What UAC Controversy?

"There will be people who say, UAC isn't a security feature because it can be bypassed so easily"

------------------

Read the following postings, from the linked post to the bottom of the page:

http://channel9.msdn.com/forums/Coffeehouse/473037-UAC-controversy-the-last-episode/?CommentID=473716

It's not that easy to circumvent UAC (on Vista at least).

You know what, I agree! But with root access, you can do more nasty things. Say, installing a service, that periodicaly scans your home folder for files with a specific criteria and sends them back "home".

It's possible to do that with a standard account too (instead of a service, it would be background program, that starts automaticaly, because it copied itself into the autostart folder or modified HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\run) but with root access, it's much harder to detect, because it can use rootkit-techniques.

The NT/UNIX model is far from perfect, but, even considering all that, I can't still see how the new UAC behaviour in Win7 is a good thing.

It annoys people less, right.. and it creates a fake security too, wich pretty much negates the whole un-annoyingness.

UAC still does show prompts for third party software, but third party software can circumvent that prompts with mind blowing ease now (not possible before). Therefore, it controls only those applications, which WANT to be controlled! It's like as if the police arrests only those criminals, that want to arrested. This is so stupid, how can anyone defend it?

Seriously, it would be better now if Windows 7 would auto elevate everything at the default setting, at least the whole fakeness of if it would be gone. The new UAC default is the worst of both worlds.

Here is an idea:

Every program needs to chose a "category", what kind of program it is - browser, text editor, game, whatever. There should be predefined categories in Visual Studio. Programs can have more than one category, Openoffice for example is more than just a text editor.

The end user should see what categories a program has.

If a program wants to do something, that is not according to it's category, there should be warning - UAC like prompt- "this program wants to do an action, which is not according to its category. Allow?"

As example, if a text editor wants to write into Windows\Currentversion\run or wants to execute CreateRemoteThread. Why should legit a text editor do something like that? The difference to the current UAC would be, that warnings would appear, that are not legit for a specific category. Currently it's possible that any medium IL application can write into the local autostart folder, but it would be not possible for a text editor category program to write into autostart.

Some functions should be blocked out completely to some program categories.

Of course, something like this is insanely difficult for the end user, because he should be able to know what a category means at the end. A malicious program could have a text editor category and a system tool category; while the user sees only the texteditor, the program rapes the registry in the background. So the user himself must know that he can only trust text editors, which have the text editor+html editor category, but not the system tool category.

Since the system needs  a knowledgable user, it's pretty useless at the end.. well.. At least I had an idea.

"but simply because the user is assaulted by it so often that they automatically click Yes without even reading what program caused the prompt."

--------------------------------

I think this argument is totaly overblown. After you install all the needed applications, how often do you see the prompts?
How often do mom&pop, who use word+browser+mail client see the prompts?

"I think with Windows 7's modified UAC, there is a much higher chance that the user will actually read the box."

Every Vista user has read the box, becuase the text is always the same. Except for the "whodunnit" part.

No one has explained to me what good the new UAC default is good for. Read this again:
http://channel9.msdn.com/forums/Coffeehouse/473769-What-UAC-Controversy/?CommentID=473861

And now explain me, what's the point of Win7 UAC is.