Kiosk Applications (part one)

Someone recently asked (in the forums) about how to make kiosk applications in REALbasic. That piqued my interest a bit, so I did some research, and here's my tale.

The quick and dirty way that most people are used to is by setting Window.Fullscreen = true and Window.MenuBarVisible = false. So I'd like to start with that as a jumping-off point for the discussion. When you set FullScreen to true, what you end up with is an application which takes up the entire screen. You cannot see it's title bar, which means you can't see any close buttons for it. This also means that you can't resize the window to make it smaller, etc. The horribly named MenuBarVisible property takes care of the rest. It hides the menu bar (as the name implies) so that the user can't select File->Exit. It also hides all system UI, which is something users tend to forget about (for good reason, since it's not apparent by the name). System UI includes things like the start bar (and I think global floating windows, perhaps -- but I really can't recall). So by combining these two operations, what you eventually end up with is an application which takes up the entire screen and supposedly cannot be terminated -- a kiosk application.

I used the term supposedly because that's not true, you don't have a kiosk application. What you have is a fullscreen window with no menu bar and system UI. There's a big difference. You see, the point to a kiosk application is that the user should have no way of getting to the file system, or be able to end task your application, etc. You use kiosk applications when you want to write secure applications that you can stick out in public somewhere and not have to worry about anyone mucking things up. However, there are ways to muck things up with the above scenario.

Any Win32 app running on a recent version of Windows can get to the task manager by hitting Ctrl+Alt+Del and finding the application in the list. Once they've found the application, then can always end task it, thereby quitting back to the desktop. Granted, you could have your application running as Admin and the user running as Guest, so that they do not have sufficient privileges to terminate the application. But if your application is installed or launched incorrectly, or the user is an admin (for some reason), then it's an issue.

Any Win32 application can hit Alt+Tab to switch between other applications. This causes your "kiosk" application to go to the background and some other window to come to the foreground, and it doesn't require privileges to do so. All that's needed are multiple open windows. Oops! So you could get around this by ensuring that there's only one window open -- your application's. Then, when the user hits Alt+Tab, they only see your application in the task list.

Just because the start bar isn't visible doesn't mean it can't be accessed. Try it -- set MenuBarVisible = false, run the application and then hit the Windows key. That'll pop open the start menu. Or, if you prefer to just skip the start menu and get straight into the file system, hit Windows+R, type cmd and hit enter. Ta da! Here again, there are no privileges involved (until the user gets to the file system, where the user privileges matter). So your user can still get access to the file system.

As you can see, this combination of flags is rather useless if you're truly trying to make a professional kiosk application. However, you need not fear, for there is a true solution within your reach. Windows (starting with NT 3.51) has two security concepts for us to work with: window stations and desktops.

A window station contains a clipboard, atom table, and one or more desktops. However, there is only one window station which can have user interaction (called Winsta0), so we don't really need to concern ourselves with the concept too much. Window stations are more useful if you're running a terminal services machine. In that case, each time a user logs on, they're given a session with its own window station (so that users cannot ever "see" one another).

What you're more interested in is a desktop object. Desktops are logical display surfaces -- they contain things like windows and other UI widgets. You may not know it, but you use different desktops all the time! When you login to the computer, the login screen is on the Winlogon desktop. When you hit Ctrl+Alt+Del, the OS switches you onto the Winlogon desktop as well. When the screensaver becomes active, you're switched into the screensaver's desktop. And of course, there's the default desktop which you interact with every day.

So the trick to making a kiosk application is to make a new desktop object. By doing this, you can limit the user's access to things however you see fit (and by default, it's as secure as you can get). Next time, we'll take a look at the basic process behind running your application in its own desktop.