Slashdot Mirror
Microsoft Says Other OSes Should Imitate UAC
COA writes "Many Vista adopters find User Account Control irritating, but Microsoft thinks it's an approach other OSes should emulate. Microsoft Australia's Chief Security Adviser Peter Watson calls UAC a great idea and 'strategically a direction that all operating systems and all technologies should be heading down.' He also believes Microsoft is charting new territory with UAC. 'The most controversial aspect of Watson's comments all center around the idea that Microsoft is a leader with UAC, and that other OSes should follow suit. UAC is a cousin of myriad "superuser" process elevation strategies, of which Mac OS X and all flavors of Linux already enjoy. The fact is that Microsoft is late to the party with their Microsoftized version of sudo. That's really what UAC is, after all: sudo with a fancy display mechanism (to make it hard to spoof) and extra monitoring to pick up on "suspicious" behavior.'"
Microsoft would is trying to make you believe sudo was their idea. Cancel or Allow?
Life is short: void the warranty.
How about UAC starts imitating better designed privilege escalation mechanisms from Linux or OS X? Of course, that would require a sensible architecture in which software can be installed by users, for themselves, without superuser permissions. And, unfortunately, it would need secure software as a basis to avoid needing unnecessary privileges to accomplish mundane tasks in insecure applications. Sorry Microsoft, you missed the boat on this one. The majority of Vista users have UAC turned off, and the majority of those who dont will turn it off as soon as they figure out how.
From TFA: "Why should I be letting my normal user be running as system administrator?" Welcome to the 1980s
Today's lucky number is: 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
make me a sandwich.
Yeah, it is about time those OpenBSD pikers got off their collective asses and followed the World Leader in Secure Operating Systems: Microsoft.
"Every decent man is ashamed of the government he lives under." - H.L. Mencken
nearly all OSes already have something similar, but superior, to UAC.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
Other Operating Systems need to put more annoying dialogs that ask for elevation privileges every 5 minutes and don't ask for any credentials.
Hell, they should make them appear so often people completely ignore their content and just blindly click "OK" or "Allow". Yeah, that's the ticket...
For a company who is reknowned for brutalizing industry standards it's humorous to find them believing the industry would adopt their bastardized version of the existing.
"Microsoft says other OSes should annoy the crap of its userbase more."
Eviscerati.Org: All Hail the Eviscerati
Why use UAC when a much more intuitive sudo interface has already been developed?
Translation: "If we can get all the other operating systems to follow our lead, we can claim some sort of patent infringment on 'em."
> The fact is that Microsoft is late to the party with their Microsoftized version of sudo. That's really what UAC is, after all: sudo with a fancy display mechanism (to make it hard to spoof) and extra monitoring to pick up on "suspicious" behavior.'"
The fact that Microsoft is late to the party is what makes it a patent trap. If it were just sudo, it wouldn't be patentable. When it's "a method for controlling process elevation, comprised of (sudo) and (a fancy display mechanism) and (extra monitoring)", it becomes patentable.
Microsoft is setting a trap for future patent lawsuits. Deny or Allow?
...what to do, but keep your grubby hands off the real operating systems that don't base their security on feel-good measures, but sound design and actually fixing things.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
because Unix has a method to do this [that isn't annoying], so we should immediately switch to one that is?
what the hell is security through pop-ups anyway?
The machine unmakes the man. Now that the machine is so perfect, the engineer is nobody. -Ralph Waldo Emerson
I would say (and many here would agree) that UAC is a half-hearted, bad copy of sudo. sudo requires authentication and only for actions that require elevated privileges (like changing key system files). UAC annoying asks the user to verify suspicious behaviors to ensure that is what he or she really wants to do. Really UAC is an attempt at MS to shift the blame the user for their somewhat insecurity architecture. When something does go wrong, MS can blame the user saying it was the user's duty to verify their actions.
Well, there's spam egg sausage and spam, that's not got much spam in it.
...ROT13 *is* easier to manage and deploy.
I don't think it's such a bad idea to have some extra means of making sure a user REALLY wants to do a special action. Ubuntu and Fedora handle this by asking a user to authenticate whenever an action requiring elevated rights occurs. It's actually done quite well and is only required for doing things like adding or deleting software, and the rights stick around for a while so you're not constantly typing in passwords.
The problem of course is that Microsoft went crazy and decided to lock down EVERYTHING. To the point where it's just plain annoying running the OS with it on. I tried it for a couple weeks just to see if I could get used to it. There's a tendency for people to crave the old way of doing something not because it's better, but just because that's what they're used to. I did eventually decide UAC was more trouble than it's worth, and disabled it.
I guess I tend to agree with the theory that UAC wasn't really real security, but about putting the blame more on the user. Microsoft can just claim "Well, you DID disable UAC didn't you?, so it's not our problem."
AccountKiller
What do you expect him to say - "we're late to the party and we botched the implementation". It took them five years to create Vista. They pulled out every major feature except 'security' and DRM and they got security wrong. And now they wonder why customers aren't clamoring to upgrade to Vista.
[Insert pithy quote here]
...my browser keeps asking me to allow or deny arstechnica...
The Kai's Semi-Updated Website Thingy
Barring the debate over whether UAC is well implemented, what's somewhat new is that it's the default behavior. Ubuntu has been doing this since the beginning of that distro, but I don't know of other Linux distros that--by default--don't let you log in as root, granting sudo priviliges to the first user created. I can't say whether Apple does this. I know for sure that Slackware, Fedora, and RHEL don't. FreeBSD didn't last time I checked, but that was a *long* time ago. I think the debate ought to be less about whether UAC is well implemented or innovative, and more about whether other OS's ought to have the default behavior that Ubuntu, and now Microsoft have... whether by sudo, UAC, or whatever the mechanism is. To me, that's the point of the whole thing.
You are coming to a sad realization. Confirm or Deny? :)
To be brutally honest though, I find it difficult to even *understand* selinux. I'm still only running it in permissive mode.. If Microsoft actually manages to show the user/system admin such audit messages and modify policy accordingly (based on system admin's response) then I think that's a good idea. Fetchmail and spamassassin spew some "denied" audits on my home computer but I haven't (yet :-)) found out how to modify the selinux policy. I think it shouldn't be done with interactive menus though; secure e-mail directly into root's mailbox is probably a bit safer.
Disclaimer: IANAsecurity expert, but I play one at home.
To be, or not to be: isn't that quite logical, Slashdot Beta?
We implemented a special switch which allows these functions. It's located inside the computer's power supply, near the big thing marked "1000uF 250V".
In order for the setting to take effect, you have to make sure to press the switch while the computer is running. We've found that using a steel coat-hanger wire (be sure to sand the paint off, first, you don't want it getting into your computer!) passed in through the vent holes in back works well.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
....and the last horse crosses the finishing line... too bad the other horses finished years ago and the race track no longer exists... *Coming soon from Microsoft* More working ideas that where implemented years ago in other operating systems that we'll claim we invented
"Stallman says add to this code and you are one of us. Gates says use this code and you belong to us."
The fact is that Microsoft is late to the party with their Microsoftized version of sudo. That's really what UAC is, after all: sudo with a fancy display mechanism (to make it hard to spoof) and extra monitoring to pick up on "suspicious" behavior.'"
o soft-uac-not-a-security.html
No it's not! Not at all. First of all, let's define what sudo should do: Act as a barrier that data and application execution must pass. UAC does not fit the definition.
"Vista features such as UAC or Protected Mode Internet Explorer that are dependent on limited user privileges -- which Microsoft calls Integrity Levels (IL) -- are designed to allow some IL breaches.
Because the boundaries defined by UAC and Protected Mode IE are designed to be porous, they can't really be considered security barriers, he said. "Neither UAC elevations nor Protected Mode IE define new Windows security boundaries,"
Thank you Mark Russinovich for stating what's been clear for quite some time. http://www.networkworld.com/news/2007/021407-micr
I wish, for once, everyone and their grandmother would stop assuming Microsoft's security proclamations are reliable information.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Microsoft's UAC approach does not fix the problem. Windows is like a rickety bridge. We know its dangerous but Microsoft's "fix" is to place signs every 5 steps warning you could slip. How about instead we build a better bridge instead of build a better sign? Maybe we need Microsoft to build a better Windows instead of build a better system to warn us about Windows? That must be crazy talk because Microsoft year after year continues to choose to seek how to build better signs instead of better bridges.
Lets get Microsoft to design a software platform that doesn't require the user to think about whether or not the user is about to break something? Is that really so hard for one of the largest software companies in the world? UAC from my view is the wrong way to solve a problem which was born of questionable engineering. One of the reasons why UAC is so dubious is that the user may not know any better either which is a "blind leading the blind" across that rickety bridge. In summary, a better Windows wouldn't have a need for UAC so why tout this technology?
... and then they will sue them for patent infringement.
You can't win.
I'll probably be modded down for this...
Microsoft Australia's Chief Security Adviser Peter Watson calls UAC a great idea (and wishes everyone had it)
In other news, the Notre Dame football coach thinks his team can win. Local Ford salesman hates Toyotas. Linus Torvalds thinks Linux is great. Christians report having favorable rating for Jesus this year.
MS's Chief Security Adviser is paid to evangelize MS security. This is news?
-- Political fascism requires a Fuhrer.
When did Micro$oft buy the Union Aerospace Corp? Does Id know about this?
What if some malware attacks in this while? That, I believe, is precisely why Microsoft didn't implement it this way.
There's a tendency for IT people to believe that ALL solutions have to be perfect solutions. Yes, there's some level of increased risk for a few minutes after a use authenticates. But if you have a short period of time where the extra rights stick around, you'll likely get people to actually USE the damn thing rather than running as root (or turning off UAC).
Security in particular is often a balance between usability and security. If the product isn't usable because of the security, the users will MAKE it usable by going around the security (thereby defeating the security).
Hmm. Apart from installing/uninstalling software, controlling system settings, and for certain software that hasn't got its act together yet and needs admin permissions, exactly where does UAC pop up?
I couldn't tell you specifically, as I disabled it in Vista months ago. All I know is the damn thing came up waaay too often, so I killed it.
AccountKiller
So MSFT is `chown -R unpriv_user *.exe` and making all pgms SUID unpriv_user! This brings problems:
Are all necessary files world-readable? What about other users.
Are all necessary files/dirs world-writable? c:\windows\system32?
How will the OS know if a pgm can access certain ports?
What if a hostile doesn't access ports directly but fork()s legit pgms?.
if other pgms are writeable, can't an attacker assume their priviliges by corrupting them?
Priv isolation by user is far clearer than by pgm.
UAC has far too many false positives to be meaningful. You can't freaking open the Control Panel without a UAC prompt.
As such, users see the prompts as an unimportant nuisance, but soon realize that things don't work unless you click "Allow." Thus, you're training users in Pavlovian fashion to click "Allow" to any damn box that comes up.
Now think about this for a second: when 99% of the prompts you get are harmless, and "Allow" is always the right answer, just how many users will actually read it and apply critical thought when they see the 1% of UAC prompts that warns of actual danger? Almost none of them, even the smart ones. Once you get trained to just click allow, you're going to click it just before your realize "Oops! I didn't want to allow THAT one!"
So if you ask me, UAC is a huge step backwards in terms of security. Microsoft appears to have put almost no thought into it and it's little more than a way of blame-shifting. After all, the USER is the one who didn't click "Deny" the one time in one hundred it would've prevented something bad, so it's *all* their fault. Even though they only did what UAC trained them to do.
Disable UAC now. It's not security; it's blame-shifting.
A modern OS should be having something that's much better than sudo.
Modern desktop class OSes should have sandbox _templates_, with apps being allowed to "suggest" a template.
Then if an app claims to be a "plain old screen saver", it only gets "plain old screen saver" rights - which means no network access, no access to the user's files etc.
If it claimed to be a "standard network game" then it gets different sort of access - file system access to its own "app specific data folder" in the user's home directory, access to full-screen graphics, sound _playback_ (not recording[1]), limited network access (as per requested).
If some flash applet "game" somehow requires "full administrative system privileges", go figure...
[1] Only a few apps should be allowed to record sound - stuff like skype, voice chat app for games. Your word processor should not be recording sound. The O/S should handle the voice control stuff if you like that sort of crap. And by default you may not wish to allow an app to record sound while backgrounded or just sitting in the "systray".
I've not used vista that much, but I have had the misfortune to try to install hardware under vista. I have to say that "Tinyfirewall" does a better job alterting you that program a is accessing program b. It doesn't make the distinction between something that requires administrator privilages, nor was it decent for average users that don't know what "cryptic-filename" is or does, or if it should access the net, but it was a good stop gap piece of software which took into account the fact that windows wasn't geared for security served as a useful watchdog, esp for windows it self and software which phones home and auto updates.
There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
No prob :-)
Definitely not an anything zealot (except coffee perhaps)... Each OS has it's place, it's fan/user base (same thing sometimes), and it's purpose...
StarTrekPhase2 - The Five Year Mission Continues!
Microsoft telling others how to do security is like a chicken telling Colonel Sanders how to cook.
Except that you become conditioned to WHEN the prompts arise. (Which don't happen when opening the Control Panel btw)
A lot of programs you install in Vista don't give you the prompt, others do. Some things you do in Vista give you the prompt, others don't. Those installs that are silently passed are signed or don't request to do anything dramatic to the system, and average user doesn't care why or how, he just knows it's trusted. He or she usually got that software from the site of the publisher or physical media (likely too, a publisher who is huge) and he or she knows it's safe. The prompts arise when you get into Control Panel and other aspects of the Windows system where changes could bring failure, but not when copying your personal files around. I notice I get it on my laptop when another program calls a program that isn't signed (Firefox calls an old version of Winrar, because I don't want to buy the new one, and each time it asks me if I'd like to open the file. Not only do I LIKE this, but respect it. Sygate personal firewall conditioned me to this when Firefox was opened by another program - not only does it save the time of loading some advert page, on a DVD maybe, but it kept a few pieces of malware from phoning home. Users can understand this behavior.)
The number one item that can protect the average user is if a prompt arises out of no where. If you are browsing the web and suddenly you are asked for permission to modify your system - when you've done nothing to drive the event - you aren't going to allow it. Sure, when you download and install software you may fly through that prompt, but to the new user, the normal user, you will learn right away that installing software is dangerous. In my corporate IT environment installing any software is forbidden, running software not supplied by IT is forbidden - for a reason. After clicking through a few cancel or allows you may just discriminate a little more when it comes to your actions. Is it security? Not really, but do home users really need that much? Isn't it right to tell them that making or saving a change in the Control Panel can have adverse effects? (and likewise with the other actions?)
It's hard to attack UAC completely because Linux and others have Sudo, Redhat allowed you to escalate to root privileges by simply typing the password and to most new Linux users escalating to root has become a normal exercise. There is all this talk about OS security, but it's all in the hands of the users. To deny someone the ability to take control of their own machine is barbaric - I think we all agree with that statement. We can't lock users out of taking control of those center ring privileges, unless you're the head of IT and those machines are under you "watch". You say it shifts blame, but that is where it belongs, on the user. The help is there in Vista, it spells out the concept of UAC in easy to understand terms. There is no reason a normal user can't take advantage of it. I know many people who still accept cookies on a per request basis (on today's web!) - some people actually want this feature. It doesn't work for the great majority of us, but don't kid yourself and say we aren't completely familiar with idea.
My advice for the soccer moms and grandparents: Don't turn it off. Prompting is good. This is coming from someone who has had a desktop system with the same factory install of Windows XP running since January, 2004 (I un-boxed it June of 2004). I work with what I have, and that system has not only been a workhorse for my Windows desktop software, but runs a ton of GPL software and is enhanced with Cygwin. All together I run 6 machines at home with Debian, FreeBSD, XP Pro, XP Home, Vista (aforementioned laptop) and Windows 2000 Server. Only two of those require an escalation of privileges, at the machine Everything has a place and UAC has a place with those new users going to their retail store and buying a PC for the first time. Years ago people were complaining didn't Windows have a similar mechanism.
Get your Unix fortune now!
And then we sue them.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
That is correct, not that it matters and "all or nothing" is what is described in the patent as something that the patent does not cover. (Something implemented since 1999 is not prior art either).
Let me try to make this clearer, since noone seems to understand what they've patented. Sudo, ACLs, Unix Groups, Capabilities are not what is covered in the patent. The patent does cover something like TiVo. You can be root on your machine, but you are not allowed to change the operating system. The patent does cover something like the PS3, you can install Linux and be root on your machine, but you are not allowed access to the whole system. Moreover, that is exactly the language used in the patent to describe their invention - an OEM who wishes to restrict certain privileged operations on their system from an administrating end-user.
*Sudo is specifically not covered. Sony PS3s and TiVos are.
Hope that helps.
UAC is the biggest pain in the butt to users of any software I've ever come across. Its the first thing I disable in Vista because its continuous stream of "are you sure" dialog boxes everytime you just open a file is so freaking annoying.
Jeez I REALLY hope other OS-developers are laughing hard at this and not taking Microsoft's suggestion to implement this everywhere seriously.
In Unix, you type a command, get "permission denied", and then run the command again, prefixed with "sudo".
In Windows, you type in a command, get "permission denied", and... crap. There is no "sudo". Instead, you have to find a shortcut to a command prompt, right-click and select "Run as administrator", confirm the UAC prompt, change back to whatever directory you were in, and then run the command. It's a huge pain for people who work from the command line.