Frogboy

Join Date 03/2001

+2419

Should Stardock fix Microsoft's UAC?

User Account Control on Vista discussion

In a new Macintosh advertisement, the PC has what looks like a body guard who keeps interupting the conversation with the Mac in the name of "security". The feature Apple is making fun of is called the User Account Control.

The idea behind UAC is to protect users from malicious software and other content that could affect the stability and integrity of the user's computer. But many users have expressed utter disdain for it. As a result, UAC ends up being disabled by users much to the chagrin of Microsoft.

But what if there was a different solution? What if third-parties were able to modify how UAC worked?

For example, imagine the UAC remembering what users had given it permission to previously? Right now, every time I open up Stardock Central, I'm prompted by UAC. Very annoying. What if after I selected "continue" it saved Stardock Central and its checksum such that it wouldn't come up again for that program as long as it was unchanged?

Another example would be after I select continue on the UAC, the account remains in an elevated state for say 5 minutes (or some user-defined time) so that anything else that needs UAC would automatically be passed.

I think just these two changes would significantly improve the usability of UAC to the point where most of the complaints would go away.

And I think these kinds of changes are absolutely necessary because, right now, users are just turning it off completely which is definitely not a good thing. You should definitely not turn off UAC but it is very understandable how annoying its current implementation can tend to be.

Microsoft has stated that any attempt to alter the functionality of UAC would be considered a security violation that would be dealt with accordingly. It's scary sounding stuff. But if the alternative is that millions simply turn off this functionality or the bad reputation of UAC slows migration to Windows Vista then what's the best path?

Which brings us back, should third-parties like Stardock step in and fix UAC on their own? Or should the user base wait and hope that Microsoft enhances the UAC experience?

Locked Post

Advanced Search

Watch this post

Do not email me updates for this post Email me updates for this post

Successfully updated karma reason!

I personally don't mind the UAC so much, but it would be nice to leave the system in an elevated state for some period of time.

For all the whining people did about how unsecure Windows is, now that Microsoft has done something about it, they aren't happy with it. You can't please all the people all the time but there will always be a squeaky wheel.

Is the UAC open enough to be configurable or modifiable? I love what Stardock does and would like to see their take on a new implementation.

Successfully updated karma reason!

Xan

Join Date 01/2003

+29

Another problem with the current implementation of UAC is that they come up regularly enough that users start to ignore the prompt and automatically click "continue". That sort of thing completely undoes the theoretical benefit of UAC.

Ideally, Microsoft will update UAC to be more intelligent like remember programs that have been given permission and timed elevated states.

But if MS doesn't do it, then somebody else should fix it, preferably a company people trust like Stardock.

Successfully updated karma reason!

I hope that Microsoft makes it more user friendly, and less annoying, but if not Stardock should step in for sure.

Besides, even if Microsoft "enhances" the current UAC, companies like stardock can always add better features, and things that Microsoft would never add.

Successfully updated karma reason!

Sign Up or Login and this ad disappears!
There are many great features available to you once you register. Sign Up for a free account and browse the forums without ads.

I would like it if there was an option to have UAC remember applications & used a checksum to match them.

I keep getting prompted by UAC for things like Process Explorer, Computer Management, or Neverwinter Nights 2, as examples.

Successfully updated karma reason!

NightTrainthedark

Join Date 07/2003

+255

Being a Microsoft partner, I would assume you can find out if they are planning on any changes. If not then why not make it better and make some money.

Successfully updated karma reason!

Brad,

I think your TweakVista app should allow users to modify the functioning of UAC. For example, specify EXACTLY what to allow or disallow. Allow the system to learn from past actions. And get rid of multiple dialogs (e.g., if UAC prompts you that you need to 'allow' the deletion of a file, then don't ALSO show the deletion confirmation dialog. It's redundant. One or the other.). Remembering applications is a must.

Please, please, please make TweakVista as great as TweakUI was for XP!!
Vista's a good OS, but we all know that it needs Stardock's touch to make it great.

Successfully updated karma reason!

I'm not quite sure if Stardock should fixe the UAC.

I think that there are so many complains and solutions to fix UAC, that Microsoft should fix it quickly.

Successfully updated karma reason!

I turned off UAC. I really don't see much of a point in it. Is there really malicious software out there that wants to change my font size or screen resolution? What is UAC protecting me from on my personal home computer? If I have anti-virus (for whatever that's worth with Vista) and anti-spyware utilities and practice safe browsing and email habits, why do I need UAC interrupting me at all?

Like Xan said above, these alerts pop-up (and I use that term intentionally) so often that users will simply learn the quickest way to close them without taking the time to read them, or, as is the topic, turn UAC off entirely.

UAC cries "Wolf!" far too often for it to be any use when something truly malicious does come along.

If I could turn off UAC for the rest of my session without rebooting, and have it turned back on automatically with the next reboot, I might consider that. Then, if I wanted to make a lot of changes or perform actions that I know are going to trigger UAC I could turn it off just during that period. But since a reboot is required to turn it on or off, it stays off full time.

A whitelist of allowed applications would also be nice. Just like my firewall, I could be alerted only if the application has changed since permission was granted.

While I like the idea of Stardock improving upon UAC, if it is possible to alter UAC wouldn't that mean it isn't worth much as a security precaution anyway?

Successfully updated karma reason!

MS has known about UAC not being well-received for awhile and yet have refused to add those two mentioned adjustments. Stardock may be prevented though from helping if it is indeed something MS would sue over. Though to be sure if MS doesn't fix it and Stardock can't, someone out there will and people will find it.

Successfully updated karma reason!

I've gotten by without UAC for 20 years without a computer meltdown and I can get by another 20 years without it!

Successfully updated karma reason!

jelvis

Join Date 01/2003

I kind of like the approach of keeping the status elevated for a defined time. Has worked great for me in Ubuntu.

Successfully updated karma reason!

Nice idea and it really shouldn't take too much to implement it. Once I have approved the running of a certain version of a certain program, I shouldn't have to OK it again. However, there should be an edit capability such that if I accidently approve a program, I can go back and remove it from the auto-approved list.

It would also be nice to have access to a list of the actions that required approval and but that approval wasn't given. It would allow us to see if attacks were being made.

Successfully updated karma reason!

With all respect, I'd place my security more safely with the system engineers over the graphics guys, any day.

I'd advise against stardock playing with UAC, if nothing else, to distance yourself.

Think about it. You alter UAC, the machine gets infected, who's fault is it? MS or Stardock?

Successfully updated karma reason!

Here is what they need to do:
1. I do something for the first time, ask my permission and start counting
2. After five times of running the exact same thing with the same file size, date and checksum, add a "remember choice" button
2. After fifteen times, never show the question again until the file date, size or checksum changes. Then, notify me what changed and present the choices again and keep counting.

This needs to work with startup programs, installs, device manager, etc.

Successfully updated karma reason!

I feel I should note that everyone should make sure they know exactly what UAC does and doesn't do before making pronouncements about its use.

Successfully updated karma reason!

Istari

Join Date 05/2001

+20

Stardock IS a software company (System engineers). How do you think Stardock is able to do things like WindowBlinds, Multiplicity, KeepSafe, etc.?

As for fault, it's the user's fault if their machine gets infected most of the time. When people clicked on "I love you" attachments in XP was that Microsoft's fault?

Somebody needs to make UAC usable or else it will be either turned off or just ignored. I would prefer Microsoft do it but they have largely ignored feedback on this. So if not them, I'd rather Stardock do it. Otherwise, you'll end up with a Symantec-bastardized solution.

Successfully updated karma reason!

I don't see MS adding any sort of customization, like remembering which process to allow/deny witch CRC checksum to track modification. They would have to add an UI to access that and that sound way to complicated for the average user and a support nigthmare.

IMO companies with firewall products will probably add that possibility in the future. They already have most of the work done. Most of them are going into that direction anyway, adding virus & malware protection.

Brad: Your ideas sound like something for SecureProcess

Plus it would make it useful for people outside of it's current target population.

Successfully updated karma reason!

safe lists and performing checksums on every executable is not the answer.

UAC is not going be an option in the future, this is just stage one. Best that developers and users alike get accustomed to a restricted user account now.

Successfully updated karma reason!

I think your idea ia really good for all who are already agitated with UAC and for those who may want to make the switch to Vista. My current firewall does exactly what you are suggesting and I love it.

Successfully updated karma reason!

Ummm, no firewall can cause your programs to run with limited privileges...

An app that hasn't be elevated can't write to the majority of drive and registry, such as the windows directory. How exactly would a firewall accomplish this?

Successfully updated karma reason!

Honestly, I'd prefer a big glowy button to turn UAC off. That works for me!

Successfully updated karma reason!

Heh, this sounds like a question for one of the weekly polls.

I can only judge from the stories I've heard as I don't have Vista yet, but, if it's half as annoying as it sounds then I would probably turn it off too.

As for a 3rd party fixing it, I would probably use that if it helps make me more secure and stops me wanting to throw the computer every time the prompt came up. If Stardock did it and it wasn't some free piece of soft ware then you could probably add it to the Thinkdesk set of apps.

Successfully updated karma reason!

I mess around so much with the system that I couldn't bear the UAC eventually. I tried levaing it on for a long time, but eventually I gave up because it slowed me down too much. And the switch to the secure desktop is just brutal. I got along with XP and previous Windows just fine running as an admin, I can't ever recalling being affected by virus or malware.
I only wish that the Security Center wouldn't bug me about it. I disabled the popup do I wouldn't get that popping up everywhere, but I wish the was an option to have Windows not monitor the status of UAC. I quite like the Security Center monitoring my Antivirus and Firewall etc and informing me if they should be turned of. But since I disabled UAC it's now constantly red.

They way I see it about third parties fixing UAC; I wouldn't trust it. If third parties can 'fix' it, then third parties can break it.

Successfully updated karma reason!

Remembering applications would open up a hole in UAC - as malicious code could launch applications on the "allow list" and manipulate them to cause privilege escalation.

Having an "Elevate everything for the next 5 minutes" option is far worse, since malicious code just needs to wait until you switch to that mode and then it can go to town.

Successfully updated karma reason!

That's not what UAC is for. Anti-Virus and anti-malware apps aren't going to prevent your daily use applications from being attacked by code-injection exploits.

Like Xan said above, these alerts pop-up (and I use that term intentionally) so often that users will simply learn the quickest way to close them without taking the time to read them, or, as is the topic, turn UAC off entirely.

UAC cries "Wolf!" far too often for it to be any use when something truly malicious does come along.

Doesn't matter. UAC is still very useful even if the user clicks "Continue" to every prompt they see.

Successfully updated karma reason!