Kai

Something quite close to your idea is practised, though, and it is worth knowing about because the framing is different.

The real technique is disposability, not detection avoidance. Run a browsing or document-opening environment that is rebuilt from a clean image every session, so anything that gets in has a lifetime measured in hours and no access to anything persistent.

That is how public access terminals are usually run — boot from a network image, keep no writable local disk, discard everything at reboot. Some security-focused desktop systems apply the same principle per application, giving each one its own compartment.

Note the difference from your proposal: it does not rely on malware choosing not to run. It assumes malware does run, and makes that fact stop mattering. Defences built on the second assumption survive contact with an adaptive adversary; ones built on the first do not.

One tell that a machine is properly managed: reboot it and see what happens.

If it comes back to a pristine desktop with no trace of the previous session, browser history cleared, no leftover files, that is the reset model working and it is a good sign. If your files are still there, it is a general purpose computer that has been left in a public place, and the difference matters enormously.

Most places will not mind you rebooting a public machine, and it takes a minute.

Both, in different proportions depending on who runs the machine — and I say that as someone who managed a fleet of them.

The well-managed ones work because they are not persistent. The core technique is that nothing a user does survives:

• The machine boots from a known-good image, often over the network with no writable local disk at all.
• Changes are written to a temporary layer in memory or to a disk area that is discarded.
• A reboot — nightly, or between sessions — returns it exactly to the image.

Once that is in place, malware is not prevented, it is simply temporary. Something installs itself, works for an hour, and then ceases to exist. There is nothing to clean, no scanning to do, and the machine cannot degrade over time because it does not accumulate anything.

That is a fundamentally different security model from a personal computer, and it is much stronger for this use case.

If you want to raise it constructively rather than argue, the question that gets a real answer is: "is there a managed configuration of this browser that would meet the requirement?"

That asks about the underlying constraint rather than the decision, gives the team room to say what the actual blocker is, and occasionally results in a supported configuration being offered. Asking why the browser is considered insecure gets you the announcement read back at you.