What Is an Unknown Publisher Warning & Why Should You Care?

Home » What Is an Unknown Publisher Warning & Why Should You Care?
1 Star2 Stars3 Stars4 Stars5 Stars (3 votes, average: 5.00 out of 5)

Many malicious programs come from unknown or unverified publishers. But why is software from an unknown publisher dangerous? And why should you only download software from trusted publishers?

When you buy or download software, you likely assume that it’s safe. But when an unknown publisher warning pops up on your screen, you quickly realize that’s not always the case. This is why it’s important to only install software that comes from a verified publisher — never one that’s unverified or unknown.

But what is an unknown publisher? And why is knowing who the software publisher is important?

An Unknown Publisher Warning Is Your Computer’s Way of Yelling “Stranger Danger!”

An unknown publisher is a software creator whose identity isn’t verified by your Windows operating system or web browser (e.g., Microsoft Edge). They differ from a verified publisher — someone who takes extra steps to ensure their software and apps are trusted by your device and browser.

Say, a friend sends you a link to their favorite “shareware” website so you can download a cool new free game onto your computer. When you attempt to download the file from an unknown publisher, you might see a warning like this in your browser:

freevideo exe harmful

When you attempt to install the application, you’ll see a strange message pop up from your Windows operating system:

unknown publisher message
This is an example of a Windows User Account Control (UAC) alert that triggers when an application requests access privileges to your device.

This alert is your computer’s way of warning you that the software may not be safe to install and that you must proceed with caution. Another unknown publisher warning message that you might see comes from Microsoft Defender (Windows’ built-in security feature), which looks like this:

windows protected your pc freevideo exe
A screenshot of a Windows Defender SmartScreen unknown publisher warning message.

Does that mean you should just ignore these messages and install the software anyway? No way! It’s important that you only download and install software that comes from a verified publisher.

But why is installing software from an unknown publisher such a bad idea? Because it puts you at risk of cyber attack and data theft.

verified publisher

Software from Unknown Publishers Puts Your Device’s Health & Security at Risk

If you’re walking along the street and see a piece of candy on the ground, would you pick it up and eat it? Hopefully not! After all, it’s dirty or germy and might make you sick. Instead, it’s best to only eat candy that one of your parents (or someone else you trust) gives to you, or that you buy from the store yourself.

This same concept also applies to computer and internet security, which is why you should only download software from a known, verified publisher. Ignoring a security warning and installing software from an unverified publisher is dangerous (more on that momentarily).

So, what does it look like when you try to install an app from a known (verified) publisher? See the difference by comparing the example we shared earlier to one from a digitally signed software executable that we’ve put side-by-side below:

Side by side comparision of unsigned and signed software executables

The first message (left) warns you that the software is requesting access to your device and may be dangerous. The second message (right) still checks whether you want to give the application access to your device, but it also informs you that the company that published the software is legitimate.

Never Just Ignore an Unknown Publisher Warning

The difference between the two is like inviting a stranger into your house versus a friend — one is someone you know and trust while the other is a potential threat. Trust and identity are integral to your personal and digital security.

Giving any untrusted applications access leaves your device open to attack by cybercriminals. They can use malicious software to do any or all of the following:

  • Steal your username and passwords
  • Install malware onto your device (and use that as a foot in the door to gain access to your larger network)
  • Control your device as part of a botnet (a network of infected devices)
  • Steal personal data they can use to carry out other types of cyber crimes

This is why you must make an informed decision when deciding whether to install software from an unknown or unverified publisher:

  • Double-check to ensure you’re downloading software from a legitimate source.
  • Do in-depth research on the software and its publisher to verify it’s legitimate and safe.
  • Get your parents’ permission to install the application if you’re under 18.

All of this may leave you wondering why some programs are labeled as coming from an “unknown publisher” while others say they’re from a “verified publisher.” The difference is that the software creator undergoes an important background check that verifies their identity.  

Verified vs Unknown Publishers: Identity Matters

On the internet, your digital identity is important. It’s like the digital equivalent of your school ID card or a driver’s license — it’s a trusted, verifiable way to prove to others that you’re you and not an imposter.

The process of becoming a verified publisher is kind of like the steps teachers go through to work at a school. Each teacher has to undergo an important background check by a trusted third party (in this case, the school district). This process allows the state to verify that the teacher is who they say they are and that they’re trustworthy enough to teach students.

In much the same way, if a software developer or publisher wants to be trusted by Windows operating systems or the Edge browser, they also have to undergo a background check. But instead of your school district checking out different personal and employment records, another trusted third party (a certificate authority, or CA) checks to make sure the software creator or their company is legitimate.

When the process is complete, and the CA is satisfied that the software creator or company is legitimate, they issue a code signing certificate.

Student Learning Online

A Code Signing Certificate Is Like an Official Stamp That Says Software Is Trustworthy

A code signing certificate is a digital file that helps software developers gain the trust of browsers, operating systems, and users (like you) by digitally signing their software or firmware. The way it works is that the software creator installs the certificate onto their computer. Whenever they create new software that they want to publish, they create it on that device and then use that certificate to apply something called a digital signature.

We won’t get into all the technical mumbo-jumbo on how digital signatures work, but the takeaway here is that the digital signature makes it so that you know:

  • The verified identity of the publisher, and
  • Whether the software has been altered or modified since the software created signed it.

This digital signature is a way for your device’s OS to recognize when something’s been modified. If a bad guy tries to change the code of a digitally signed app, your operating system will recognize that something is wrong and prevent the app from running or display a warning.

Not All Code Signing Certificates Are the Same…

Code signing certificates come with two main levels of verification:

  • Standard validation — This process results in the issuance of a standard code signing certificate (also known as an organization validation or OV code signing certificate). This verification process involves checking some basic company information (name, location, phone number, etc.).
  • Extended validation — This more involved identity verification process, which requires a CA to dive into more specific company information, results in the issuance of an EV code signing certificate.

Signing software using either type of code signing certificate requires the private key to be stored on secure hardware. Each code signing certificate’s private key will be generated on a secure hardware token (provided by the issuing CA). 

This brings us to our next point: How do you know whether an application is signed by one of these publicly trusted certificates or that the signer is trustworthy? You can check it yourself!

How to Check a Program’s Verified Publisher Details

When you download an application, be sure to check the .exe file’s digital signature and timestamping details before starting the installation process. You can do this through the following steps:

  1. Right-click on the file and select the Properties This will open a window that looks like this:
exe property option
  1. Next, select the Digital Signatures tab at the top. This new window displays the name of the signer, their email address, and the precise date and time when the software was signed (via timestamping). To move on to the next step, press the Details button:
exe digital signature
  1. In the Digital Signature Details window, select the View Certificate button to open a new window. (This next screen will display more in-depth information about the certificate):
Subject Option in Exe
  1. Select the Details tab in the top menu and then click the Subject listing in the main window. Here, you’ll see that the certificate was issued to Skype Software Sarl, which is part of Microsoft Corporation, which is based in Redmond, Washington (United States).
Exe Digital Signature Details
  1. You can verify the company information listed in this certificate against the official Microsoft website to verify its legitimacy.

Final Thoughts on Unknown Publisher Warnings

Not all unsigned software is necessarily bad or malicious. However, intentionally bypassing the Windows unknown publisher warning to install software from an unverified publisher can be dangerous and may put your device and data at risk.

It’s our hope that you leave this article with the two following important takeaways:

  • Users: Only install software applications from trusted, verified publishers.
  • Software developers/publishers: Only release and distribute software that you’ve signed using a publicly trusted code signing certificate.