Is UAC really secure?

[MadMaxData]

I'm seriously considering dropping the UAC settings on my primary rig. Why? There's no real reason to keep it. It only provides a false sense of security. Check out this artice: CLICK ME

 

[pparks1]

Well, the article was written nearly 1 year ago...before Windows 7 was actually released.

Second, nothing in the software world is perfect. So, it seems kinda silly to dispense of something that might have a few shortcomings if it could work in many other ways. I mean I would never stop running an antivirus just because it didn't have protection against 1 particular virus or exploit.

Personally, I don't have issue with UAC and simply leave it enabled. I've always been confused by those who are tormented by UAC....i simply don't hardly ever see it.

 

[zzz2496]

Wow, finally someone that agrees with me...

Btw, FYI: that flaw is fixed... That flaw is no more. It's simply that several Windows subsystems will auto elevate (back then) without user consent, many disagrees, MS patched the behavior, all is well

zzz2496

 

[MadMaxData]

Well, the article was written nearly 1 year ago...before Windows 7 was actually released.

True enough, but it's still relevant for Windows 7 users.

Second, nothing in the software world is perfect. So, it seems kinda silly to dispense of something that might have a few shortcomings if it could work in many other ways. I mean I would never stop running an antivirus just because it didn't have protection against 1 particular virus or exploit.

Neither would I, but that's not at all the case with UAC. One of the "few shortcomings" UAC has in Windows 7 is it allows third party software to automatically elevate. This completely defeats the entire purpose of UAC, rendering it useless in my opinion.

Personally, I don't have issue with UAC and simply leave it enabled. I've always been confused by those who are tormented by UAC....i simply don't hardly ever see it.

I do maintanance on my rig often. Every application I use for this get's a UAC prompt [CCleaner, Registry Clean Expert, Diskeeper 2010...etc...etc]. Torment is an overstatement, but it is quite annoying at times. Why leave it enabled if it doesn't secure my rig like intended?

I currently have it enabled anyway, but I'm considering disabling it.

 

[pparks1]

I do maintanance on my rig often. Every application I use for this get's a UAC prompt [CCleaner, Registry Clean Expert, Diskeeper 2010...etc...etc]. Torment is an overstatement, but it is quite annoying at times. Why leave it enabled if it doesn't secure my rig like intended?

Fair enough. I keep my computer as clean as possible every step along the way, so I don't find it necessary to run things like reg cleaners and the like...because I don't install anything that I don't intend to keep. When i do want to play and poke around, I always do it in a virtual machine.

I do see it from time to time when I run things like a system backup, etc...but I only do something like that once or twice a week...so no big deal.

I would just disable it and see how it goes for you. You won't be any worse off than users on Windows XP.

 

[MadMaxData]

I guess the point I'm trying to make is this. If third party software, such as malware, can bypass the UAC, and automatically elevate the application, then what's the advantage in using UAC? I can only imagine that malware developers write their programs to execute code at an elevated level as their standard. This renders UAC completely useless.

I suppose I was wanting someone/anyone to offer up a good reason to keep it enabled. If there is a real [as opposed to imagined] advantage to keeping it enabled, then I will. Otherwise, it's getting disabled.

 

[pparks1]

I guess the point I'm trying to make is this. If third party software, such as malware, can bypass the UAC, and automatically elevate the application, then what's the advantage in using UAC?

I thought that article specifically stated that 3rd parties were unable to auto escalate. From page 2 of the article

Fortunately, third parties aren't able to automatically elevate

The point of that article is that Microsoft's own software can auto escalate and thus reduce the point of UAC. However, for 3rd parties....malware included....cannot. It's a questionable practice for sure...not really practicing what you preach.

I can only imagine that malware developers write their programs to execute code at an elevated level as their standard. This renders UAC completely useless.

Clearly you didn't read the whole article or understand the point that I made above. 3rd parties cannot auto escalate as their standard. It doesn't work for them...unless they are of course...Microsoft.

And remember, you were mentioning all of your 3rd party apps that forced you to click on the "OK" button...clearly these guys aren't able to silently "auto escalate" to get around annoying you.

 

[johngalt]

Another point - disabling UAC is akin to logging in as root on a *nix box - you just don't do it.

If you seriously get too many notifications from UAC per day, then you're either 1) rebooting your machine too often, or 2) running too many optional apps that require elevated privileges for whatever reason.

BTW, for future reference - don't change the text of a link to "Click Me" - it is exactly that sort of behavior that we try to get novice users to avoid when they are online, without first verifying the link. The board software here has a neat feature that will automatically parse the pages title and make it the text of the link, like this:

Opinion: Windows 7's UAC is a broken mess; mend it or end it | Vista Home

 

[MadMaxData]

Clearly you didn't read the whole article or understand the point that I made above. 3rd parties cannot auto escalate as their standard. It doesn't work for them...unless they are of course...Microsoft.

Umm, actually I did understand the article, and your point. Wow, I can't believe you just said such a thing. You don't have any third party software on your machine that silently elevates without a UAC prompt? I've got a ton of it. I didn't need to read an article to know that...LOL

And remember, you were mentioning all of your 3rd party apps that forced you to click on the "OK" button...clearly these guys aren't able to silently "auto escalate" to get around annoying you.

Not all my third party applications, just a few. Third party software does indeed have the ability to silently elevate. I have plenty of third party software on my machine that does just that. In fact, most of them. Which is cause for concern, because malware programs can do the exact same thing. I think I lost you somewhere down the line.

 

[MadMaxData]

BTW, for future reference - don't change the text of a link to "Click Me" - it is exactly that sort of behavior that we try to get novice users to avoid when they are online, without first verifying the link. The board software here has a neat feature that will automatically parse the pages title and make it the text of the link.

A text link is a text link. It doesn't matter if it "sounds legitimate." Instead of teaching novices not to click on text links, perhaps they should be taught to hover over the link, and check it in the status bar before clicking on it?

 

[johngalt]

So, instead of doing as I requested of you, also saving you the time of having to format the link, you want to argue with me.

Fine. Argue away.

 

[MadMaxData]

So, instead of doing as I requested of you, also saving you the time of having to format the link, you want to argue with me.

Fine. Argue away.

I don't want to argue with you at all, and that wasn't my intention. Just because I thought your suggestion was rediculous doesn't mean I want to argue about it.

 

[win7clutz]

So, instead of doing as I requested of you, also saving you the time of having to format the link, you want to argue with me.

Fine. Argue away.

Surprised? Read his post since joining...

 

[MadMaxData]

Fine. Argue away.

Surprised? Read his post since joining...

LMAO....talk about the pot calling the kettle black.

Let's appeal to common sense, shall we?

Please show me the difference between the two methods of text links, when both text links do the exact same thing?

 

[win7clutz]

You’re belligerent. Yet it’s a public forum, so do what you please…

You frequently post ‘bout your client base. Guess that makes you special. Disable UAC if you like and suggest the same for them, you’re the only one that has to deal with the result…

Happy Trails and Flame Away...

 

[johngalt]

try again.

Post a link: Paragon Software: Download free partition software for home (No, I am not editing the link to display that text - it is automatic.

Please re-read what I wrote before you decide to argue. Thanks.

 

[MadMaxData]

You’re belligerent.

Honestly, I could care less what you think. Your the biggest jerk on this forum, bar none.

 

[MadMaxData]

Please re-read what I wrote before you decide to argue. Thanks.

Like I said, I'm not arguing. Please show me the difference between your way, and mine? There is none because both methods do the exact same thing. No argument.

 

[johngalt]

Wrong. My method is a simple paste of a link. There is no adding URL tags, typing the words "click me" or "Who's your Daddy" or anything like that. If you cannot understand that, then this conversation is over.

Grab 5 random links, paste them in a new reply and submit - without adding any BBCode - and just maybe you'll understand.

 

[win7clutz]

You’re belligerent.

Honestly, I could care less what you think. Your the biggest jerk on this forum, bar none.

Wow, I just realized that you're in Ohio! Let's have lunch...