirating something because the download url ID'd them right.
I can't think of a plausible legit reason this would be a problem. What else gets those motw tags, office files? Someone wrote up a business proposal in Word, posted it on an external file hosting servi
I upgraded to Linux... (Score:2)
Re: I upgraded to Linux... (Score:2, Flamebait)
Windows - Group Policy - Do not preserve zone info (Score:3)
I just had to enable this policy setting to disable the zone information alternate stream since I copied some files from my old laptop to my new work laptop and I had to use the IP address because the idiots that manage DNS disabled automatic DNS registration for VPN clients. So now I could not find my old machine by the name had to use the IP address. So every single file from my documents folder that I was migrating ended up getting marked with the zone information in the mark of the web as being downloaded from the internet.
Windows - Group Policy - User, Windows Component's, Attachment Manager
https://learn.microsoft.com/en... [microsoft.com]
Power shell - Unblock-File
https://learn.microsoft.com/en... [microsoft.com]
Get-ChildItem -Recurse -File |
Unblock-File
Re: Windows - Group Policy - Do not preserve zone (Score:4, Informative)
I almost forgot the good old SysInternals Streams command.
https://learn.microsoft.com/en... [microsoft.com]
Streams.exe -s -d *.*
Re: (Score:2)
Wait, you did a laptop migration, over the VPN? Backing up to a company file server wasn't an option?
And since the theme today is winrar, it never occurred to rar/zip your My Documents and transfer that?
Dude... you do you, but come on.
People still use (Score:2)
What happened to good old tar!
tar -zcvf
Re: (Score:2)
Buddy, I not only have licenses for win-rar, I also have licenses for pkzip and actually pay for maintenance.