Linked by Thom Holwerda on Sat 31st Jan 2009 10:45 UTC
Privacy, Security, Encryption Yesterday, we reported on the security flaw in Windows 7's UAC slider dialog, and today, Microsoft has given a response to the situation, but it doesn't seem like the company intends to fix it. "This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level." I hope this reply came from a marketing drone, because if they intend on keeping this behaviour as-is in Windows 7 RTM, they're going to face a serious shitstorm - and rightfully so. Let's hope the Sinfoskies and Larson-Greens at Microsoft rectify this situation as soon as possible.
Permalink for comment 346365
To read all comments associated with this story, please click here.
UAC bad or worse
by Gone fishing on Sat 31st Jan 2009 14:19 UTC
Gone fishing
Member since:
2006-02-22

I don't think I can start my work PC (Vista) without swearing, I can think of dozens of things that really tick me off - UAC isn't really one of them although one wonders if some of the warnings are really necessary. If I'm fundamentally changing or potentially fundamentally changing the the software environment / OS I should be warned and permission asked (and I'd say add a password too).

The default described looks poor and if it can be exploited in the way described that looks like a train wreck. Certainly it will be exploited, if it can be and we will have another Trojan / spambot virus infested MS operating system.

Surely they will fix this - I would add if UAC is annoying they could look at removing unnecessary warnings and possibly allow users to suspend UAC for a temporary session (after adding appropriate warnings etc) so that users can configure their systems without being nagged perhaps a button on control panel suspend UAC warnings until control panel is closed?

Reply Score: 0