full-disclosure - Re: Windows 7 UAC compromised

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <26698.1233862720@turing-police.cc.vt.edu>
Date: Thu, 05 Feb 2009 14:38:40 -0500
From: Valdis.Kletnieks@...edu
To: Jimmy Astle <astle.j@...il.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>,
	Miller Grey <vigilantgregorius@...il.com>
Subject: Re: Windows 7 UAC compromised

On Thu, 05 Feb 2009 14:17:32 EST, Jimmy Astle said:
>                It all comes back to windows biggest issue, joe the plumber
> shouldn't not be running as a local admin on his box. UAC problem solved!  I
> still dont see how redmond missed the concept.

It's *easy* to see how Redmond missed it - they *intentionally* missed it.

You have to keep in mind that as a corporation, Redmond doesn't *really* give a
flying f**k in a rolling donut about your computer's security - they care about
their profits.

We all (including the Redmond guys) know that we could drastically reduce the
number of infections by making people run as non-admin and making it damned
inconvenient to install possibly untrusted software.  But if you care about
your profits, you ignore the 4,986 geeks who won't run it because it's a total
security mess, and sell it to the 193,472,415 Joe Sixpacks out there, and sell
it in a config that lets Joe install any damned thing, because Joe wants his
dancing hamster screensaver.

In other words, they'll fix the security problems *only* when they get so bad
that even Joe Sixpack (and his corporate counterpart Joe "ya want fries with
that" McSE) start insisting that Something Be Done.  And even then, they'll only
do as much as it takes to maximize the profits (you tighten it too much, and
you get double-whammied - tightening more costs more *and* loses you sales).

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/