Editorial: Windows 7's UAC Is Broken and Insecure
Linked by Thom Holwerda on Thu 5th Mar 2009 13:27 UTC
Windows For Windows 7, Microsoft has made some changes to User Account Control to counter the criticism that UAC was too intrusive. It didn't take long before several holes were poked in Windows 7's default UAC settings, and now one is left to wonder: is it wise to sacrifice security for (perceived?) usability? Ars has an editorial that deals with this question.
E-mail Print r 8   · Read More · 93 Comment(s) http://osne.ws/g9p
Thread beginning with comment 351846
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE: Security OR usability?
by google_ninja on Thu 5th Mar 2009 17:08 UTC in reply to "Security OR usability?"
google_ninja
Member since:
2006-02-05

I mean, the UNIX-style rights management has had no major changes since UNIX was born. And it is both secure AND usable.


The idea of root is inherently insecure, because if that is compromised, everything is compromised. Because of that, your system is as secure as the least secure process running as root on a UNIX machine. The upside is that this allows for something that is extremely simple to wrap your head around.

ACLs allow a far more fine grained approach to security, both in regards to root/no root and in regards to cascading permissions. The other edge of this is that it drives the complexity way up from the traditional UNIX DAC approach. On windows, the tooling has gotten a hell of alot better with Vista and 2k8, but even though I know what I am doing and there is a GUI to show me effective permissions, I still sometimes sit there scratching my head wondering where something came from.

All that to say that I actually agree with you that a UNIX approach would be more appropriate for home users, because they dont stand a chance in hell of figuring out ACLs, but that UNIX style ugo is not the end all of security paradigms.

Reply Parent Score: 3

RE[2]: Security OR usability?
by mkone on Thu 5th Mar 2009 21:27 in reply to "RE: Security OR usability?"
mkone Member since:
2006-03-14

"I mean, the UNIX-style rights management has had no major changes since UNIX was born. And it is both secure AND usable.


The idea of root is inherently insecure, because if that is compromised, everything is compromised. Because of that, your system is as secure as the least secure process running as root on a UNIX machine. The upside is that this allows for something that is extremely simple to wrap your head around.

ACLs allow a far more fine grained approach to security... "

On any computer system, there is going to be at least one user who is all powerful. That is unavoidable. The only thing ACLs give you is the ability to give different permissions to different users. The granularity is good. But you can't knock UNIX for having root. And besides, you do get ACLs with UNIX nowadays anyway, at least you do in Linux. If you need to.

Reply Parent Score: 2

google_ninja Member since:
2006-02-05

Nothing should ever run as that user though. With ACLs it is alot easier to do that then with a DAC system

Reply Parent Score: 2

Bill Shooter of Bul Member since:
2006-07-14

No, you can use SELinux to explicitly define what root can do.

Reply Parent Score: 1

RE[2]: Security OR usability?
by rajj on Thu 5th Mar 2009 21:29 in reply to "RE: Security OR usability?"
rajj Member since:
2005-07-06

You can't just talk about UNIX security as a generality. Most of modern UNIX operating systems have ways to deal with containing the all mighty root. The BSDs have TrustedBSD (MAC), Secure Levels and Jails. Linux has SELinux (MAC), UML, and chroot(). Solaris has Zones and MAC. All of these also support POSIX ACLs. In the case of Solaris, it also support NFSv4 style ACLs which are very similar to NT ACLs. FreeBSD should also get this in the near future.

Even though NT doesn't have the concept of a super-user, for all practical intents, if an admin account is compromised, you're still hosed because the ACLs pretty much give admins carte blanche access anyway.

NT style ACLs are also really easy to get wrong (most permissive access rather than least permissive access), and its non-trivial to verify that any particular entity has the access that you think they do.

Reply Parent Score: 3

google_ninja Member since:
2006-02-05

You can't just talk about UNIX security as a generality. Most of modern UNIX operating systems have ways to deal with containing the all mighty root. The BSDs have TrustedBSD (MAC), Secure Levels and Jails. Linux has SELinux (MAC), UML, and chroot(). Solaris has Zones and MAC. All of these also support POSIX ACLs. In the case of Solaris, it also support NFSv4 style ACLs which are very similar to NT ACLs. FreeBSD should also get this in the near future.


The original poster wasn't talking about that though, he was talking about the whole user/group/other thing compared to the NT ACLs.

Even though NT doesn't have the concept of a super-user, for all practical intents, if an admin account is compromised, you're still hosed because the ACLs pretty much give admins carte blanche access anyway.


Granted, which is why absolutely nothing should ever be run as an admin user on an NT system. You have very fine grained controls, so you should make least priviledged users to run your services under.

NT style ACLs are also really easy to get wrong (most permissive access rather than least permissive access), and its non-trivial to verify that any particular entity has the access that you think they do.


I actually mentioned that in my origional post. The verification got alot better with vista, because you now have an "Effective Permissions" tab that tells you what it ends up evaluating to for a given user. What is still missing though is why it evaluated to that, which can be a real pain to track down, even with the effective permissions tab.

Reply Parent Score: 2