Windows Vista Security Joke ?

[Gary Richardson]

Well, can't see myself running out to install Vista (when it comes out) on my box.

http://www.winsupersite.com/reviews/...ta_5308_05.asp

Modern operating systems like Linux and Mac OS X operate under a security model where even administrative users don't get full access to certain features unless they provide an in-place logon before performing any task that might harm the system. This type of security model protects users from themselves, and it is something that Microsoft should have added to Windows years and years ago.

Here's the good news. In Windows Vista, Microsoft is indeed moving to this kind of security model. The feature is called User Account Protection (UAP) and, as you might expect, it prevents even administrative users from performing potentially dangerous tasks without first providing security credentials, thus ensuring that the user understands what they're doing before making a critical mistake. It sounds like a good system. But this is Microsoft, we're talking about here. They completely botched UAP.

The bad news, then, is that UAP is a sad, sad joke. It's the most annoying feature that Microsoft has ever added to any software product, and yes, that includes that ridiculous Clippy character from older Office versions. The problem with UAP is that it throws up an unbelievable number of warning dialogs for even the simplest of tasks. That these dialogs pop up repeatedly for the same action would be comical if it weren't so amazingly frustrating. It would be hilarious if it weren't going to affect hundreds of millions of people in a few short months. It is, in fact, almost criminal in its insidiousness.

Let's look a typical example. One of the first things I do whenever I install a new Windows version is download and install Mozilla Firefox. If we forget, for a moment, the number of warning dialogs we get during the download and install process (including a brazen security warning from Windows Firewall for which Microsoft should be chastised), let's just examine one crucial, often overlooked issue. Once Firefox is installed, there are two icons on my Desktop I'd like to remove: The Setup application itself and a shortcut to Firefox. So I select both icons and drag them to the Recycle Bin. Simple, right?

Wrong. Here's what you have to go through to actually delete those files in Windows Vista. First, you get a File Access Denied dialog explaining that you don't, in fact, have permission to delete a ... shortcut?? To an application you just installed??? Seriously?

OK, fine. You can click a Continue button to "complete this operation." But that doesn't complete anything. It just clears the desktop for the next dialog, which is a Windows Security window (Figure). Here, you need to give your permission to continue something opaquely called a "File Operation." Click Allow, and you're done. Hey, that's not too bad, right? Just two dialogs to read, understand, and then respond correctly to. What's the big deal?

What if you're doing something a bit more complicated? Well, lucky you, the dialogs stack right up, one after the other, in a seemingly never-ending display of stupidity. Indeed, sometimes you'll find yourself unable to do certain things for no good reason, and you click Allow buttons until you're blue in the face. It will never stop bothering you, unless you agree to stop your silliness and leave that file on the desktop where it belongs. Mark my words, this will happen to you. And you will hate it.

Sounds like it will be a nightmare. God help you if malware gets on the computer, it'll take 30+ prompts to get rid of it as well.

Edit to add: Looks like it it gets worse as you can't do anything else until allow or deny a prompt.

It actually gets worse. In his review of the latest build, Thurrott points out that Microsoft security people found a bug in the original that spoofed the cursor. It hid the real cursor under a fake one and when the user clicked it thinking that they were canceling a screen, they were actually accepting it thereby allowing malware to install. In order to combat this, Microsoft currently has the dialog boxes pop up in the Secure Desktop mode, meaning everything goes black except the dialog box thereby preventing the user from doing anything else until the dialog box is addressed. Imagine that happening over and over again.

This isn't security for the user, its security for M$, so they can tell you (well you must have "allowed" it), when you're overrun with Malware.
http://www.schneier.com/blog/archive...oft_vista.html

[chrishoggy]

Beta Build 5365 + "External Developer Workstation" is the latest release, not 5308 that they reviewed. So their info may be more than a little out of date Word on the street form beta testers is it's good. Some of the stuff in Vista is coming out on public beta release, such as IE 7 http://www.microsoft.com/windows/ie/...s/default.mspx

[Kraellin]

frankly, i think MS shld go back to a dos boot disk system. your o/s is on a disk (ok, it would have to be cd now) and you simply insert the cd to start the system up. no way to corrupt the base o/s with viruses or malware of any kind. need to do updates to the system, just order a new cd or burn a new one from a download. simple, clean, protected.

not looking forward to vista at all.

craig

[Gary Richardson]

Hi Chris,

Thanks for update, I know its still in beta, so the eventual product released for sale is likely to be much different, but I don't like some of the directions they seem to be going in.

I want to have complete access to my system. Too many problems are caused by being denied by the very systems that are supposed to protect you. I've seen too many corrupted computers where the overlying problem wasn't the infected files, but trying to get past the "defensive" systems that were preventing you from removing them.

The bad guys are clever enough to get round all the systems that are put there to "protect" you (or that has been my experience), and utilise them to their advantage.

Better education is the answer, not more restrictions.