Symantec Shouldn't Make This Software

Anyone that has used Windows Vista at all will be familiar with User Account Control (UAC) prompts.  The bulk of these you will see during initial setup of your machine, typically during installation of new software but occasionally during management of your machine. If you see one of these that does not correlate to one of these actions then guess what you should cancel it.

Symantec seems to think that UAC prompts are a big enough problem that they are looking into designing software that could answer them for you.  Now to me this seem to be really short sighted. Even if they can succeed in inserting into the UAC process, which I doubt they can, this would just serve to perpetuate a problem with security that has plagued Windows. Microsoft has taken a huge step in increasing Windows overall security and this technology can only undermine its effectiveness.

Steve Hiskey of the Windows Security team had this to say on it, "normal users only elevate to install... and install SHOULD have an elevation prompt.  If it is "daily" application that needs elevation but should be running as Standard User, then Symantec is doing the industry a disservice by auto-elevating that application rather than pushing the vendor to fix the application to work correctly."

I agree completely with Steve's comment and in my opinion the fundamental answer to User Account Control prompt abundance is to correctly design software for Windows Vista. This and only this should be used to control the frequency of prompts. If a software vendor can't produce a design that works on Windows Vista then they won't be getting any of my money.  I have run as a standard user since day one on Windows Vista and I can honestly say that I rarely have to interact with UAC prompts anymore.

Robert over at Windows-Now also has some valuable insight.


Posted Jan 10 2007, 03:28 PM by Josh Phillips

Follow Me on Twitter

Did you enjoy this article? If yes, then subscribe to our RSS 2.0 feed or

Comments

Matt Freestone wrote re: Symantec Shouldn't Make This Software
on 01-10-2007 4:49 PM

Couldn't agree with you more Josh.  You are 100% correct.  Symantec's been going down hill for years now.  This stupid concept may just finish them.

Carl wrote re: Symantec Shouldn't Make This Software
on 01-10-2007 5:48 PM

Josh,

You're right that Symantec should absolutely not circumvent the UAC process.  But I see a few problems with UAC that have nothing to do with Symantec.

1. The first user in a new Vista install is an Admin.  People aren't going to create an additional Limited User Account.  They're going to run with the first account created.    This means the UAC prompts are just a "Continue" button.

2. People are going to reflexively click through the constant UAC "Continue" prompts just like they did the prompts for ActiveX controls in Internet Explorer 6.

3. If it's possible to circumvent UAC, this technology will quickly end up in every piece of Vista-focused malware, rendering UAC useless.

I'm not trying to be overly negative.  Certainly having UAC is better than not having it, but I'm not sure it's going to make much of a difference in the end.

Josh Phillips wrote re: Symantec Shouldn't Make This Software
on 01-10-2007 6:06 PM

Carl,

You have some very valid points.  Social engineering, and the just click to get it to away could happen.  Thanksfully the the default is "no" on the prompts and the "Secure Desktop" that UAC takes you to should help with malware.

There is no API around the prompt., but symantec might make a service to do some things.

as for being a Protected admin.  Since the shell is running in the same contect on both it and a standard user the only real difference is the absense of a need for a password, but your right standard user would have been better to get to.  Hopefully in the next version of windows they can make that happen.

JoeM wrote re: Symantec Shouldn't Make This Software
on 01-10-2007 8:09 PM

agree josh.  Personally I have not turned off UAC, and have not had a need to do so either.

Peter wrote re: Symantec Shouldn't Make This Software
on 01-11-2007 7:09 AM

Symantec has developed some major beef with Miscrosoft over the past year.  I don't know why.  Symantec products are still pretty good, but you can't trust anything they say about MS anymore.  It's all one sided propoganda now.

Windows is a registered trademark of Microsoft Corporation.
Powered by Community Server (Non-Commercial Edition), by Telligent Systems Themed By nb development