Linked by Thom Holwerda on Sat 31st Jan 2009 10:45 UTC
Privacy, Security, Encryption Yesterday, we reported on the security flaw in Windows 7's UAC slider dialog, and today, Microsoft has given a response to the situation, but it doesn't seem like the company intends to fix it. "This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level." I hope this reply came from a marketing drone, because if they intend on keeping this behaviour as-is in Windows 7 RTM, they're going to face a serious shitstorm - and rightfully so. Let's hope the Sinfoskies and Larson-Greens at Microsoft rectify this situation as soon as possible.
Thread beginning with comment 346390
To view parent comment, click here.
To read all comments associated with this story, please click here.
jessta
Member since:
2005-08-17

...made such a big deal over the UAC in Vista. So what do people do now, when UAC is broken by the default settings in Win7? More complaining. It can be changed, you know.
You people made your bed, lie in it.


So you think there are only two options here? UAC prompts users a lot or UAC doesn't prompt users.
If people are complaining about both options then that should tell you that neither option is a good option.
People want security without having to think about security...that's the problem that needs solving.

Reply Parent Score: 3

obsidian Member since:
2007-05-12


(snip)
People want security without having to think about security...that's the problem that needs solving.


Easy!

Use OpenBSD.... problem solved!

No thinking needed - secure by default. ;)

Edited 2009-02-01 05:52 UTC

Reply Parent Score: 2

jessta Member since:
2005-08-17

Use OpenBSD.... problem solved!
No thinking needed - secure by default. ;)


...that's not really true. OpenBSD suffers from the same problems as most of the Unixes and other major operating systems. OpenBSD has no known remotely exploitable bugs in it's default install(which is a state of complete uselessness)...but as soon as you actually use if for something you have to start thinking about the security implications.
There are ways to do 'no thought security' it's just that it's a lot of effort to setup because you have to break backwards compatibility.

Reply Parent Score: 2