RSSMicrosoft on Win7 UAC: 'Take the emotions out of the discussion'
By Scott M. Fulton, III | Published February 5, 2009, 4:24 PM
The latest blog posts from Windows 7 engineers reveal this quandary: If the whole point of accelerating Win7 was to eliminate the Vista complaints, and the tool to accomplish that is generating more complaints, what do they do?
Repeating the message, sometimes exhaustively, that they are indeed listening to testers' concerns about the trial security measures in the latest Windows 7 public beta, Microsoft's engineers appear to be on the brink -- if not already over it -- of asking testers the following: If all you're going to do is complain, why should we bother?
The subject, of course, has been the "royal shellacking" that the company has been receiving in the last few weeks for design choices that are said to reduce or eliminate the cause of Vista customers' complaints, but which appear questionable from a security standpoint. Should, for example, Windows 7 have the ability to assign privilege self-elevating privileges to binaries that appear to be signed by Microsoft? As Betanews readers have pointed out, Vista already has similar capabilities; but based on what Microsoft representatives have been saying and what testers are discovering, those methodologies are made easier in the current Win7 beta build.
In a very long blog post early this morning, Microsoft engineer John DeVaan began with words that could be interpreted, or misinterpreted, to mean, if only you folks would keep the noise down, we could get some work done around here. DeVaan begins, "Most of our work finishing Windows 7 is focused on responding to feedback. The [User Account Control] feedback is interesting on a few dimensions of engineering decision making process."
DeVaan goes on to ask testers not to speak of Microsoft's design choices for UAC as a "vulnerability," arguing that technically, that word applies to a case where a specific piece of malware has broken through and delivered a payload. No such incident has been reported or discovered with Win7 Build 7000, he says.
The architectural problem he then focuses upon is whether a prompt was a proper roadblock to prevent malware from being installed -- the choice made for Vista that Win7 is trying to steer away from. The default setting in the new Action Center for User Account Control in Win7 is, "Notify me only when programs try to make changes to my computer." This eliminates the UAC prompts that Vista users would receive, which would often come up immediately after they order a system change, usually through the Control Panel.
From a user perspective, that seems reasonable enough -- eliminating system questions that seem to ask repeatedly, "Is what you just did what you meant to be doing?" On the other hand, such prompts were measurably effective at constraining the ability of malware to impersonate the user (and that's the real technical term for processes that adopt the current user's privileges) and make changes the user didn't ask for.
So the problem is finding the right balance; and to that end, DeVaan defends his company's current choice by reminding those who are technically minded and who would be concerned about the architectural implications of such issues, that they're in the minority.
"It is important to bring in some additional context when explaining our design choice," DeVaan wrote. "We choose our default settings to serve a broad range of customers, based on the feedback we have received about improving UAC as a whole. We have learned from our customers participating in the Customer Experience Improvement Program, Windows Feedback Panel, user surveys, user in field testing, and in house usability testing that the benefit of the information provided by the UAC consent dialog decreases substantially as the number of notifications increases. So for the general population, we know we have to present only key information to avoid the reflex to 'answer yes."'
At PDC last October, Microsoft system designers presented statistics showing that when Vista users were bombarded by prompts, they tended to ignore them more often, making each one less and less effective at doing its job. In fact, users could "answer yes" or click on Continue or Allow almost reflexively, without reading the warning -- a habit which in and of itself could become exploitable by malware.
Inspired by DeVaan's post, Microsoft chief security advisor Roger Halbheer, in a post of his own this morning, took the discussion a few steps further, invoking a kind of question reminiscent of what the primordial humans in the daily planning meetings from a Douglas Adams novel, might ask: If you think you're so smart at inventing the wheel, you tell us what color you think it should be.
"Is UAC really the only thing you are concerned about?" Halbheer asked. "I think it [the system-wide security policy] should be consistent throughout the Windows settings (including UAC) -- protecting UAC alone probably does not cover the attack vectors you are mentioning."
Assuming the user is an administrator anyway, Halbheer continued, "As an example: I can open the Device Manager without prompt. I can change all Windows Settings without a prompt (including all the security settings). This is what the UAC setting is for. From a Risk Management perspective: What would it really change if we would ask for a prompt if you change the UAC setting? So, the malware we are looking at could now not change the UAC settings but all the other Windows settings (if you are an Admin). How much would this really lower the risks -- or would it reduce the risk at all?"
Maybe folks would be better off if "High" were the default setting -- essentially keeping things where they were with Vista, he tossed out. Would users like that better?
"In my opinion," Halbheer concluded, "we all should do two things: 1. Take the emotions out of the discussion; 2. Look at the broad picture from a risk management perspective...The reason for publishing Beta versions is to have these discussions now, where changes are still possible rather than after the release. So, let's have this discussion taking the points above in consideration."
the Windows 7 engineering team has addressed and will bolster UAC for the RC, amen... now we can move on
Score: 0
|"now we can move on"
...if only that were the case. The dunderheads are still whining about DRM in Vista, after all.
Score: 0
|They're making it sound like life and death exist in the UAC. Xp is still considered more secure than Vista (not according to Microsoft), so I don't understand why they can't go back to the drawing board with the whole idea. It's like they absolutely HAVE to have the UAC, just because Vista was deployed with it.
Score: -3
|XP is not more secure than Vista, or as stable, these are facts... who exactly are you referring to when you say XP still considered more secure :P i want what you're smoking
Score: 3
|"Xp is still considered more secure than Vista"
I stopped reading there. Do some more research. Vista is by far more secure than XP, even with UAC disabled. Check out the changes they've made to the kernel.
Score: 1
|Well actually, Tool, I think TCP may be onto something there -- it's in his language. When I talk to everyday people, XP is considered more secure than Vista. People genuinely think that because they either see or hear about all these annoying alerts that Vista brings up, and they feel less secure, that they are less secure. Although statistically, perhaps in orders of magnitude, Vista is more secure than XP.
This whole UAC affair is about mitigating the perception problem. When you hire a thousand people to do crowd control at an airport, people think there must be a bomb scare. It doesn't matter that they may suddenly be standing in the single safest place in the world.
-SF3
Score: 1
|Perception is *not* reality.
We should know that here, on this site, and we should not be catering to those who do not understand that, or worse, seem intent on furthering the incorrect perceptions.
Vista has a lot of bad PR. We should know better here than to fall victim to such. We are, after all, intelligent and educated people in this field, right?
Score: 1
|The simplest solution is to learn from the Mac.. Eliminate shared DLLs, and make applications store it's files WITH the application, that way anything thing that modifies the Windows/System folders would require an Admin level password, and anything in the Program Files folder would not. Uninstall = Delete Folder. *done*
Score: 0
|I said that the first time I saw Vista UAC annoying without end.
I seems MS can only (photo)copy the visual part of Mac OS, not the good one. A shame.
Mac OS UAC equivalent works like it should, asking when it needs to, not *every time* you open something, without modal windows, which are ANNOYING and useless. It seems like MS efforts are to slow down your work in the computer, not improving it...
I like Windows 7 though, it seems what Vista should be. The new task bar is a very good idea, I do not know how did they imagine it[/sarcasm]. Oh, yes, similarities with Mac OS dock are coincidences. They seemed to make a decent copy (even improved) this time. Good work there.
Score: 0
|The issue with UAC is that almost ~EVERY~ installer wants to put files in location on the drive like the System32 folder, or Windows folder. Unfortunately that triggers UAC everytime.
Score: -1
|@ Floodland: Um, Windows has had a taskbar for an awful long time. Meanwhile, Mac OS used to give you a list of apps running in the top right corner. Then OS X came out and the "dock" was unveiled. Where the hell do you think they got this mind blowing concept from? Yes they added their own ideas to it, much like Microsoft has done with the Superbar in Win 7, but don't be ignorant to the facts.
Score: 0
|I use windows since 3.0, Mac OS since version 6 and also used Desqview, OS/2, Linux and some BSD variants. I know who took what from who and how ideas improved (or not) over time.
The dock concept has very little to do with Windows task bar, but to Arthur OS, back from 1987. Later with RISC OS and finally with Next OS. All of them before Windows 95.
So, you show your own ignorance, little MS fanboy... Better learn a little, then write.
Thank you.
Score: 0
|solution, require entering your admin password as per any UAC change, done, that was alot of peoples first thought on this issue and im sure no 'emotion' was involved
Score: 1
|That doesn't solve anything.
If UAC is set to not use the "Secure desktop", regardless of who set it that way, the scripts in question can wreak whatever havok they want. They aren't required to alter UAC settings. A simple registry check will tell the script the status of UAC. If it's open, the script can do whatever it wants...without prompting UAC, or the username/password check you suggest.
Score: 0
|I don't know, man. Why harsh on them for trying to get rid of the annoyances? That UAC settings screen with the drag bar says it all - you set it to what you prefer and you are good to go.
Everybody was upset that the UAC was TOO intrusive by default, so they just changed the default. There is nothing stopping people from changing it to the right setting for them.
Home users and gamers may not want ANY of those prompts, while corporations might want it all locked down tight.
If there are two distinct markets - the home consumer and the corporate client - maybe have the home version set at a more tolerant default.
As long as Microsoft gives users the OPTION to configure it the way they want, and they make it pretty much idiot proof on HOW to configure it, then I don't understand why folks would be all upset.
I do sort of wish that they would be more Modular in their approach to added features and functionality.
Have a nice base level and let folks download and install the pieces that best meet there needs. Maybe you have the "I need to be protected from myself" kit that totally ramps up security big time and a "Hey, I'm an old-school hacker that can handle it by myself" option where they may install a less intrusive package, if they do at all.
On this one, I think Microsoft is just trying to do what people have whined about - get rid of the annoying prompts.
It's only the DEFAULT setting here - they give you the tools to adjust it pretty easily, right? So why get all freaky about it?
It's when the DON'T give you the choice that folks should be angry about.
Score: 1
|Since I disabled UAC in Vista, that may be part of the problem I have in actually comparing Vista and Windows 7. I wouldn't call it Vista SP 2.5 I find it more like Vista Lite. Sure with all the versions out there kinda confusing I suppose. I only say it because it feels like a step backwards. Sure it's going to be faster, they took stuff out of it. The only real reason to have Windows 7 then would be the touch screens. I find Microsoft Surface more interesting for that. Not that I have that sort of money. I want Microsoft to succeed, I just hope they don't rush things like they did with ME. Ironic since it kinda parallel's Windows 2000. First Windows 2000 came out, then Windows ME (eek) then XP. Third times a charm huh? (but Windows 2000 was the standard bearer. ) Given this scenerio, I'd assume with Vista being the Standard bearer... Windows 7 is probably going to suck at some point and Windows 8 will be the faster seller.
Score: 0
|You got it all wrong, ME didn't follow Windows 2000, ME followed Windows 98. XP followed Windows 2000, as the NT kernel. So, in this case, Vista=2000, and Win7 = XP. Thats what I and many expect and hope.
Don't get "Follow" and "timeline" confused. ME was 98 + Plug and Play bonus... and all we got was BONEintheASS
Score: 0
|UAC is a continuously evolving "patch" on a legacy kernel that's broken at the core. W7 is Vista SP2.5 with some added eye candy and the same device/driver paralyzed half-baked OS users are so deathly sick of (read vista). I suppose we're doomed as long as we demand that our PC's have a DOS prompt. How about something new. Keep updating Vista (they won't because XP still could outsell it were it not for the OEMs), and give the market something entirely different and the early adopters will flock to it... the world will follow and the hackers will get their long deserved re-set... Put all that cash into some real R&D instead of paying lawyers to defend anti-trust in the EU... take a chance Microsoft... Vista took how many years and is how big a flop... ? Does anyone remember Michael Cimino's 2nd film (his first was The Deer Hunter) ?
Score: -2
|His second film was "Heaven's Gate."
Score: 0
|Much of the problem could be ameliorated by the removal of the Registry. No one has ever shown it to be speedier or more reliable than the way +nixes allow the OS to know about programs and users. Yet everyone knows how difficult it is for the average user to deal with.
On another note, Microsoft seems to be aiming the newest operating systems at an audience growing more stupid, instead of taking the tack that the audience is mostly people who have used computers, and are therefore more knowledgeable.
Score: 2
|I agree dump the registry.
I nearly have a heart attack every time something goes wrong and I have to search the registry for the fix. Instead of nested entries I find hundreds of separate keys that contain the same redundant info over and over and over again. The other problem are empty entries. Why create them if they are just nulls. At least enter a 0.
(Sorry I don't have Vista and have not had time to run the Windows 7 beta yet, so if you have already done some of these things then good. Great minds think alike.)
Instead lets go back to simple ini files but create a new system so that users can make changes securely via a Windows interface that uses visual security like my bank does where I have to click on a succession of images to prove that I am a live person with permission to make the changes. Then a normal graphical and text based system that logically displays things like where the save and profile files are to be stored, what color and size text and all other setting that the user can change there. Then everyone must use the same format and set multilevel settings such as basic advanced and "admin only" settings. Don't have everyone automatically be the admin but ask at install and have a level that can change all settings except internal OS settings. Simple color and font changes would not require this.
Make the GUI built in and very user friendly for endusers and easy for software designers to use for free. The settings are then stored in a secure "ini" type file called *.set" in the My Documents folder in a sub folder named My Settings and another sub folder named after the Software. This location would also store any saved files that the user saves unless he changes their location through the Software's settings GUI. Making this change would ask to move the docs and set files to the new location. *.doc,*.rtf, and *.txt etc. would go in their own folder since many programs us
these files. Then the OS can make these locations known text and doc editors and allow them to hopefully make this the default location for all of these files. (I know you have tried to get away for one location, but you have a method to have the OS do this silently then everyone is happy. Both the newbies and those very organized like myself.)
Call this new control panel the "Operations Center" and each piece of software and device drivers are listed and when clicked on displays the installed version number (in a new universal standard XX,XX,XX and (the descriptions: alpha, beta, or final; after it), allows uninstall, reinstall, change of installed pieces (ex. add or remove spreadsheet, word processor, database, programs etc.), available new released updates for that software are listed (no betas) (checked via internet), and the place to change all users settings related to that software. Moving all of this to one location will simplify the programmer and user experience and make it secure so no mal-ware or software can make any changes without being verified as coming from a "live person's" permission (whether end user or admin) and after a thorough testing by anti-malware program. All settings for Windows 7 will be accessed here as well. If an external firewall is used then a manner should be setup to detect it and automatically deactivate the internal Windows firewall.
Also this allows simple backups of the My Documents folder as having all files related to the software that a user needs to backup (settings and docs). As well then Windows can lock the system so that nothing can change the OS or any software settings or the contents of any documents unless a live person gives permission and other than these settings no other overhead is needed to secure a PC. This will require all macros, VBscript, inf, cmd, and batch files to be security protected so that only after a live person authorizes it via the "Operations Center" then these files cannot be modified unless a live person authorizes it. They can then run automatically without any intervention in a secure manner.
Also no default install for Windows 7 (except when created by a liveperson via burned version or removable media config script and begun by a live person). Instead a wizard that asks the live person what the machine is used for and only install those packages and services needed for that use. If any new functions need to be installed then the user opens the wizard and the OS asks what and only installs the newly needed packages. It also looks on the internet and makes sure the latest drivers and software is downloaded and then any service needed is installed.
I believe this would really revolutionize the Windows experience.
Also make a virtual copy during fresh install of all Windows 7 setup files in a separate hidden partition that can be slipstreamed with service packs so that a user can fix his system without a disk. This could have a required system check to determine a legal copy matched to the CPU number of the computer before allowing the slipstream to be added. If a CPU is changed then a live person will need to reauthorized the system. Microsoft needs to then require OEM's to do this as well. This all allows for everything to keep their system running up-to-date and fix most problems on-the-fly. Also a copy if all installed drivers should be stored automatically there by Windows as well.
Also a lower price for home users and small businesses is needed. It is just too expensive. I suggest that the disks are available at a low $5 or $10 price from anywhere then a secure system for internet registration that then requires a credit card or paypal payment to get a registration for like $120 full consumer/home office version and slightly more for small business users. At that time the Home server version could be purchased and unlocked (as it would already be on the setup disk. This registration would be done after the system is setup either at home or office. If no internet access is available then an alternate method of registration could be done via a large store such as Best Buy. Methods for this are to be determined. Serial numbers
on stickers should be abandoned and a safe secure electronic method should be adopted. Single use mini-cd's obtained from the store might be an idea like the rental movies have used if a non-internet activation method is required.
I hope you guys at Microsoft read this and find some benefit of these ideas that will help us all.
Score: 1
|MSFT is considering the removal of the registry (or at least keeping it for compatibility reasons only) for the next "platform" release of Windows.
Since Windows 7 builds on vista, and not considered a major release (as far as versioning/platform goes) they won't do anything that could majorly change the way the OS functions.
I wouldn't be at all surprised to see the registry get demoted in usefulness in the next platform release.
Score: 0
|"where I have to click on a succession of images"
It also needs to work for the blind and those unable to click.
Score: 0
|"If the whole point of accelerating Win7 was to eliminate the Vista complaints, and the tool to accomplish that is generating more complaints, what do they do?"
Immediately terminate the development of Windows and partner with Apple. Simple. End of story. Have a great day.
Score: -4
|Better yet, partner with a good Linux like Ubuntu.
Score: 0
|Better yet, let Microsoft do what the hell they want to do with Windows 7 in regards to security like they wanted to do with Vista... and screw what everyone else thinks.
Big freakin' deal! So users have to click a button to allow something to run that UAC would otherwise reject. Any of the umpteen thousand distributions of Linux require typing a root password to allow the same thing. Oh... but Linux is so much better and secure, right? Apparently they're on to something. Maybe Microsoft should require users to type their password as well...
Score: 0
|How would you like that every time you drove your car that you had to restart it to make a turn onto a new street, yountmj?
Score: -1
|at least with linux, or at least with ubuntu it bothers to remember you entered your password. UAC reminds me of that nasty little item that came with Spybot. And it was never smart enouigh to remember. Like emails on Mailwasher are more easily remembered as spam in that program than Thunderbirds Junk memory
Score: 0
|Ugh...Wouldn't that make MacOS an open platform (as in install on non Apple hardware), and make MacOS the most insecure, buggiest, virus prone bloated OS in the market? Wouldn't that also mean that everyone would have apple products and everyone would think how mundane and non inventive their products are? Talk about role reversal! You really can't see the forest in the trees can you?
Life is always good when you are oblivious to the obvious.
Score: 0
|@ sjc001
If you're going to respond to me directly, at least have the courtesy of making sense.
Score: 0
|they address and fix the issues according to consumer feedback, which they now have done
Score: 0
|NEWSFLASH: Most people don't understand what UAC is all about.
It's not a security barrier by itself. It's not meant to protect users from malware they download and open themselves.
UAC is a measure that aims to stop clueless developers from writing broken software with the assumption that everyone runs as an admin (e.g., storing data and settings in Program Files, writing to HKLM registry hive and so on).
Even though technically users could use standard accounts since NT, nobody used them before Vista, because of the amount of broken software out there (including even written by Microsoft).
Now with UAC in place it's easier to run as a standard user most of the time, elevating privileges only when necessary to install software or change system settings.
Think of UAC as analog of *nix command "sudo", only better (because of the use of secure desktop) and more convenient (because usually all is needed is to click "Continue", as opposed to entering your password). Nobody seems to complain about using sudo on Linux, or having to click a lock icon and typing a password on Mac OS X, yet everyone is b****ing that Vista's UAC is annoying.
Score: 2
|Baloney.
Score: -2
|"Nobody seems to complain about using sudo on Linux, or having to click a lock icon and typing a password on Mac OS X, yet everyone is b****ing that Vista's UAC is annoying"
That's right on the money. If one wants to enter a password in Vista or Win7, then UAC can easily be set to do so. This whole argument exposes the double standard against Windows.
Score: 1
|Spot on!
Score: 0
|"UAC is a measure that aims to stop clueless developers from writing broken software with the assumption that everyone runs as an admin (e.g., storing data and settings in Program Files, writing to HKLM registry hive and so on)."
No, UAC is a measure to allow users to run as a limited user but still be able to use legacy software or other software that needs administrator access.
In fact features like VirtualStore will allow "broken" software to continue to run and function fine in Vista and 7.
Also I disagree that UAC is better than sudo. I believe sudo has the edge:
1) For UAC, users may not have to enter their password thus encouraging "click-throughs". In Linux even administrators must enter a sudo password. This takes a bit longer and although can be just as automatic, it gives more of a chance for that "wait a minute, I didn't run anything that should need this" moment. You can change the group policy settings on windows to even require administrators to enter a password, but I'm just talking default settings here.
2) Legacy software may require administrative rights on Windows even when the features of the software can be accomplished without admin rights... thus UAC will have to be used to elevate those legacy programs. On Linux this is a non-issue since users have run with limited abilities, using sudo when needed on specific programs. There are no legacy programs that were designed for linux systems without sudo since such systems never existed (AFAIK).
3) sudo integrates with the terminal, allowing one-time elevation of specific commands as well as output from both "elevated" and normal commands to live in the same terminal. On Windows an elevated process must create its own console (which disappears as soon as the process exits... try sdbinst /? in a non-elevated command prompt in Windows 7 to see what I mean) and there is no "sudo" command without third-party utils (I use Start++) thus making UAC more difficult to utilize for users who prefer to use the command line.
Score: 1
|"Legacy software may require administrative rights on Windows even when the features of the software can be accomplished without admin rights... thus UAC will have to be used to elevate those legacy programs."
True, but we're talking about new software too. Developers are forced to adjust their programs in order to reduce the number of UAC prompts or eliminate them entirely, thus making the whole experience better and more secure.
"sudo integrates with the terminal, allowing one-time elevation of specific commands as well as output from both "elevated" and normal commands to live in the same terminal."
I agree with that point, I'd also like to have the ability to elevate specific programs from the command line, but sudo does not use the secure desktop, thus a keylogger could steal your password.
Score: 0
|Maybe Microsoft should consider the way OSX Leopard handles requirements for typing in a system password. Only needed when installing any software or updates, whether Apple's own or 3rd-party.
Score: 2
|Yes, but on the same hand Apple needs to stop enabling security issues like "open safe files after downloading". A safe file is judged by it's extension only and that can become very problematic in itself.
I do like the "password on install" feature, regardless of which app, as well as the first-time warning (similar to something Windows has with its own security center, I believe. I don't use Windows that much).
Score: 1
|Stick it at the highest setting by default. Ask the user what they want at initial system setup.
Perhaps that may placate people. At least that way, if they set it lower it's their own fault and if they get bombarded by 'too many' UAC dialogues it's still their own fault.
Score: 2
|I know what they should do. Remove UAC. Even when it worked properly it was little more than an annoyance to legit users who would just auto-click on it to just get rid of it without actually reading what it said. That makes it worthless as a security measure. Security should be invisible, all this did was distract.
Score: -6
|"Security should be invisible"
You are utterly clueless, aren't you? If one of my IT guys even jokingly said something that stupid...
Score: 0
|What are your thoughts on #5 at http://www.ranum.com/sec...ecurity/editorials/dumb/ ?
Score: 0
|Unworkable in the real world.
People expect to be able to do certain things with their computers with a certain amount of ease. This cannot be accomplished while maintaining a strict, unyeilding security policy. It *does* work in corporate environments, as many here can likely attest, but for the home user...
It's fun to say there should be a test to own a computer...I've been guilty of it myself, but it's in humor because we know such a thing is ludicrous.
Reality? Penetrate and patch is the only workable solution at this point even though we all know it can't *solve* the problem. It's not a solution, it's a treatment.
Score: 0
|