I want FULL CONTROL NOW!!!

  • Thread starter Thread starter Guest
  • Start date Start date
In message <[email protected]> "S
Wayne said:
When you want to perform any maintenance operations that require
administrative
control in Linux or OS X the system DOES indeed pop up a window and
ask for
your password. It then gives you several minutes in which it assumes
that since
you typed your password, you are who you say you are, and you can it
won't
bother you again. After those few minutes are up, and if you do
something else
requiring administrative elevation, it asks for the password again.

Do you see how this is better? Rather than popping up a box EVERY
SINGLE TIME
you do an admin task, it does it once, and then doesn't do it again
for a few
minutes. It doesn't just ask for a monkey to press a button in a
dialog box, it
actually requires your password. So it knows that the person
requesting elevation
is at least someone with the admin password. If you have several
things you
need to do in a short amount of time (which is typically the case for
admin tasks)
then you only get one popup.
Click to expand...

There are a couple problems with what you just said.

First off, no password is needed in Windows if you are an administrator
(you already provided your password) -- If you're running as a limited
user (or set it via an appropriate group policy) then administrative
credentials are required.

Windows uses a single-sign-on model, which makes locking the workstation
when unattended the user's responsibility. There are also appropriate
tools for environments designed for security to help users avoid leaving
their PC unlocked while unattended (One store I visited had a system
when if you stepped off of a pad on the floor, the machine logged out)

UAC is for a different threat -- UAC is not designed to ensure that
there is an administrator sitting at the keyboard. Windows already
figured that out, you don't have to tell it over, and over, and over,
again.

Rather, UAC is designed to assume that the app which wants
administrative privileges was intentionally started by the user at the
keyboard, not a user-level program.

These are *very* different threats.

If I'm a piece of malware that wants to compromise your system, all I
have to do is run silently in the background and wait for you to enter
your password, after that I have 10 minutes to do whatever I want to
your system. If I were a malware author, I'd call that a wet dream.
 
Back
Top