94% of Microsoft Vulnerabilities Can Be Mitigated By Turning Off Admin Rights (computerworld.com)

100% of Microsoft Vulnerabilities by Anonymous Coward · 2017-02-26 06:38 · Score: 5, Funny

100% of Microsoft Vulnerabilities Can Be Mitigated By not using Windows

Re:100% of Microsoft Vulnerabilities by michaelmalak · 2017-02-26 08:25 · Score: 1

Don't forget opening Word macros from OpenOffice https://www.openoffice.org/sec...
Re:100% of Microsoft Vulnerabilities by tepples · 2017-02-26 08:31 · Score: 1

How so? If I access my Hotmail account through Firefox on a GNU/Linux PC or through the Outlook app on an Android/Linux tablet, I'm still vulnerable to any vulnerabilities in Microsoft's servers.
Re:100% of Microsoft Vulnerabilities by tepples · 2017-02-26 09:33 · Score: 1

How is Hotmail exploiting a vulnerability in your non-Windows PC?
It isn't. The vulnerability to which I refer is in Microsoft software that runs on a device other than my PC.
Hotmail goes through Microsoft's server. If the Microsoft software running on Microsoft's server has a vulnerability, the data stored on said server on behalf of its users is affected, even data stored on behalf of users who do not run an Windows operating system. Therefore, shunning Windows will not protect users from all vulnerabilities in Microsoft software.

Hotmail, really?
Unlike Google with respect to Gmail, Microsoft promises not to use the text of emails stored on a Hotmail user's behalf as part of Microsoft's interest profile on a user.
Re: 100% of Microsoft Vulnerabilities by tepples · 2017-02-26 12:09 · Score: 1

If there's one multinational corporation I trust to keep a promise, it's Microsoft.
Unless Microsoft wants to stop doing business in Europe, there's at least one organization with the power to hold Microsoft to its promises.
Re:100% of Microsoft Vulnerabilities by ctilsie242 · 2017-02-27 03:02 · Score: 1

Windows 10 Enterprise has that functionality coming up.
I do this anyway... have a VM just for running the browser under. This way, if/when it gets nuked, a rollback to a snapshot cures it. Running ad blocking software doesn't hurt either.
Re:100% of Microsoft Vulnerabilities by MerlTurkin · 2017-02-28 04:26 · Score: 1

You stole my line. Almost word for word! Nice!
Re:100% of Microsoft Vulnerabilities by Coren22 · 2017-03-01 08:23 · Score: 1

I'll just leave this here:
https://developer.microsoft.co...
It doesn't help with Chrome and Firefox, but at least it is a VMed Edge already built for you.

--
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?

Not viable on Windows 10 by Anonymous Coward · 2017-02-26 06:40 · Score: 5, Informative

as it is on macOS. On W10, for some things it will ask you to identify as an admin, and proceed, and for other things it will just fail instead, either forcing you to relog as admin, or to enable admin for your main account. They couldn't even make this work.

Re:Not viable on Windows 10 by Alcemenes · 2017-02-26 06:48 · Score: 5, Insightful

I think you hit the nail on the head right there. I've always felt the interface to gain admin on Windows has been clunky and inconsistent at best.
Re:Not viable on Windows 10 by aaarrrgggh · 2017-02-26 06:57 · Score: 5, Insightful

It is very much on par with recommending not to plug the computer in to improve security. Too much of the system still requires administrative rights for it to be viable.
Re:Not viable on Windows 10 by murdocj · 2017-02-26 07:00 · Score: 1

This sounds like BS. I used an ordinary user account on Windows 7, I'm an ordinary user on Windows 8, no problems. Hard to believe they broke it in Windows 10.
Re:Not viable on Windows 10 by The+MAZZTer · 2017-02-26 07:12 · Score: 1

Microsoft tried going further. They called it Windows RT. Nobody bought it. They're trying it again with Windows 10 Cloud. I have a feeling nobody will buy that either.
Re:Not viable on Windows 10 by MatthiasF · 2017-02-26 07:15 · Score: 1

AC is full of crap. Never had issues with Windows 10 and having a separate admin account (which is the best policy no matter the operating system).

As far as the article, I agree with Avecto's findings. On any computers I have setup for others, I have always setup a separate admin account from the working user account and made sure the latter did not have admin rights. For some people I simply made this account without a password or something very simple they could remember easily. In either case, simply requiring that extra 10 seconds of thought and the dialog not being a "yes/no" question will stop nasty stuff from happening.
Re:Not viable on Windows 10 by quonset · 2017-02-26 07:38 · Score: 1, Informative

This sounds like BS. I used an ordinary user account on Windows 7, I'm an ordinary user on Windows 8, no problems. Hard to believe they broke it in Windows 10.
They didn't. I have my dad set to a general user account on his W10 machine and he has zero issues. Every program runs perfectly, even the one in DosBox.
On those occasions something needs installed or updated, I log into the administrator account, take care of it, then log off. Not a single issue so far.
Re:Not viable on Windows 10 by tsa · 2017-02-26 08:14 · Score: 1

This. It just doesn't work.

--
-- Cheers!
Re:Not viable on Windows 10 by aaarrrgggh · 2017-02-26 08:35 · Score: 1

Generally it is an application specific issue rather than an OS issue (although the way it works in OS X basically assumes the user is an administrator). Some updates can be addressed by a domain admin, but it is still a mess with AutoDesk and Adobe products, along with many software packages that are not multi-user aware.
Re:Not viable on Windows 10 by Gadget_Guy · 2017-02-26 08:36 · Score: 3, Informative

Too much of the system still requires administrative rights for it to be viable.
That is utter nonsense. It is such a shame to see this modded as informative, because it is completely misleading.
I have use standard accounts since Windows NT 4.0. Now that was a pain, but every single version of Windows has made the process easier than the last. The biggest improvement was the UAC that prompts for the admin password when needed. Some badly written software can still cause problems like programmatically checking that the current user is an administrator and giving an error message if not. This means the UAC doesn't get a chance to kick in.
But those programs are few and far between, and you can usually manually launch the program as admin by holding the shift key down and right-clicking on the program (or just change the icon's compatibility settings to run as administrator if the program has been installed). It is incredibly rare that you ever need to actually log in using the administrator account. Temporary elevation is usually enough (the equivalent of *nix sudo).
Re:Not viable on Windows 10 by arth1 · 2017-02-26 08:38 · Score: 1

AC is full of crap. Never had issues with Windows 10 and having a separate admin account (which is the best policy no matter the operating system).
I would argue that not relying on a tie between accounts and privileges is a better policy. It may take more work to set up something like selinux and capabilities, but not a lot of malware or Oracle scripts (but, I repeat myself) can deal with that.
Re:Not viable on Windows 10 by Gadget_Guy · 2017-02-26 08:58 · Score: 1

No you're full of crap, or you're just dumb. It's one or the other.
That's very rude, and especially funny since you are wrong.

The point that was made was that you can do it if you keep switching accounts, which is cumbersome, but the convenient way of always using your regular account and only identifying as admin when needed does not work.
You don't need to switch accounts. If you are changing a system setting or installing software as a standard user, the system prompts for a password. You do not need to log out of your standard account, you just type in the password and keep working as if you had logged in as an administrator account. It does actually work, and only takes a second to type in the password. Perhaps you should actually try it yourself since you obviously don't know how the system works.
Re:Not viable on Windows 10 by tepples · 2017-02-26 09:04 · Score: 1

I have my dad set to a general user account [...] On those occasions something needs installed or updated, I log into the administrator account, take care of it, then log off. Not a single issue so far.
Can you do that remotely on the home version, or do you need to be physically present? Because if it's Saturday evening, and your city doesn't run buses on Saturday evenings or Sundays (as Fort Wayne, Indiana, doesn't), it might be a long wait before you can be present at dad's computer.
Re:Not viable on Windows 10 by jader3rd · 2017-02-26 09:28 · Score: 1

I have had the opposite experience. Once I started running on Vista I created my account and a separate admin account. I have all of my extended family doing the same. It is very much doable. The only thing that I had to run, logged in as the admin, was a diagnostic tool from Dell. Besides that UAC prompts work.
Re:Not viable on Windows 10 by jader3rd · 2017-02-26 09:31 · Score: 1

Can you do that remotely on the home version, or do you need to be physically present?

You don't need to be present. UAC prompts work through Windows Remote Assistance.
Re:Not viable on Windows 10 by Gadget_Guy · 2017-02-26 09:44 · Score: 1

What they're trying to say is that there are situations where this will not work, where Windows will not ask you for the password, but just fail instead, thus concluding that for some things your account MUST have admin rights.
And what are those unspecified situations? Because I can't think of anything right now, and especially not something that I would need to run often enough to purposefully undermine the security of my system by running as an administrator account all the time..
Re:Not viable on Windows 10 by Gadget_Guy · 2017-02-26 09:59 · Score: 1

How do you run a program as an administrator with a different account in windows 10?
If it is on the start menu right click on it, then on the pop-up menu choose "More->Run as administrator". If the program is an icon on the desktop or an executable file then right click on it and choose "Run as administrator". If you always want to run that particular program as an administrator, then right click on the desktop icon or program file and choose Properties. Under the Compatibility tab, select "Run this program as an administrator".
Re:Not viable on Windows 10 by aaarrrgggh · 2017-02-26 10:24 · Score: 1

That works for a limited set of applications, mainly for things whose rights were "broken" from standard behavior-- I can think of a few tasks in the command prompt that would fit in that gpcategory. Those changes by Microsoft were an improvement to security, hands-down.

But, about half the applications I use in Windows require administrator rights to work. Some of these center around DRM/Licensing controls, some are likely just lazy, and some are because the software was never designed for multiple user mode. With the latter category, an administrator often can "fix" the install so it works for an additional user, but only on a one-by-one approach.

So, at least for me specifically, a Windows box without admin rights ends up being as useful as an unplugged computer. I do not appear to be unique in this category.
Re:Not viable on Windows 10 by Gadget_Guy · 2017-02-26 11:55 · Score: 1

But, about half the applications I use in Windows require administrator rights to work.
You should probably name and shame those applications then, because they are the problem; not Windows.
I would add an extra reason to your list of why some programs require administrator rights: stupidity. The accounts software that we used for many years required administrator rights to run. It annoyed me because I could not see why it would be required. Upon inspection, I found a *.MANIFEST file in the install directory. It had a setting of something like userLevel=highestAvailable. I changed this to asInvoker and it no longer gave a UAC warning. It worked perfectly without those additional settings.
There is no need to shame them because they fixed this in a later version. But how stupid was it to insist that your accounting computers were more vulnerable to malware than they needed to be.
Re:Not viable on Windows 10 by AC-x · 2017-02-26 21:01 · Score: 1

and for other things it will just fail instead, either forcing you to relog as admin, or to enable admin for your main account
Right click, select "run as admin". For the few system management apps that don't prompt for admin themselves that's all you need to do. No need to relog or change permission settings.
Re:Not viable on Windows 10 by rtb61 · 2017-02-26 21:40 · Score: 1

I seems I must remind everyone. Windows 10 admin rights can not be turned off. Sure you can knock out your 'limited' admin rights but you can not shut down M$'s over arching admin rights which they demand and have basically implemented as a root kit implement, that is impossible for you to remove. So great big ole fat lie, you can not longer shut down admin rights, except your own, specifically 'limited' admin rights, as one you install windows 10, you surrender all your rights to M$.

--
Chaos - everything, everywhere, everywhen
Re:Not viable on Windows 10 by benjymouse · 2017-02-27 00:38 · Score: 4, Insightful

They can't make it work. Windows core architecture is fundamentally broken and insecure. See MS's documentation about security tokens and permissions. You can only unmask permissions since 2008R2. This means that your process starts with max permissions and is masked to reduce it. Totally unlike the authentication/authorization and security elevation process in pretty much every other system out there.
No, your process starts with a *masked* token. The security subsystem creates *two* tokens when you log in: One with all of your privileges and one where "admin" privileges has been masked out. Switching from the masked token to the unmasked token is called *elevation*.
The desktop process (explorer.exe) and any process that you launch will *by default* use the non-elevated token. This means that by default none of your user processes have admin privileges, even if you logged in using a admin account. It is understandable that someone only familiar with the Linux/Unix model does not get this at first, because Linux/Unix do not have *tokens*. The *nix model can only describe the permissions of a process through an "effective user" - i.e, a reference to an account. No token.
On Windows, each process has a security token which by default is inherited from the parent process, but may differ. This is not possible on *nix where you need to refer to some user id to describe the privileges indirectly.
An executable's manifest may indicate that the it needs certain admin privileges when executed. In that case, Windows will look up to see if your *unmasked* token fits the required privileges. If it does, Windows will prompt you for consent to use the elevated token. If you approve, the new process is launched with the elevated token that was created and stored when you logged in.

--
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Re:Not viable on Windows 10 by benjymouse · 2017-02-27 00:54 · Score: 1

What they're trying to say is that there are situations where this will not work, where Windows will not ask you for the password, but just fail instead, thus concluding that for some things your account MUST have admin rights.
Oh you mean how apt-get will fail if I forget to run through sudo? Is that a Linux problem

--
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Re:Not viable on Windows 10 by Bob+the+Super+Hamste · 2017-02-27 02:52 · Score: 1

I can think of some but that is usually really shitty software that does its own checks instead of using the OS checks. It then has a hard bail out and UAC never prompts to elevate privileges. There are a few programs that I have run into that do this but then I just right click on them and run as administrator anyway which then brings up the UAC prompt before the program starts and things work. It is most often installers of older software that have this problem and I haven't seen it in a while so I am forgetting the few that I have seen do this.

--
Time to offend someone
Re:Not viable on Windows 10 by Gr8Apes · 2017-02-27 03:27 · Score: 1

No, your process starts with a *masked* token. The security subsystem creates *two* tokens when you log in: One with all of your privileges and one where "admin" privileges has been masked out. Switching from the masked token to the unmasked token is called *elevation*.
What you describe is true for a user with admin privs. This is not privilege elevation of the type I'm discussing, where you can actually temporarily elevate a process's permissions to, for example, do 1 task as an admin and then drop back into normal priv level for the remainder. This used to be possible in windows prior to the 2008R2 release, albeit somewhat clunky and difficult. It is still possible if you drop into serious hacking, but you'll be working around system processes to do so. The recommended workaround is to use a separate process launching process to create a new process with the appropriate permissions, execute your task, and then said process ends.
Note that my processes that I'm discussing have significantly less than regular user permissions. I don't run wide open like a regular windows user.

--
The cesspool just got a check and balance.
Re:Not viable on Windows 10 by michael_wojcik · 2017-02-27 07:45 · Score: 1

I have use standard accounts since Windows NT 4.0.
Same here. In fact, I think it was even possible to do this in NT 3.5, though if memory serves only console-mode applications could be elevated in that release, and even that required a third-party utility (unless you wanted to write one yourself).
Re:Not viable on Windows 10 by elfprince13 · 2017-02-27 08:21 · Score: 1

I've even had stuff where it asked me for admin credentials and then still failed.

only one problem.. by Anonymous Coward · 2017-02-26 06:42 · Score: 1

the way the MS system is designed: having no admin rights = a computer that's basically a paperweight.

Re: only one problem.. by Anonymous Coward · 2017-02-26 07:16 · Score: 1

Lol. Guess you never worked at a company that uses windows. See they have this thing called a domain. And the windows pc is joined. Then they have this thing called a user. They let employees have this. Then when developers like me want to install anything I have to ask fuck face neck beard to do it.
But no vulnerability... besides the back of fuck face neck beards skull from the large pc case crushing it.
Re: only one problem.. by haruchai · 2017-02-26 13:32 · Score: 2

Lol. Guess you never worked at a company that uses windows. See they have this thing called a domain. And the windows pc is joined. Then they have this thing called a user. They let employees have this. Then when developers like me want to install anything I have to ask fuck face neck beard to do it.
But no vulnerability... besides the back of fuck face neck beards skull from the large pc case crushing it.
We have an AD domain & ~10,000 users 95% of whom don't have admin rights. But judging by the number of malware infections and re-imaging I see reported, they seem to be really, really good at finding the 6% of cases where Windows without admin rights doesn't work.

--
Pain is merely failure leaving the body

Great if.. by Anonymous Coward · 2017-02-26 06:45 · Score: 1

The company buys into this and supports implementing a system of packaging and deploying applications are updated in the background or that users can request and install with our being prompted for an admin user. And setting up processes and procedures for users to request non standard apps, have it approved, and can call a helpdesk to who can then remote desktop the system and type in an admin login to get it installed.

I've worked at one company that did this, and it worked well because they set out to do this properly. Every other place I've worked puts this into the too hard basket, and users are made local admins.

Also in the news by Opportunist · 2017-02-26 06:47 · Score: 4, Insightful

94% of all programs won't run properly without those rights.

Unfortunately for the longest time developers for Windows got away with not giving half a shit about security. To make matters worse, when MS finally decided to tighten the screws, they went overboard by a long shot. You cannot even install a simple program without elevated rights.

And to make matters worse, "elevated" means "full access, anywhere". There is no granularity, it's only "can't do jack shit" or "total control". You cannot open up the program files to install a normal program without also giving that program the ability to drop a low level driver into your system.

Then again, if that worked, a lot of people would probably notice just WHAT kind of crap their beloved games barf into the deeper intestines of their computers for the sake of the all holy DRM.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.

Re:Also in the news by Anonymous Coward · 2017-02-26 07:01 · Score: 1

I don't know if Adobe does it still... but at one point they were using "extra space" in the MBR to store part of their DRM...
It isn't just games that go overboard with DRM
Re:Also in the news by murdocj · 2017-02-26 07:03 · Score: 1

Nonsense. I run as an ordinary user and I rarely have to run anything as admin. Games don't require admin.
Re:Also in the news by HuskyDog · 2017-02-26 07:05 · Score: 2

My wife's PC and my daughter's Mac both operate on the principle that they only have user accounts and I have access to a separate Admin account for doing things like adding software. Neither of them has ever experienced a problem which could be solved by giving their accounts higher privileges. Perhaps we have been lucky, or perhaps their requirements are modest.
Re:Also in the news by KiloByte · 2017-02-26 07:05 · Score: 5, Insightful

Hell yeah. Especially browsers have never, ever a reason to run as root.
-rwsr-xr-x 1 root root 18768 Feb 19 21:17 /usr/lib/chromium/chrome-sandbox

--
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Re:Also in the news by robmv · 2017-02-26 07:23 · Score: 1

It is true on the consumer side, they try at least to follow the minimal requirements to be a good Windows application. the business world on the other side is awful. Applications that don't work if you install on Program Files, that you need to add write permissions to the installation directory, or that need read write permissions on server shares. This is too common on small business targeted applications that I have lost count on the ones I have seen.
A lot of Windows developers have no idea what %appdata% and %localappdata% are (and related directories with user write permissions.
Re:Also in the news by tomhath · 2017-02-26 07:57 · Score: 1

At least a few companies tried that. Needless to say, the conflicts caused all kinds of problems.
Re:Also in the news by murdocj · 2017-02-26 07:59 · Score: 1

Hmmm... I'll just say that back in the 1990s I was worked on an end to end full suite of apps in a particular industry, and I recall going thru the work THEN to make sure that everything worked as an ordinary user, because we had a major customer who didn't want to give its users admin rights. I'm having trouble believing it's still the norm to hand out admin, or that there are a lot of applications that insist on installing in particular directory. But maybe I've led a sheltered life.
Re:Also in the news by Kaenneth · 2017-02-26 08:45 · Score: 1

Windows Store apps can have granular control...
Re:Also in the news by LinuxIsGarbage · 2017-02-26 08:47 · Score: 2

I'm pretty sure with Vista, 10 years ago, where there was the push to run users as non-elevated, a lot of developers smartened up.
Re:Also in the news by AmiMoJo · 2017-02-26 09:13 · Score: 3, Informative

"94% of all programs won't run properly without those rights."
This has not been true since Vista.
Vista introduced virtualization for the filesystem and registry. Apps would think they had admin rights, when in fact they were sandboxed and contained.
These days most apps run fine without admin rights. You can install them and run them without any special access. Older apps that attempt to access protected paths like Program Files and the registry actually write to special per-user and per-app hives.
If an app really needs admin rights you get the dreaded UAC prompt.
This is why Vista was so painful. Too many UAC prompts, the virtualization was slow... But it was necessary.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Also in the news by tepples · 2017-02-26 09:21 · Score: 4, Insightful

Games don't require admin.
Unless they use third-party digital restrictions management.
Re:Also in the news by Gadget_Guy · 2017-02-26 09:25 · Score: 3, Informative

You just have to click the fucking yes button, you don't even need to enter your password.
That only works if you have an administrator account. Standard users do have to type in a password.
Re:Also in the news by Anonymous Coward · 2017-02-26 09:50 · Score: 1

This.
It really hit the fan a long time ago with games like Runaway which installed a DRM driver which caused the PC to crash. Absolute POS.
If people could actually see and understand what installers did to their pc they probably would not instal half the software. I certainly don't on my phone when the permissions are excessive. A web browser needing the ability to create and modify accounts on a phone? Geez.
Re:Also in the news by Gadget_Guy · 2017-02-26 17:51 · Score: 1

You fucking moron. Standard users don't have admin credentials. OF COURSE THEY HAVE TO TYPE ADMIN CREDENTIALS IN.
Did you even read the part that I quoted from the grandparent, which said that you didn't need to type the password in? Obviously not. It's kind of weird that you call me a moron because I am correct.
Re:Also in the news by prunus.avium · 2017-02-27 03:02 · Score: 1

Depends on the game. Standalone installers usually require admin to install but then you can play as a normal user. The trouble is that most of the games my kids like to play are online so require updates.
Also, some of the online games require elevated access to handle the network connections.
Re:Also in the news by michael_wojcik · 2017-02-27 07:57 · Score: 1

94% of all programs won't run properly without those rights.
Bullshit. I wish rubbish like this wouldn't keep getting modded Informative.

You cannot even install a simple program without elevated rights.
Many programs can be "installed" without elevation, by avoiding the MS installation model and secured parts of the filesystem tree. There's a huge range of Windows software that's packaged as a simple zipped executable. Microsoft even has some - most or all of the SysInternals collection, for example.

And to make matters worse, "elevated" means "full access, anywhere". There is no granularity, it's only "can't do jack shit" or "total control". You cannot open up the program files to install a normal program without also giving that program the ability to drop a low level driver into your system.
There's plenty of granularity. You just have to know how to manage it. Security policies and group policies, for a start. And programs can drop privileges they don't need.
Look, I'm perfectly happy to admit that Microsoft hugely bungled the permissions model from the original NT 3.1 release on up. The underlying thread-token-and-permission mechanism isn't bad, and has a lot more granularity than the classic UNIX one.[1,2] But with the initial release they made it essentially unusable. NT 4 made it usable but pretty much only for determined experts, and meanwhile they continued with the Win32-based line of completely insecure customer OSes and let stupidly insecure software flourish. It wasn't until Vista and UAC that they started to get things out of control, and then they had both a user base and a software base that were utterly unsuited for it.
But it does no one any favors to pollute the discussion with myths and half-truths.
[1] Not including the various attempts to introduce fine-grained privileges into UNIX, which go back to at least SVR4, and have in some cases had some success.
[2] Mind you, some of the privileges are still mind-bogglingly stupid. You need SeDebugPermission - which is local-admin-equivalent - to be alerted when another process exits, for example.
Re:Also in the news by KiloByte · 2017-02-27 08:22 · Score: 1

-rwsr-xr-x 1 root root 18768 Feb 19 21:17 /usr/lib/chromium/chrome-sandbox
Bit wrong on this one. The binary is "owned" by root.
And thus, via the setuid bit, a process that execs this file gets full root privileges.

You as a user only have read/execute rights the second set of permissions "-xr" and then "everyone" "-x".
Eh? What "-xr", what "-x"? The permissions are: group "r-x" which doesn't matter as you don't belong to group root and the file isn't setgid, and others "r-x" so you can execute it.

This doesn't mean the file runs as root.
That's exactly what setuid means. The process can then shed its privileges, but a browser shouldn't need them in the first place.

--
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.

Turn it off by krray · 2017-02-26 06:49 · Score: 3, Insightful

I found it a whole lot easier to just turn Windows off.

Re:Turn it off by OzPeter · 2017-02-26 07:09 · Score: 1

I found it a whole lot easier to just turn Windows off.
I prefer to get paid.

--
I am Slashdot. Are you Slashdot as well?
Re:Turn it off by nnull · 2017-02-26 09:33 · Score: 1

From a regular Linux user, yes this is a problem. Trying to figure out why things don't work is quite a pain in the ass when you don't have the time to deal with it. That's one thing Microsoft certainly has everyone beat where every hardware you buy will most likely work with little to no tinkering. Unfortunately, this problem will continue on for quite a while. Displayport is another hassle especially when you want 4k and audio in Linux which I think is still very broken in Xorg.
Re:Turn it off by swillden · 2017-02-26 10:15 · Score: 3, Insightful

I've spent this weekend trying to repurpose an old laptop as a media/streaming machine, and decided to go Linux rather than Windows. It most certainly has not been easier. Maybe if you've worked with the system for years and know the ins-and-outs it is second nature, but Linux has caused all sorts of issues I wouldn't have had on Windows.
If you've worked with Windows for years and know the ins-and-outs of that system, it's a lot easier to set Windows up than something else. Personally, when I have to set up a Windows system, I have a lot of issues I wouldn't have on Linux.
I know because I had to install a Windows system for the first time in about a decade a few months ago. It took me all day and lots of hair-pulling to figure out how to find and install all of the drivers needed to make the thing run. At the end I was still left with a few devices showing errors in the device manager, which I was simply unable to get working. It worked enough, so I gave up on the rest. The worst part of the process was that right after installation Windows had no functioning drivers, for ethernet, Wifi or USB, which made it really hard to get drivers onto the box. I solved this by booting a Linux LiveCD (which worked out of the box), creating a small FAT32 partition, downloading the ridiculously bloated 250MB (WTF?!?) ethernet driver onto it, then booting Windows again and installing from the FAT32 partition. I have no idea how a Windows guy would have solved that.

--
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Re:Turn it off by Raenex · 2017-02-26 11:19 · Score: 1

One question I keep asking myself is why there are a zillion ways to do everything in Linux.
Because it's an open ecosystem.
Re:Turn it off by AmiMoJo · 2017-02-26 20:56 · Score: 1

I have no idea how a Windows guy would have solved that.
You can make a Windows live CD (called Windows PE). It's rarely necessary though.
It sounds like the version of Windows you were trying to install was not officially supported by your hardware. If it was, drivers would not have been a problem. Since Windows 7 they have included drivers for contemporary chipsets on the disc, which are usually enough to net network access and download the officially supported ones from Windows Update or the manufacturer's website.
For your scenario. downloading the drivers onto a USB flash drive is usually the simplest option. In a pinch you can download on your phone and simply connect a USB cable to the computer, or the flash drive to the phone. Obviously doesn't work with Apple phones, only Android and Windows.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Turn it off by swillden · 2017-02-27 03:14 · Score: 1

I have no idea how a Windows guy would have solved that.
You can make a Windows live CD (called Windows PE). It's rarely necessary though.
It sounds like the version of Windows you were trying to install was not officially supported by your hardware.
I was installing a purchased copy of Win7 on a machine that came with Win10, because the tools I needed to use (for which I purchased the machine) only run on Win7. Of course, the vendor of said tools didn't bother to document that anywhere.

For your scenario. downloading the drivers onto a USB flash drive is usually the simplest option. In a pinch you can download on your phone and simply connect a USB cable to the computer, or the flash drive to the phone.
As I said in my post above, Windows didn't have drivers for the USB controller. USB was not available.

--
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Re:Turn it off by dbIII · 2017-02-27 03:53 · Score: 1

Displayport is another hassle especially when you want 4k and audio in Linux which I think is still very broken in Xorg
Why do you think that? A lot of people seem to be using it without any problems. Have you actually heard of someone with a current problem or are you just dredging up stuff from back when the hardware was under development?
Re:Turn it off by AmiMoJo · 2017-02-27 05:07 · Score: 1

Yep, that's the problem, Windows 7 on a machine designed for Windows 10. Microsoft require basic stuff like USB to work for the computer to carry the "designed for Windows" sticker, but of course only the version that it ships with.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Turn it off by swillden · 2017-02-27 14:22 · Score: 1

Yep, that's the problem, Windows 7 on a machine designed for Windows 10. Microsoft require basic stuff like USB to work for the computer to carry the "designed for Windows" sticker, but of course only the version that it ships with.
You say that as though it makes sense. I installed a several-year-old copy of Debian Linux on the same machine without trouble. The USB controller chipset is newer than that old kernel, for example, but the generic controller drivers in the kernel work fine.

--
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Re:Turn it off by AmiMoJo · 2017-02-27 20:44 · Score: 1

Because a several year old Debian install must support UEFI or the UEFI must enable legacy mode for it in order to support the USB chipset. Windows 10 boots up faster by making full use of UEFI, which Windows 7 only has very minimal support for (remember it was released in 2009, nearly 8 years ago).
Can you really expect an 8 year old OS to support the latest USB chipset out of the box? Does the manufacturer even supply Windows 7 drivers that you could burn to CD and install?

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Re:Turn it off by swillden · 2017-02-28 03:45 · Score: 1

Can you really expect an 8 year old OS to support the latest USB chipset out of the box?
Seems reasonable to me. Perhaps not full support, but enough to talk to a mass storage device seems very reasonable. It's not like this is a rapidly-evolving space.

Does the manufacturer even supply Windows 7 drivers that you could burn to CD and install?
Yep.

--
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Re:Turn it off by AmiMoJo · 2017-02-28 05:03 · Score: 1

The new chipset is probably USB 3.0, which is quite different to USB 2.0 and which is not supported by Windows 7 out of the box. Drivers can support some of it, particularly higher speed transfers, but native support was only added to Windows 8 and beyond. That includes stuff like the new mass storage modes that boost throughput.
It's a trade-off. You can pay more for a chipset that has a USB 2.0 compatibility mode to work with the basic drivers in Windows 7, or you can pay less for one that doesn't. Of course they don't make this clear on the box and the former choice isn't actually available due to low demand.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC

if apps had rights to there own folder then by Joe_Dragon · 2017-02-26 06:56 · Score: 1

if apps had rights to there own folder / reg keys then there would be less of an need for admin.

For some apps storing stuff per user can lead to a lot of space used and a lot stuff being downloaded more then 1 time. Also makes it a pain for updates.

This can be an issue with games with user maps / mod and A lot of games have built in downloads for them.

Video and other drives have there own updates. The windows ones can lack the control apps.

Re:if apps had rights to there own folder then by vux984 · 2017-02-26 07:13 · Score: 4, Interesting

if apps had rights to there own folder / reg keys then there would be less of an need for admin.
Maybe.

For some apps storing stuff per user can lead to a lot of space used and a lot stuff being downloaded more then 1 time. Also makes it a pain for updates.
Windows has %appdata% folders (c:\
programdata ) for 'stuff' (files, settings, databases,...) that is shared between all users.

Video and other drives have there own updates. The windows ones can lack the control apps.
This area is a complete minefield... i mean, these days geforce experience requires a sign in, as do the drivers for a razor mouse etc... that whole part of the ecosystem is pretty toxic.
Re:if apps had rights to there own folder then by Gadget_Guy · 2017-02-26 10:07 · Score: 1

if apps had rights to there own folder / reg keys then there would be less of an need for admin.
This feature was implemented with Vista. To work around those badly written programs that assume that they can write to their installation folder or LOCAL_MACHINE registry, Microsoft implemented File and Registry Virtualization. If an application opens a file in read/write mode under Program Files, then a copy of that file is made in %APPDATA% and this file is used instead.
This was only intended for old programs, and it only works for 32bit applications. It is assumed that 64bit applications are modern enough to know where they should place configuration files and such.
Re:if apps had rights to there own folder then by haruchai · 2017-02-26 13:42 · Score: 1

This was only intended for old programs, and it only works for 32bit applications. It is assumed that 64bit applications are modern enough to know where they should place configuration files and such

And that seems like a very bad assumption to make. I wonder how long before Microsoft realizes this and implements it for 64bit apps too

--
Pain is merely failure leaving the body
Re:if apps had rights to there own folder then by RyoShin · 2017-03-02 12:13 · Score: 1

these days geforce experience requires a sign in,
This seems to be avoidable, at least in the interim. Google "geforce experience avoid upgrade" or some such; I found a Youtube video that directed you to an Upgrade (Update?) folder, from which you rename or delete an EXE, and then the old version places nice again; no sign-in needed, and as far as I could tell I still downloaded the latest driver.
If you've already upgraded you can uninstall and put the old version back (the comments had links to "official" Nvidia installers, but other comments suggested these actually installed the latest version so you might have to roll the dice with "old version" file hosts.)
Re:if apps had rights to there own folder then by vux984 · 2017-03-02 13:29 · Score: 1

I just bought a logitech mouse that doesn't require an account; and uninstalled geforce experience. It doesn't do anything I need anyway; not enough to put up with (or fight with) its bloated nonsense.

Chrome updates from the about menu need admin by Joe_Dragon · 2017-02-26 07:00 · Score: 1

Chrome updates from the about menu need admin but it does have an background auto update that works without admin.

Firefox has auto and about menu works without admin.

I've often wondered about this. by HuskyDog · 2017-02-26 07:01 · Score: 1

I have always managed my wife's PC (Win 2000, then XP, then 7 and now 10) by having non-admin accounts for each family member and a separate Admin account which I use only for installing applications (having where possible downloaded them using my personal account). I did this because it seemed sensible and is the way Linux works but was always rather mystified that it was never mentioned in any of the "How to make your PC more secure" articles which appear in the popular media.

I wondered if for some reason it wasn't as much of a protection as it appeared, but it now seems that I have been doing the right thing all along (phew) and that it is indeed a mystery why it isn't mentioned more often.

I should add that so far as I am aware my wife has never experienced any problems as a result of this policy (which I also apply BTW to my daughter's Mac).

This arrangement is also how the PCs at work are controlled with the added restriction that none-approved executables will not run at all. If I want to programme or have admin rights then I need to use a VM behind a substantial firewall.

Vulnerabilities vs infections by Artem+S.+Tashkinov · 2017-02-26 07:09 · Score: 1

I haven't read the article, my bad, my I guess it's not talking about vulnerabilities but about various malware which indeed in most cases requires admin rights to be properly installed.

However a great number of modern viruses live under various hidden directories in the user's profile, e.g. C:\Users\User\AppData\Roaming, so Admin Rights or not but you will be successfully infected.

The real problem with Windows is that most users blindly trust whatever .exe/.pdf/.docx/.xlsx files they receive from absolute strangers and they don't associate them with threats. Microsoft is trying hard to solve this problem by migrating to an app model which is used by Android and iOS but it just cannot work with Windows for far too many reasons, the primary two are of course compatibility and UWP limitations. It can be solved by a new OS which won't be called Windows but Microsoft just doesn't have the guts for that.

Re:Vulnerabilities vs infections by Artem+S.+Tashkinov · 2017-02-26 09:53 · Score: 1

Windows since Windows Vista makes your user a non administrator by default, unless you 1) disable UAC completely or 2) specifically enable the Administrator account and log under it.
I guess I'll have to read the article because something feels wrong about it.
Re:Vulnerabilities vs infections by Anonymous Coward · 2017-02-26 10:00 · Score: 1

I'd argue they're still administrators, just with UAC gating the admin requirements. Problem is people are so used to clicking yes that they don't think about it. Many wouldn't understand what it does either. If one opens a "word document" and it prompts for admin escalation, how many would think "since when do word documents need admin privs, perhaps I better not run it" vs "yes, yes just go away and show me what it is".

Hiding the real point by Anonymous Coward · 2017-02-26 07:10 · Score: 2, Insightful

The real point of this story is that by disabling admin rights Microsoft can pretend to the world that their products are not the least secure in their respective classes.

Of course it completely fails to address the fact that unless you only want to do very simply things on a computer, admin rights are frequently required.

Re:Duh? by TechyImmigrant · 2017-02-26 07:24 · Score: 5, Insightful

Who runs with full admin rights?

Define 'full'.

I run with admin rights on my Windows 10 machine because it's the default and it's a pain in the neck to run without. "Sorry you don't have permissions to set the clock".

--
I should use this sig to advertise my book ISBN-13 : 978-1501515132.

Re:Duh? by Gadget_Guy · 2017-02-26 07:38 · Score: 4, Informative

I run with admin rights on my Windows 10 machine because it's the default and it's a pain in the neck to run without. "Sorry you don't have permissions to set the clock".

Have you also turned off UAC prompts? Because when I set the time it prompts me for the admin password and it works fine. I don't ever see the message that I don't have permissions to set the clock; I just see the icon on the button to set the time which shows that it will perform an elevation (prompt for password) to run it.

We knew that almost two decades ago... by Anonymous Coward · 2017-02-26 07:38 · Score: 2, Informative

when I worked at Microsoft. We talked about ways of protecting users, but the rumor was that it was killed because so many people buy new computers instead of fixing ones that have a Microsoft-created problem. Viruses are very profitable to Microsoft.

Re:We knew that almost two decades ago... by Anonymous Coward · 2017-02-26 08:25 · Score: 1

Can confirm. Worked at a computer store for nearly seven years. Many people just buy a new computer when Microsoft's Windows starts running poorly. Creating problems with Windows makes a lot of money for Microsoft.
Re:We knew that almost two decades ago... by ruir · 2017-02-26 15:49 · Score: 1

Apparently they are very profitable to Apple too.

Re:Duh? by bmorency · 2017-02-26 07:43 · Score: 2

one thing I run into is that I install a program for a user and it will create a desktop icon. For some reason windows will ask for the admin password to delete it. Why does windows ask for the admin password to get rid of an icon?

Re:Duh? by Anonymous Coward · 2017-02-26 08:02 · Score: 1

The desktop shows the contents of two folders. It shows your personal desktop at "%userprofile%\Desktop", which you can add and remove icons and files from freely, and it shows the contents of "C:\Users\Public\Desktop" which needs admin rights to create or modify stuff by default since it affects all the users. The stuff that needs an admin password to remove is in the public desktop and is shown on the desktops of all users.

Re:Duh? by Gadget_Guy · 2017-02-26 08:10 · Score: 4, Informative

Why does windows ask for the admin password to get rid of an icon?

Because those icons are stored in the shared desktop folder (default: C:\Users\Public\Desktop). Any file or icon here will be visible on the desktop of every user. If you shared a computer with other users, then you might not want the other people to be able to edit the icons that appear on your desktop because they could alter them to run malicious software instead. If you ran a program where you needed to login with a password, then they could write their own mock version of the software that logs the passwords and change the desktop icon to run it instead.

If you don't share the computer with other people, then you could grant write permission on the shared desktop folder to all users. Then you could delete and update automatically created icons to your heart's content.

Re:Duh? by tsa · 2017-02-26 08:14 · Score: 2

Me too. It's just too much of a hassle to switch admin rights off. Maybe it's better now but knowing MS it will not have changed much since 2000 when I tried using my computer as a normal user. "You can only run that program in administrator mode," it would tell me, or it would just refuse to do the simplest things. I gave u in frustration. I do use my Mac as a normal user, which works fine. It only asks for administrator passwords when doing administrative things like installing programs and changing global settings.

--

-- Cheers!

Re:Duh? by TechyImmigrant · 2017-02-26 08:36 · Score: 1

Why does windows ask for the admin password to get rid of an icon?

Because those icons are stored in the shared desktop folder (default: C:\Users\Public\Desktop). Any file or icon here will be visible on the desktop of every user. If you shared a computer with other users, then you might not want the other people to be able to edit the icons that appear on your desktop because they could alter them to run malicious software instead. If you ran a program where you needed to login with a password, then they could write their own mock version of the software that logs the passwords and change the desktop icon to run it instead.

If you don't share the computer with other people, then you could grant write permission on the shared desktop folder to all users. Then you could delete and update automatically created icons to your heart's content.

Or you could run with admin rights.

--
I should use this sig to advertise my book ISBN-13 : 978-1501515132.

That's nothing! by Gravis+Zero · 2017-02-26 08:36 · Score: 1

You can mitigate 100% of Microsoft vulnerabilities by not using Microsoft products! ;)

--
Anons need not reply. Questions end with a question mark.

Re:That's nothing! by ruir · 2017-02-26 15:48 · Score: 1

it should be pretty obvious but many people are just .... brainwashed.

Re:Admin? by tepples · 2017-02-26 08:40 · Score: 2

Both Windows and GNU/Linux separate "running as root" from "running as a member of the wheel group". Even if you're a member of the wheel group (which may be called Administrators under Windows or sudo under GNU/Linux), you still need to elevate in order to do any tasks that require superuser privileges. But perhaps creating two accounts, one in wheel and the other not, and doing work other than software installation as the user not in wheel would make it harder to social-engineer users into elevating.

Re:Duh? by TechyImmigrant · 2017-02-26 08:41 · Score: 1, Informative

I run with admin rights on my Windows 10 machine because it's the default and it's a pain in the neck to run without. "Sorry you don't have permissions to set the clock".

Have you also turned off UAC prompts? Because when I set the time it prompts me for the admin password and it works fine. I don't ever see the message that I don't have permissions to set the clock; I just see the icon on the button to set the time which shows that it will perform an elevation (prompt for password) to run it.

That was an exaggeration for emphasis. I could be more specific.. On a work laptop, I can write to my 'c:\Users\\Documents' folder, but if I try to access it via the various shortcuts on the left of the file manager, I am denied access. No UAC, even though I have the password for that. The permissions on the thing vary based on the path you access it by? That's messed up.

--
I should use this sig to advertise my book ISBN-13 : 978-1501515132.

Re:Admin? by Alain+Williams · 2017-02-26 08:41 · Score: 1

Even on my Linux boxes I do not run my web browser or email client as root. To do so is just asking for trouble - even on a Unix system.

Re:Duh? by tepples · 2017-02-26 08:43 · Score: 1

Likewise, GNU/Linux has kernel mode setting and the Direct Rendering Manager.* Isn't that also part of the GUI in the kernel?

* The latter happens to share initials with something more sinister.

Re:Duh? by Gadget_Guy · 2017-02-26 08:49 · Score: 2

Maybe it's better now but knowing MS it will not have changed much since 2000 when I tried using my computer as a normal user.

What? Have you not heard about the User Account Control (UAC) that was implemented with Vista? It does exactly what you described happens on the Mac:

It only asks for administrator passwords when doing administrative things like installing programs and changing global settings.

Yep, that's exactly what Windows does. They really have done work on Windows in the last 17 years!

Re:Just to be clear what that means by arth1 · 2017-02-26 08:49 · Score: 1

Most Windows vulnerabilities can be mitigated by removing admin rights.

Most vulnerabilities can be mitigated by removing ignorant users.

The other 6% by Hognoxious · 2017-02-26 09:12 · Score: 1

The other 6% can be eliminated by not turning the machine on. And the good news is you'll get almost as much work done.

--
Confucius say, "Find worm in apple - bad. Find half a worm - worse."

Re:Duh? by Gadget_Guy · 2017-02-26 09:15 · Score: 2

That was an exaggeration for emphasis. I could be more specific.. On a work laptop, I can write to my 'c:\Users\\Documents' folder, but if I try to access it via the various shortcuts on the left of the file manager, I am denied access. No UAC, even though I have the password for that. The permissions on the thing vary based on the path you access it by? That's messed up.

That's not an account type issue; something is seriously borked on your system. That doesn't happen normally even if you are a standard user. It sounds like the user folders have been moved, but the icons haven't been updated to reflect this. (It's possible that something like OneDrive has fiddled with the folder locations).

I assume that you are talking about the Quick Access section. If I were you I would right click on those folders and select "Unpin from Quick Access". Then browse to the folders and click on "Pin to Quick Access" in the Home ribbon to recreate the list. That should fix the problem.

horseshit by Lehk228 · 2017-02-26 09:16 · Score: 1

94% of the bad shit that will happen will happen with or without admin rights. who cares if your windows install is ok when cryptolocker is holding all your tax files from the last decade ransom for $500 bucks worth of bitcoin or your bank login credentials get stolen as you log in.

--
Snowden and Manning are heroes.

Re:horseshit by jbmartin6 · 2017-02-27 02:15 · Score: 1

This. 99% of the known vulnerabilities are mitigated, sure. The other 1% are the vulnerabilities that attackers are actually using.

--
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.

Re:Duh? by Gadget_Guy · 2017-02-26 09:17 · Score: 1

Or you could run with admin rights.

But that would be stupid considering how vulnerable your system would be (given the topic of this /. story).

Yeah, well by Anonymous Coward · 2017-02-26 09:24 · Score: 1

100% of Microsoft Vulnerabilities can be mitigated by turning the machine off. That doesn't make it a reasonable fix.

Making the machine less useful because it can't be both useful and secure at the same time isn't a win.

RUNAS helps with some apps by schwit1 · 2017-02-26 09:27 · Score: 1

I put C:\Windows\System32\runas.exe /trustlevel:0x20000 before some apps to have them run as a basic user.

[c:]runas /showtrustlevels
The following trust levels are available on your system:
0x20000 (Basic User)

This works for firefox and outlook and some others. Chrome and slack fail.

No Visual Studio RT by tepples · 2017-02-26 09:27 · Score: 1

Microsoft is trying hard to solve this problem by migrating to an app model which is used by Android and iOS but it just cannot work with Windows for far too many reasons

Probably the same reason it doesn't work with iOS. You can't develop apps on an iPad Pro with keyboard and Apple Pencil because Xcode works only on a Mac. Likewise, you can't develop apps on a Surface 1 or 2 because Microsoft never released Visual Studio RT. (You can on Surface Pro and Surface 3 because those run full Windows.)

Re:Admin? by minstrelmike · 2017-02-26 09:34 · Score: 1

What I found most interesting is that I _cannot_ load most linux software as a non-root user, even tho that is recommended. seems like there's always some package that wants to be root. It's actually gotten better over the years. I know I read a lot of bragging about how much more secure linux was but it seemed as if every software package I loaded needed to be root which made me think all those "developers" were just running as root and hoping to stay lucky.

Re:Duh? by tsa · 2017-02-26 09:46 · Score: 1

Oh that's interesting. I will try it out tomorrow. Thanks!

--

-- Cheers!

Re:Admin? by Alain+Williams · 2017-02-26 09:51 · Score: 1

Eh ? I don't understand. To install software (is that what you mean by ''load'') you generally need to become root for a short while since you typically need to create files in /usr/bin/ & similar. This is very different from the program needing superuser privileges in order to run -- only a very few do. Most packaged software needs to be installed with superuser privileges but if, however, you build it yourself you will run ./configure and can put the software almost anywhere - usually.

Re:Duh? by Gadget_Guy · 2017-02-26 10:13 · Score: 1

When you make the decision to use windows, you are accepting that you are vulnerable.

But if you can make yourself 94% less vulnerable, it makes sense to do this. I wouldn't run as root/administrator as my general purpose account on ANY operating system. I also would not assume that ANY operating system would make me invulnerable.

Re: Duh? by bmorency · 2017-02-26 10:34 · Score: 1

Why can't windows just make a link to that icon and change the permissions on the link it makes on the users desktop so the user can do anything they want to that link and not touch the icon in the shared folder? That way they can delete it if they want.

wtf does it mean to turn off admin rights by 0111+1110 · 2017-02-26 10:55 · Score: 1

Is there like a switch? An "Admin Rights" checkbox somewhere? Maybe not a bad idea but I haven't seen anything like that. Did I just miss it? I'm still using Windows 7 so maybe this switch is a new feature in Windows 10. If the author meant that a user should run as Standard (unprivileged) User and not as an Administrator then maybe he should have said that. It is not as simple as just turning something on or off. If you are running as an Administrator you would probably want to actually create a new standard user account and start using that and that may require reinstalling some of your applications.

I'm guessing the guy who wrote that article doesn't use Windows and so does not realize that it just doesn't work that way. One of the greatest advantages of Windows 7 over XP was the relative ease of running as non-admin and a lot of software had to be changed to allow for the possibility that a user might be running it without full admin rights. I'm sure there is still some older software (games for instance) that require full admin privileges to run, but you can just switch to an admin account to run those.

Unfortunately for me the VPN that I use has software that appears to run only from a full admin account. "Run As Admin" doesn't even work with it. So there is still some (bad) software out there that expects full admin rights unfortunately.

I guess it shouldn't need to be pointed out that Microsoft is one of the worst software companies out there and pretty much everything they do is wrong/stupid. Their attempt at getting Windows to work hassle free as a standard user was not a complete success. That people running as Admin is still a problem just highlights this.

--
Quite an experience to live in fear, isn't it? That's what it is to be a slave.

Did Cortana tell you this? by TheOuterLinux · 2017-02-26 11:00 · Score: 1

She's schizophrenic. She hears and sees things that aren't there. Actually, she really just sees and hears everything. Just like woman, loves gossip and tells you it's ok not be in charge. No more "Sudo make me a sandwich" jokes. Sorry Cortana, but my man Tux (Linux) is sexy as hell and does anything I ask and isn't all up in my business 24/7.

Check bank / cc statements by raind · 2017-02-26 11:20 · Score: 1

Bitch if something is not authorized
-have good backups when ransomware comes in
-enjoy

--
Get up!

Re:Duh? by Gadget_Guy · 2017-02-26 11:45 · Score: 1

I'm sorry, but I think that is completely wrong. Exactly how does Windows starting with maximum permissions actually manifest as a real world example?

If you start with a basic account, you don't have to whittle away its rights; it is low by default. If you want it to be a higher access account then you add it to the Administrators group. Then it inherits the additional permissions. This is the opposite of what you described.

Where you might be getting confused is that the permissions system allows for both Allow and Deny settings, but it is extremely rare to see Deny being used. For an example of how Deny works, if you wanted to create an account that could install software, but not edit the firewall settings, you would add the Administrators group to the account and then Deny edit rights to the firewall. Deny is only useful AFTER you have raised the account's permissions from the default low settings.

Good policy, if you can live with it .... by King_TJ · 2017-02-26 12:50 · Score: 1

I've been doing this for a while now with my daughter's Windows 10 PC. She's running as a "standard" user account that prompts for my admin account's assigned PIN code when it needs elevated rights for an action.

It's FAR more functional than an arrangement like this would have been with an older version of Windows like 7 or XP. But it's not perfect. One of the problem she's had is that she's gotten interested in modding games (Minecraft is a good example, as all the serious players use custom texture packs and other modifications so specific servers they want to connect to will let them properly view/play customized levels other people created with the additional tools and patches.) These mods quickly start requiring admin rights to the machine to get them installed properly.

I've also just found it annoying how often I have to provide the admin PIN code to allow updates to go through for various things. Malware Bytes anti-malware software is one example, as are the regular updates pushed out for the Java JRE and the nVidia video driver updates.

For our corporate Windows users in our office, I don't think we could live with taking away their admin rights either. Technically, we *might* be able to do a lot of tedious configuring of more advanced permissions (using "print administrators" security rights and all of that) to get around a lot of their problems. But it's a lot of hassle to still inevitably hit "roadblocks" where something unexpected needs those admin rights to update, install or run. The login scripts that auto map certain drive letters to shared network resources and auto connect certain networked printers for them, plus update the clock date/time with a central time server won't even work without giving them sufficient rights for all of that.

Re:Good policy, if you can live with it .... by HuskyDog · 2017-02-28 12:02 · Score: 1

Well, we certainly can live with it just fine and have done so since the days of Win2000. At the end of the day, security is a trade-off and we have accepted that the relatively minor inconvenience of "standard users" (and for our case it is indeed minor) is less than the inconvenience of a malware attack. It is a balance which everyone has to make.

The same is true for work environments. Where I work security is a very high priority (for reasons you are free to speculate about) and therefore a very restrictive regime operates. There is an approved list of applications (about 200 I think) almost all of which are distributed via App-V. Some can be installed by anyone, whilst for more restricted ones you have to apply and get added to the necessary AD group. In all cases, no admin access by users is required. There is no possibility of adding your own applications as all areas writeable by users have the Windows equivalent of "noexec". If you try to install and run an executable then it simply won't start and logging software will register the attempt and dispatch a warning to your manager.

I have to say however that for most people this regime is not a serious hindrance. The common applications, Office, Chrome, Acrobat Reader etc are all installed by default and update automatically in the background so most users never have a problem. Power users who need admin access for specialist none-approved applications can use their browser to access a VMWare cloud environment and spin up VMs (Windows and Linux) where they can do whatever they want (albeit behind a very restrictive firewall). It all basically works fine and no-one ever experiences a problem with their clock not being set correctly! Mind you, I suspect that our IT budget is significantly higher per seat than yours. Yer pays yer money and yer takes yer choice!

Re:Duh? by SQLGuru · 2017-02-26 14:06 · Score: 1

I don't see how it's a pain. It's much less of a pain than cleaning an infected system. I haven't had an Admin account as my normal account since the XP days. If I'm prompted to enter an admin password and it wasn't something I was intentionally doing, I know something's up --- immediate shutdown (full, not just a restart) and scan my system on boot up.

Re:Duh? by SQLGuru · 2017-02-26 14:13 · Score: 2

I'm a DEV, too. My *account* is a limited account. But (depending on the project), I can launch Visual Studio with Admin rights. Some projects are just fine without them, so I don't use them. Other projects require admin rights, so I launch either through Shift-Right-click on the icon and select "Run as Admin" or I create a second shortcut and set the Admin flag. I get the UAC prompt when I launch it, but that's usually only once per dev session, so it isn't *that* annoying. But only Visual Studio is running as admin, the rest of my system (i.e. my browser) is still "protected" by using a limited account.

Re:Duh? by FictionPimp · 2017-02-26 15:26 · Score: 1

Not only that, but you can always run as. In my day to day job I run as a standard user. I frequently launch server manager as a domain admin users for admin related tasks. I have not ran as a local or domain admin on windows 10 ever.

Re:100% of Microsoft Vulnerabilities Can Be Mitiga by ruir · 2017-02-26 15:46 · Score: 1

Amen

Re:Admin? by rsmith-mac · 2017-02-26 16:28 · Score: 2

But perhaps creating two accounts, one in wheel and the other not, and doing work other than software installation as the user not in wheel would make it harder to social-engineer users into elevating.

I've read TFA twice now and I still can't figure out if that's what the authors are trying to suggest, or something else entirely.

The entire point of UAC/sudo is to allow users to run in a standard context for day-to-day activities, and to quickly elevate certain applications/actions when it's required. Unless something has gone terribly wrong here, applications running un-elevated under an admin-capable UAC account have no more rights than an application running on a non-admin-capable account in the first place. Until elevation takes place, it's for all practical purposes a non-admin account.

So what is TFA trying to suggest, and what is their metric? Are they saying UAC is broken and applications are trivially executing privilege escalation attacks? (And if so, how are standard accounts not affected?) Or are they just saying that since users can escalate applications, the OS automatically counts as vulnerable to the attack? In other words, is the argument that we should be doing away with UAC/sudo?

Re: Duh? by Gadget_Guy · 2017-02-26 17:49 · Score: 1

That's all well but why would you want Windows ? Assuming you have the choice.

Because despite what people around here say, Windows is simply good enough. I have a mix of different operating systems, and have no problems switching between them because they all offer the same basic facilities.

Re:100% of Microsoft Vulnerabilities Can Be Mitiga by ruir · 2017-02-26 23:27 · Score: 1

| By installing Linux instead Should be a no-brainer, but people are stupid.

Re:Duh? by benjymouse · 2017-02-27 00:14 · Score: 1

Windows still runs the GUI as part of the kernel?

No. The GUI runs under the logged-in users non-elevated account, i.e. even if you log in as an administrator, the administrator privileges are stripped from the user token that is used for the desktop (GUI) process. (the explorer.exe process).

On the driver level, graphics drivers are split in two: A (hopefully) smaller kernel part as well as a user-mode part. This split is for reliability and security. By keeping the kernel mode small, the developer can limit the attack surface and maximize reliability. A memory corruption bug in the user-mode part can at the most cause the specific application to fail.

--
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*

Yeah and then... by sproketboy · 2017-02-27 02:13 · Score: 1

Most of your software wont work properly because monkeys still insist on writing config info into program files.

Re:Yeah and then... by The-Ixian · 2017-02-27 04:11 · Score: 1

Sorry, but if your app is trying to write to program files then your app is broken or written for a version of Windows that hasn't been supported for a very long time.
The last big app that I can recall doing this was QuickBooks. They were late to change and caused all kinds of hassle for terminal server admins for years.
We are actually using Avecto for privilege control and escalation and it works pretty well for that. We are currently in the testing phase for adding application whitelisting to the Avecto workload as well. The idea being that we allow executable content to run from areas of the file system that the user doesn't have write access to (Program Files and Windows directories) and block exe's from all other locations with exceptions based on cryptographic signature meta data (like program publisher) or file hash.
The only problem I have with Avecto is the purchase options. They are a European company and don't take credit cards or POs.

--
My eyes reflect the stars and a smile lights up my face.
Re:Yeah and then... by sproketboy · 2017-03-01 00:04 · Score: 1

> Sorry, but if your app is trying to write to program files then your app is broken or written for a version of Windows that hasn't been supported for a very long time .NET by default uses exe.config files by default sitting in the same place as the exe file. Changing INI files to XML. Same shit different year. There are plenty of older apps not rewritten that depend on "running as admin" in windows. Microsoft should have abandoned program files 20 years ago and instead do it like Mac does with fat binary including all their resources in a read only Applications folder.

Re:Duh? by prunus.avium · 2017-02-27 02:42 · Score: 1

Many, many people. Especially anyone who plays games.

Even my kids have admin access now since online games require patches be downloaded and written to system locations.

Re:Duh? by Gadget_Guy · 2017-02-27 02:47 · Score: 1

That's nice, but the Swedish Chef predates Supreme Court Nominee Bork by a decade. The Muppet Show had a greater worldwide impact than some parochial bit of politics.

Re:Duh? by Gr8Apes · 2017-02-27 02:47 · Score: 1

I'm sorry, but I think that is completely wrong.

And you'd be wrong.

Exactly how does Windows starting with maximum permissions actually manifest as a real world example?

It's the root of all buffer overflow, DLL injection, and any other type of attack. IOW, this is not hypothetical, but a real world issue. You should also note that Windows last I looked suffers from the largest number of severe or higher level security issues. That would be the type of security issues where the machine can be compromised. Most of those don't care about what user account you're running from, precisely because of this problem.

If you start with a basic account, you don't have to whittle away its rights; it is low by default. If you want it to be a higher access account then you add it to the Administrators group. Then it inherits the additional permissions. This is the opposite of what you described.

Where you might be getting confused is that the permissions system allows for both Allow and Deny settings, but it is extremely rare to see Deny being used. For an example of how Deny works, if you wanted to create an account that could install software, but not edit the firewall settings, you would add the Administrators group to the account and then Deny edit rights to the firewall. Deny is only useful AFTER you have raised the account's permissions from the default low settings.

And this is where you're confused. How do you think you get that higher permission process? It's because you have access to calling a process with system privs as a regular user. But you don't even need that access to break security. Your regular "low-priv" user process still has the ability to inject DLLs. A simple DLL injection with a method overriding an existing DLL method that is called with a system priv process, which you can also accomplish simply with your "low-priv" user process, is all it takes to break out of the security sandbox. (This was actually a recommended process for having a true no privs process effectively elevate a security token within its process. This is a terrible hack, btw, and just shows how bad security in Windows really is) The approach we used was to create a separate service process that had privs setup to solely spawn a new process with the permissions we needed to effectively do what we needed to do without completely opening up the system to all sorts of potential escalation attacks. While somewhat clunky and spawning multiple processes and having to deal with IPC, this was still a better approach security wise than all other options under windows. AFAIK, those servers still haven't been hacked through our processes.

So no, the "non-privileged" user in Windows really isn't a non-privileged user in the sense of what they can do security wise, unless and until you completely lock down the machine to the point that it is effectively a kiosk with only a single directory available for read-write with limited applications available none of which have code execution capabilities nor network access capabilities. It really is that bad.

--
The cesspool just got a check and balance.

Re:Duh? by Gr8Apes · 2017-02-27 03:08 · Score: 1

If you have the ability to run arbitrary code, see other post for details on how and why you're still not secure.

--
The cesspool just got a check and balance.

Re:Admin? by MrLint · 2017-02-27 03:17 · Score: 1

So herein lies the core of the issue, 2 actually.

1) social engineering. Under normal UAC, as part of the admins group you have to merely click-thru to elevate a process. As a non admin user, with a seperate privileged account you must provide credentials.This raise the bar of, in nothing else, user awareness, and prevents the sadly typical user behavior of just clicking on any button tat comes up without reading. Sudo still requires a password, so its not the same as the UAC standard setting.

2) escalation flaws. A user not in the admins group is not allowed to latest at all (probably). Thus if a malicious program does come along looking to exploit the a system component, or other program that has a flaw, the assumption that root access can be achieved will basically fail silently. For a non-windwos example of this see ShellShock on MacOS.

Re: Duh? by Gadget_Guy · 2017-02-27 03:20 · Score: 1

Familiarity. I've been using Windows since Windows 3.0, so I'm very familiar with the interface and the way the systems works behind the scenes. Over the same time I have used Unix, FreeBSD, and quite a lot of Linux distributions. Because there was such a variety in the *nix side of things, all of which worked differently from other similar operating systems, I actually find that I am quicker getting stuff done in Windows. Windows 8 nearly ruined this with its stupid modern UI, but I have been able to ignore most of that and stick with the old desktop.

It's what I use at work, so programs that I use (and write) at work can also be used on my home systems. Also, when buying software (especially games), Windows is the better supported platform. For open source stuff, the situation is reversed, but I most of the software I use also has Windows versions too. I am gradually moving my standard selection of programs to cross-platform versions so I can one day migrate from Windows. The only reason why I would do this is because I don't trust the direction that Microsoft is taking these days.

PowerShell. This is one of the things that keeps me on Windows; I just love PowerShell. Sure, they released an open-source, cross-platform version, but to get the best out of the shell you really need to run it on Windows.

Despite what you say, security is definitely good enough. Since the release of Service Pack 2 for XP, every version of Windows has gained more security features. I haven't had any malware problems since I upgraded to XP (which happened after SP2 was released). It helps that I have always used limited user accounts (like this article says). Of course, I don't go running random programs that get emailed to me, but then I also wouldn't do that on Linux either because I don't just assume that it is that much more secure than Windows.

Re:Admin? by dbIII · 2017-02-27 03:38 · Score: 1

Are they saying UAC is broken and applications are trivially executing privilege escalation attacks?

Not so much "broken" as in it was never enough to do what you suggest since it was about limiting SOME admin level activities for users with full admin rights.
Sudo is completely and utterly different because the *nix user model is very different to the MS one and much simpler. There is not really much point in comparing the *nix user model and the MS one. MS is about "flexibility" to put things politely, which is why there are so many things that do not behave in an obvious way if you are looking at it as if it was like the *nix model.

Ransomware usually doesn't need admin rights by Doke · 2017-02-27 04:17 · Score: 1

Ransomware typically runs as a normal user, without admin access. Yet it's one of the more devastating forms of malware. It doesn't need admin access to rip through a company's shared drives.

Re:Duh? by cyberchondriac · 2017-02-27 04:18 · Score: 1

There are some apps that don't respond properly with UAC; I had to use admin for my son's computer (he only had user status as he was 13 at the time); for some things, I had to switch logon and login as administrator. Couldn't even "run as administrator". Pain in the butt.

--

Look back up at my post, now look back down, you're on the Internet. Now look back up. I'm a signature.

Re:Admin? by Shoten · 2017-02-27 04:23 · Score: 1

Context here:

There are two different scenarios that have to be discussed, and they are very different.

One is enterprise users...that's people at work, using Windows. For them, Admin rights are really not usually necessary, and there is someone else (the admins, obviously) who can serve in the admin role when needed. This is where the biggest bang for the buck of reducing user rights comes in. Yes, there's software that requires admin rights...but in the enterprise market that is becoming increasingly rare, and there are often ways to hit a middle ground where that software will run without giving full local admin rights to a user.

The other group is home users. This is the sticky wicket. Yes, there's UAC...but as home users aren't really that technically savvy. So, when something asks them to click (assuming Windows 10 here) "Yes" or "No," they will often just choose "Yes" because it's what they've had to do a hundred times before to make something valid work correctly. And that 101th time...it's malware. And sure, you could have them using an account with no admin rights at all, but then who would be their admin?

So, as you debate TFA and its message, keep these two scenarios in mind. They both have a lot of users in them, even the same users when you think about it...but they work in very, very different ways.

--

For your security, this post has been encrypted with ROT-13, twice.

Re:Just to be clear what that means by cyberchondriac · 2017-02-27 04:24 · Score: 1

But then you'd have no employees left. There really should be some level of basic training required/supplied, but most places just won't do it, even if took just an afternoon.

--

Look back up at my post, now look back down, you're on the Internet. Now look back up. I'm a signature.

Technically correct by computational+super · 2017-02-27 04:33 · Score: 1

Well, that's true in the same sense that turning off your computer mitigates vulnerabilities... without admin rights, nothing works in Windows.

--
Proud neuron in the Slashdot hivemind since 2002.

Re:Just to be clear what that means by arth1 · 2017-02-27 04:36 · Score: 1

But then you'd have no employees left. There really should be some level of basic training required/supplied, but most places just won't do it, even if took just an afternoon.

Unfortunately, getting people to switch to a critical and questioning mindset takes more than an afternoon. For many, I don't think it can even be done. This makes protecting the business from its own employees a necessity countermeasure, as long as you can't segment off the insecure users.

Re:Duh? by TechyImmigrant · 2017-02-27 05:46 · Score: 1

On a work laptop, I can write to my 'c:\Users\\Documents' folder, but if I try to access it via the various shortcuts on the left of the file manager, I am denied access. No UAC, even though I have the password for that. The permissions on the thing vary based on the path you access it by? That's messed up.

I realize this is Slashdot and we have to hate Microsoft and Windows, but what you described doesn't happen on a normal system. It's like the users on this site become complete Luddites when dealing with a Windows machine.

It's a work system. It has whatever IT did to it, which is a spattering of the usual anti-virus stuff. It happens. Should I think better of Windows because it doesn't happen to some other people?

--
I should use this sig to advertise my book ISBN-13 : 978-1501515132.

Re: Duh? by nosfucious · 2017-02-27 06:48 · Score: 1

I call bullsh*t.

Professional Windows Administrator (3000 boxes in 20 countries in EMA).

I maintain 4 Windows accounts, (1) my user account with "email" and "sip" account. This does not even have local admin on my box and I work just fine. (2) Administrative Account, but NOT Domain Admin account. This is account that will have admin rights on servers and some delegated AD permissions. This account only does "admin" activities, eg - user account creation, check event logs, and mostly by powershell script - on a server that I never, ever browse the internet on. This server has Internet Explorer locked down and only admin utilties on it. From time to time I need this account to log in to server desktops by RDP to get specific tasks done. This admin account is never used to do "user" type activities - eg open word files or fill in HR forms. (3) A Domain Admin account - 99% of the time this is changing DNS entries, and (4) Enterprise Admin - with 99% of the time is publishing a new certificate template, with 1 time per year upgrading the AD Schema.

No admin account has access to my email and vice versa. I show VIPs that not even I run as Administrator and the "but ... but, but I need it" arguments drop like flies.

--
Q:I was listening to a CD in Grip and it sounded horrible! What's up? A:Perhaps you are listening to country music

Re:Duh? by michael_wojcik · 2017-02-27 07:37 · Score: 1

I call it user laziness. I run both my work and personal Windows machines with UAC set to the strictest setting - prompt for credentials on the secure desktop - and I do quite a lot of work that requires occasional admin privilege (such as running builds that require local admin rights during the installation phase). It's not onerous.

People have been living with manual, explicit privilege elevation for decades: runas on older Windows releases (and add-ons for even earlier ones), su for UNIXy systems, operator terminals for mainframes, and so on. The modern era of minimal-effort click-a-button elevation is a trivial cost for significant protection. (UAC isn't a security boundary, but it blocks a lot of less-clever exploits). Anyone who can use a computer can quickly learn how to use it.

There's really no excuse.

Re:Admin? by AK+Marc · 2017-02-27 13:41 · Score: 1

Everyone who wants to be able to run anything. I have about 50% of my shortcuts on my work machine (where policy prevents logging in as local admin, but one can use local admin), set up to run applications as local admin, because so many things still require it. Windows may have made it possible to run applications without local admin, but that doesn't mean all the application writers have kept up.

--
Learn to love Alaska

But... by Meski · 2017-02-27 15:25 · Score: 1

50% of apps won't run without admin rights. I pulled that figure out of my arse, but it's probably not wildly inaccurate.

Re:Duh? by FictionPimp · 2017-03-01 09:01 · Score: 1

So every linux distro is also insecure with sudo and su?

Slashdot Mirror

94% of Microsoft Vulnerabilities Can Be Mitigated By Turning Off Admin Rights (computerworld.com)

149 of 238 comments (clear)