Linked by Thom Holwerda on Sat 31st Jan 2009 10:45 UTC
Privacy, Security, Encryption Yesterday, we reported on the security flaw in Windows 7's UAC slider dialog, and today, Microsoft has given a response to the situation, but it doesn't seem like the company intends to fix it. "This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level." I hope this reply came from a marketing drone, because if they intend on keeping this behaviour as-is in Windows 7 RTM, they're going to face a serious shitstorm - and rightfully so. Let's hope the Sinfoskies and Larson-Greens at Microsoft rectify this situation as soon as possible.
Permalink for comment 346370
To read all comments associated with this story, please click here.
RE: Not that serious
by darknexus on Sat 31st Jan 2009 14:49 UTC in reply to "Not that serious"
darknexus
Member since:
2008-07-15

Just one little problem with what you're saying. A script can change these settings... without a prompt. Now, how can a script be run? Well, let's see here... given how many people seem to illegally download commercial software on the Windows platform, one could simply embed this script in their installer. If the default settings aren't changed, it will run, no problem. And then everything is open.
So the defaults can be changed. How many average home users do you know who have any idea what UAC actually is, or how to change it? Even if they were told how, how many of them know or care why?
Yes, you're going to have complainers about UAC regardless of the decisions MS makes. This, however, is a legitimate complaint as it does not require physical interaction to disable UAC. This is a situation where the default security level is insufficient to prevent a script from making changes to the security policy. This is a huge no-no. The fix? Exempt UAC changes from being scripted, forcing a prompt whenever the UAC setting is changed. Leave the other prompts as they are, but always prompt when changing any UAC-related settings. This isn't too difficult, wouldn't interfere with the average home user, and those who did want to change the UAC settings would know why they were changing them anyway. Clicking one extra continue button in this one instance wouldn't hurt them.
Microsoft had better fix this, seriously. If they don't, they might as well drop security altogether, as they're leaving the front door wide open anyway.

Reply Parent Score: 5