Focus on Apple
Re: What's George Ou smoking? Feb 20 2007 04:02PM
Thor (Hammer of God) (thor hammerofgod com)

On 2/19/07 6:55 AM, "Don Rhodes" <drhodes (at) mail.colgate (dot) edu [email concealed]> spoketh to all:

> You make valid points, and I do not disagree with them. What I wanted to
> convey is that the UAC in Vista is a leap forward for security but most
> users will just realize that all they need to do is click
> continue/allow.

I realize this is the Focus-Apple list, and here we are talking about Vista
now, but I think that it is important to get accurate information posted in
these discussions-- it makes a difference, particularly in the light of the
"Mac/Windows zealots" conversations on this list regarding the "Gates on Mac
OS X Security" thread. If we are going to be involved in securing a
platform, we must do our due diligence in learning how to properly secure
it. I've been leading training courses in Microsoft security for years, and
have been voted a Microsoft MVP in Windows Security for the last two years--
yet at my last RSA training, I presented my "ISA Server" security training
on my Powerbook 17. If you look at the headers of this email, you'll see
that I've posted it from Entourage on my mini. I say all that in the hopes
that others reading this won't think that I'm just another Microsoft zealot,
and that the points made here are made for the purpose of better describing
the importance of the features we are discussing and not just to defend
MSFT.

That being said, it is very important to realize that in Vista, the user
will only get the UAC "allow" message when they are *already running as an
administrator*. If they are running as a "normal" user, they will be
prompted for the admin account name and password to proceed. In this
regard, "most users" will *not* "realize that all they need to do is click
continue/allow" as most users will not be administrators, as there is no
need for them to be. When you install, you create an "admin" user, then you
create a "normal" user for everyday use similar to OSX. When I got my
Powerbook, it was preconfigured as the Administrator with no password. I
had to change the password and then create a standard user for everyday use,
and had to do so out of my own knowledge that it was the best way to do it,
not because the install told me to. At least the Vista installer tells you
the difference.

I've got about 75 users (out of 130 people) at my company- not a single one
is an administrator on their box. Not one. And they are still in XP! I
can't wait to roll out Vista with UAC enabled- it will make things FAR
easier from an administrative standpoint.

Also, understand that there *is* a difference between the "admin" user you
create and use interactively and the system "Administrator" account
functions in Vista (but not XP). By way of example, let's say that you are
interactively logged in as the "admin" user (albeit, a bad thing). If you
go to CMD and try to add a static route, you'll get a "operation requires
elevation" (or similar) message. This is because there are certain
system-level operations that even the "admin" user cannot perform. One must
specifically "Run as Administrator" to perform these functions, which
*requires* the username and password of your admin account. Though it is
the same account, Vista differentiates "standard" admin tasks from tasks
where explicit "Administrator" privileges are required, just like OSX does.
I actually had to test that again in OSX as I don't run as Administrator on
my Macs either ;)

Coming from an XP mindset where "lazy" people run as administrator, one may
see the UAC as simply an example of "just hit continue for malware" but it
is not- at least it doesn't have to be. You'll still have to go out of your
way to screw up, which to me, is a good thing. At least people have the
opportunity to easily do it "right."

>
> Once program have been updated/created for the new UAC 95% of programs
> will act and work just like they did in XP; actually I hope they will
> work better.
>

Personally, everything I've installed in Vista has properly asked for the
admin account as it should. And operations in all of them where escalated
privileges are necessary work as expected, even in things like the x64 beta
drivers for my Creative X-Fi elite pro configuration console. Even my Adobe
products prompt the UAC interface to run "Adobe Update Manager" when I start
them. So, as far as I've seen, we're pretty close already.

> In the end it will take time for all of the new features to work
> themselves out and work as intended; we all remember how 95 was a
> change, and then how 2000/XP was yet another change. I'm sure when we
> look back at Vista in 2013 we all will think that it would be insane
> that we did not use UAC earlier.

Exactly- which is why I took the time to make this long post; so that others
may possibly be able to benefit from the details herein, even if it is the
Focus-Apple list (and I *really* hope it makes the list, as it would be a
colossal waste of my time if not. ;)

Thanks
t

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus