UAC Flaw: One Man's View Vista Security Discuss UAC Flaw: One Man's View in the Windows Vista forums; Hi Friends: I think that most of us thing of UAC as a security measure. However, I would bet that most of us turn it off. I vote for turning ...

[Znod]

Hi Friends:

I think that most of us thing of UAC as a security measure. However, I would bet that most of us turn it off. I vote for turning it off : http://blogs.zdnet.com/security/?p=29&tag=nl.e622

[Seansmit17]

oh yes.. my UAC is off.. it was driving me MAD!..


BTW like my new avatar? Come to the dark side.. we have cookies!

[Znod]

I did see your avatar. And, yes, I do like it very much. I assume you have chocolate Oreos. Here is something that you are very welcome to: The yellow, but not cowardly, one looks like my Avatar a bit. You must be the dark one.

[Snuffy]

For those who thought the User Account Control (UAC) feature introduced in Windows Vista was intended to set security boundaries, Microsoft has made a clarification: it isn't.

The message is attracting criticism from security experts, one of whom said it made features such as UAC seem like nothing more than a "joke".

The most direct communication about UAC to date came on Monday from Mark Russinovich, a Technical Fellow in Microsoft's Platform and Services Division, who joined the company when it bought Russinovich's Winternals Software. Russinovich is a noted developer of Windows utilities and is credited with being the first to discover the rootkit in Sony BMG's copy-protection software.

In a Microsoft TechNet blog post, Russinovich explained that Vista features such as UAC or Protected Mode Internet Explorer that are dependent on limited user privileges - which Microsoft calls Integrity Levels (ILs) - are designed to allow some IL breaches.

"Vista makes tradeoffs between security and convenience, and both UAC and Protected Mode IE have design choices that required paths to be opened in the IL wall for application compatibility and ease of use," he wrote.

Because the boundaries defined by UAC and Protected Mode IE are designed to be porous, they can't really be considered security barriers, he said. "Neither UAC elevations nor Protected Mode IE define new Windows security boundaries," Russinovich wrote. "Because elevations and ILs don’t define a security boundary, potential avenues of attack, regardless of ease or scope, are not security bugs."

He said Microsoft had communicated this in the past, but that the point needed reiterating.

Full Story At Source




News Source: www.techworld.com
__________________
Moved from original post.. Thanks ZNod

[Midway]

I have myself as a Standard User with UAC on. I have dabbled with Linux for the past three years so having to enter a password to install programs or other system changing stuff isn't nothing new to me. This is the first time I have ever ran as a User as past Windows were "clunky" in the admin/user setup.

I guess it is a matter of choice but I feel somewhat safer doing it this way.

[Znod]

I say if you feel safer, then do it--as in "if it feels good, then do it."

[Midway]

The only thing I don't like about it is when I move icons around on the desktop. I like having a minimalist desktop with only <My Folder>, Computer, Programs, IE, and Trash on it. When a program installs an icon on the desktop, I move it into the Programs folder. But UAC says I need a password for this, lol.