Is UAC really secure?

Page 1 of 4 123 ... LastLast

  1. Posts : 759
    Windows 7 Enterprise x64
       #1

    Is UAC really secure?


    I'm seriously considering dropping the UAC settings on my primary rig. Why? There's no real reason to keep it. It only provides a false sense of security. Check out this artice: CLICK ME
      My Computer


  2. Posts : 7,878
    Windows 7 Ultimate x64
       #2

    Well, the article was written nearly 1 year ago...before Windows 7 was actually released.

    Second, nothing in the software world is perfect. So, it seems kinda silly to dispense of something that might have a few shortcomings if it could work in many other ways. I mean I would never stop running an antivirus just because it didn't have protection against 1 particular virus or exploit.

    Personally, I don't have issue with UAC and simply leave it enabled. I've always been confused by those who are tormented by UAC....i simply don't hardly ever see it.
      My Computer


  3. Posts : 1,325
    Windows7 Ultimate 64bit
       #3

    Wow, finally someone that agrees with me...

    Btw, FYI: that flaw is fixed... That flaw is no more. It's simply that several Windows subsystems will auto elevate (back then) without user consent, many disagrees, MS patched the behavior, all is well :)

    zzz2496
      My Computer


  4. Posts : 759
    Windows 7 Enterprise x64
    Thread Starter
       #4

    pparks1 said:
    Well, the article was written nearly 1 year ago...before Windows 7 was actually released.
    True enough, but it's still relevant for Windows 7 users.

    pparks1 said:
    Second, nothing in the software world is perfect. So, it seems kinda silly to dispense of something that might have a few shortcomings if it could work in many other ways. I mean I would never stop running an antivirus just because it didn't have protection against 1 particular virus or exploit.
    Neither would I, but that's not at all the case with UAC. One of the "few shortcomings" UAC has in Windows 7 is it allows third party software to automatically elevate. This completely defeats the entire purpose of UAC, rendering it useless in my opinion.

    pparks1 said:
    Personally, I don't have issue with UAC and simply leave it enabled. I've always been confused by those who are tormented by UAC....i simply don't hardly ever see it.
    I do maintanance on my rig often. Every application I use for this get's a UAC prompt [CCleaner, Registry Clean Expert, Diskeeper 2010...etc...etc]. Torment is an overstatement, but it is quite annoying at times. Why leave it enabled if it doesn't secure my rig like intended?

    I currently have it enabled anyway, but I'm considering disabling it.
      My Computer


  5. Posts : 7,878
    Windows 7 Ultimate x64
       #5

    MadMaxData said:
    I do maintanance on my rig often. Every application I use for this get's a UAC prompt [CCleaner, Registry Clean Expert, Diskeeper 2010...etc...etc]. Torment is an overstatement, but it is quite annoying at times. Why leave it enabled if it doesn't secure my rig like intended?
    Fair enough. I keep my computer as clean as possible every step along the way, so I don't find it necessary to run things like reg cleaners and the like...because I don't install anything that I don't intend to keep. When i do want to play and poke around, I always do it in a virtual machine.

    I do see it from time to time when I run things like a system backup, etc...but I only do something like that once or twice a week...so no big deal.

    I would just disable it and see how it goes for you. You won't be any worse off than users on Windows XP.
      My Computer


  6. Posts : 759
    Windows 7 Enterprise x64
    Thread Starter
       #6

    I guess the point I'm trying to make is this. If third party software, such as malware, can bypass the UAC, and automatically elevate the application, then what's the advantage in using UAC? I can only imagine that malware developers write their programs to execute code at an elevated level as their standard. This renders UAC completely useless.

    I suppose I was wanting someone/anyone to offer up a good reason to keep it enabled. If there is a real [as opposed to imagined] advantage to keeping it enabled, then I will. Otherwise, it's getting disabled.
      My Computer


  7. Posts : 7,878
    Windows 7 Ultimate x64
       #7

    MadMaxData said:
    I guess the point I'm trying to make is this. If third party software, such as malware, can bypass the UAC, and automatically elevate the application, then what's the advantage in using UAC?
    I thought that article specifically stated that 3rd parties were unable to auto escalate. From page 2 of the article
    Fortunately, third parties aren't able to automatically elevate
    The point of that article is that Microsoft's own software can auto escalate and thus reduce the point of UAC. However, for 3rd parties....malware included....cannot. It's a questionable practice for sure...not really practicing what you preach.

    MadMaxData said:
    I can only imagine that malware developers write their programs to execute code at an elevated level as their standard. This renders UAC completely useless.
    Clearly you didn't read the whole article or understand the point that I made above. 3rd parties cannot auto escalate as their standard. It doesn't work for them...unless they are of course...Microsoft.

    And remember, you were mentioning all of your 3rd party apps that forced you to click on the "OK" button...clearly these guys aren't able to silently "auto escalate" to get around annoying you.
    Last edited by pparks1; 12 May 2010 at 22:55.
      My Computer


  8. Posts : 4,364
    Windows 11 21H2 Current build
       #8

    Another point - disabling UAC is akin to logging in as root on a *nix box - you just don't do it.

    If you seriously get too many notifications from UAC per day, then you're either 1) rebooting your machine too often, or 2) running too many optional apps that require elevated privileges for whatever reason.

    BTW, for future reference - don't change the text of a link to "Click Me" - it is exactly that sort of behavior that we try to get novice users to avoid when they are online, without first verifying the link. The board software here has a neat feature that will automatically parse the pages title and make it the text of the link, like this:

    Opinion: Windows 7's UAC is a broken mess; mend it or end it | Vista Home
      My Computer


  9. Posts : 759
    Windows 7 Enterprise x64
    Thread Starter
       #9

    pparks1 said:
    Clearly you didn't read the whole article or understand the point that I made above. 3rd parties cannot auto escalate as their standard. It doesn't work for them...unless they are of course...Microsoft.
    Umm, actually I did understand the article, and your point. Wow, I can't believe you just said such a thing. You don't have any third party software on your machine that silently elevates without a UAC prompt? I've got a ton of it. I didn't need to read an article to know that...LOL

    pparks1 said:
    And remember, you were mentioning all of your 3rd party apps that forced you to click on the "OK" button...clearly these guys aren't able to silently "auto escalate" to get around annoying you.
    Not all my third party applications, just a few. Third party software does indeed have the ability to silently elevate. I have plenty of third party software on my machine that does just that. In fact, most of them. Which is cause for concern, because malware programs can do the exact same thing. I think I lost you somewhere down the line.
      My Computer


  10. Posts : 759
    Windows 7 Enterprise x64
    Thread Starter
       #10

    johngalt said:
    BTW, for future reference - don't change the text of a link to "Click Me" - it is exactly that sort of behavior that we try to get novice users to avoid when they are online, without first verifying the link. The board software here has a neat feature that will automatically parse the pages title and make it the text of the link.
    A text link is a text link. It doesn't matter if it "sounds legitimate." Instead of teaching novices not to click on text links, perhaps they should be taught to hover over the link, and check it in the status bar before clicking on it?
      My Computer


 
Page 1 of 4 123 ... LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 09:19.
Find Us