> I don't think any competent authority will tell you that simply running a program you don't trust as another user should ever be relied upon as a sandboxing m

> I don't think any competent authority will tell you that simply running a program you don't trust as another user should ever be relied upon as a sandboxing mechanism anyway. You're right that merely using "runas" does not provide any additional security (at least none that can't be circumvented). However if you run an application in a separate desktop session under a separate user account that does not have admin access at all (e.g. the account type is "standard user") then it should be sandboxed from other users (in technical terms, it's a security boundary). The most practical way to do this on a consumer desktop would be to have a separate "Steam user" account that you log in to for the sole purpose of running Steam. While most people wouldn't want to do this (as it's inconvenient), it should at least be an option for those that do want it. To put it another way, there's no good reason to undermine the enhanced security provided by separate user sessions.