
Yesterday, we reported on the security flaw in Windows 7's UAC slider dialog, and today,
Microsoft has given a response to the situation, but it doesn't seem like the company intends to fix it.
"This is not a vulnerability. The intent of the default configuration of UAC is that users don't get prompted when making changes to Windows settings. This includes changing the UAC prompting level." I hope this reply came from a marketing drone, because if they intend on keeping this behaviour as-is in Windows 7 RTM, they're going to face a serious shitstorm - and rightfully so. Let's hope the Sinfoskies and Larson-Greens at Microsoft rectify this situation as soon as possible.
Member since:
2006-05-02
I really have to challenge this statement. I think that this thing that you call 'no thought security' (a nice term, by the way!) is not achievable at all, if you want to keep the computer system useful. It's not just 'a lot of effort', as you call it, it's rather that before we get to the point that "no thought security' becomes reality, a lot of research would have to teach us much more about user psychology, work flow, expectations in human-computer-interactions, etc. than we know today.
Otherwise, one would have to artificially restrict what the user is able to do just to protect them. If that's what you label 'no thought security', then we certainly do agree!
Anyway, if you could provide any more insight about 'no thought security' or some external sources, it would be appreciated!