full-disclosure - Re: [Fwd: Re: windows future]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 28 Aug 2009 16:30:26 -0300
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: Peter Besenbruch <prb@...a.net>, "full-disclosure@...ts.grok.org.uk"
	<full-disclosure@...ts.grok.org.uk>
Subject: Re: [Fwd: Re:  windows future]

> On Friday 28 August 2009 08:29:48 Thor (Hammer of God) wrote:
> > Maybe I'm not saying it properly... (and I won't belabor the point
> > anymore).  If you want a password instead of a click, then set it to
> > "prompt for credentials" rather than "prompt for consent" for
> > *administrators*.
> 
> Understood. I also understand you can set up Vista to use normal users.
> My
> objection is to Microsoft's default behavior.

This now makes more sense after further reading the following from you:

> 
> > > We basically agree on the main point: Separate user and
> administrator
> > > accounts are better. I wonder if Micosoft will start enforcing
> that?
> >
> > The "wonder if MSFT will start enforcing that" is already answered -
> they
> > do, and HAVE been.  Even with XP you could "run as administrator."  I
> used
> > to do it all the time. I actually like the UAC in Vista/Win7 better
> as it
> > gives seamless admin capabilities while interactively logged on as a
> normal
> > user.
> 
> There is a difference between being able to do something, and enforcing
> it.
> The OS on my machines will not allow a person to run an administrative
> desktop. It enforces the separation between the administrator and a
> normal
> user by requiring the creation of at least one normal user at install.
> Only
> that normal user can log in. 

Oh, now that's cool.  I didn't know that.  The "force to create a normal user and only use that" was not something I was aware of.  

What's the OS?  So, even if you wanted to, you couldn't log on as administrator and just do whatever you needed to?  I'm not sure if I like that, but I assume this is customizable behavior, yes?  


> Microsoft encourages the opposite behavior
> by
> default. I know of no Vista home user who runs as a normal user.
> 
> I guess it's good we had this conversation; I got to meet someone who
> sets up
> Windows properly on his personal machines. ;)

Absolutely - and I learned something about other default options on other OS's too ;)

t

> 
> --
> Hawaiian Astronomical Society: http://www.hawastsoc.org
> HAS Deepsky Atlas: http://www.hawastsoc.org/deepsky
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/