Windows Users Ignoring LUA Security 522
blankify writes "eWeek is running a story about the least-privilege, no-admin option available in Windows (2000/XP/2003) that has been mostly ignored by end users. From the article: '"To the average user, the notion of non-admin is abstract and obscure," said Michael Howard, a senior security program manager in Microsoft Corp.'s security business and technology unit. "Most users just don't know they can set up least-privilege accounts in Windows today, and that's just a sad reality."'"
It could be the default option during install (Score:5, Interesting)
Re:It could be the default option during install (Score:5, Insightful)
Until programs run without being admin this whole arguement is pointless.
OS X does it perfectly.
Re:It could be the default option during install (Score:4, Informative)
Change the shortcut to point to "runas
Re:It could be the default option during install (Score:3, Interesting)
I'd be particualrly scared of running IE this way, for example. It's the programs that can get hijacked that you *don't* want to be running as admin. Of course, IE may run fine with non-elevated rights - I don't know because I don't use Windows.
This is a very interesting point though: merely making a feature available isn't enough. You have to (and I'm talking about Microso
Re:sudo for one program vs. su for everything (Score:3, Insightful)
Re:It could be the default option during install (Score:3, Insightful)
Try running mainstream apps and see for yourself. Stuff like peachtree, or any other business app breaks like hell if you don't have admin priveleges. The problem IS in the OS, as the permissions in Windows is incredibly stupid (which is why Longhorn is changing to a Unix style permissions setup...)
Even XP is based upon the old premise that one person use
It certainly isn't easy (Score:5, Informative)
It certainly isn't easy, unless you're willing to invest significant technical time and effort into the project -- which is, I'm sure, a big part of the reason why most people don't do it.
That being said, I'm the admin for an organization with about 60 or so Windoze stations, and I can say that it can be done for most things. It most often involves figuring out what the defective program is trying to do, and then allowing it access to just where it needs.
The two most vital tools are FileMon and RegMon, both free from SysInternals (http://www.sysinternals.com/ [sysinternals.com]). They monitor file system or registry accesses. In the vast majority of programs can be made to work just by applying some ACLs on program-specific registry or filesystem branches.
There's no way in hell your "typical home user" could do this, though, which is, I expect, the problem and point.
Re:It could be the default option during install (Score:3, Informative)
As others have said, this is the fault of the developers of that software.
Microsoft has been telling developers for at least five years now to put user data/config/whatever in the My Documents folder for whoever is running it. *Not* doing this is really stupid, because as soon as you install an app that writes config data or whatever to its install folder, you run into problems on multi-user machines like termservers.
I work in IT f
Re:It could be the default option during install (Score:5, Insightful)
1. They carried the same codebase forward from Windows 3.1, never completely scrapping it, always just bolting new parts on. This has caused Windows to end up like a Rube Goldberg machine, so complicated on the inside that "they" say nobody at Microsoft really knows what everything in there actually DOES.
2. They really pounded the nails in the coffin when they deliberately bound IE into the O/S to frustrate the DOJ during the browser wars. By binding so many things right into the O/S, they glued themselves to their codebase. Can they even separate their GUI from the underlying O/S anymore?
3. Given that this monstrous, mammoth codebase is a hideous nightmare to try and "fix", obviously the smart thing is to pull a Steve Jobs: scrap the whole beast and glue a beaufitul, stable frontend onto a FreeBSD backend with a Mach Microkernel. This would turn Windows into a thing of beauty and stability, like the Mac O/S. But, CAN they? Is it even possible?
4. And, if they did that, they might face a revolt as virtually every software company, corporate IT department, and end user went completely ballistic. It could be suicide.
So, think this over: Microsoft is pretty much screwed, locked utterly into the codebase they've got. If they stick with it, eventually they'll be replaced by more secure, stable alternatives. If they try to save themselves the Apple way, the end could come sooner instead of later.
If YOU were Gates and Ballmer, what would YOU do?
Aside from spending the weekend on the yacht, I mean...
Re:It could be the default option during install (Score:3, Insightful)
http://www.kuro5hin.org/story/2004/2/15/71552/779 5 [kuro5hin.org]
They curse like sailors, they don't even like their OWN codebase, they code around errors... Yeah, sounds pretty clean to me.
I guess we'll see what happens. I give 'em five years, tops. I don't think the company's going out of business entirely, I just think they'll end up abandoning the PC OS business for other markets.
But, we can agree to disagree.
I wonder why (Score:3, Insightful)
I wonder if this could have anything to do with the fact that the user interfaces, OS messages, and help files are not "user friendly" and written in mysterious GeekSpeak that the average user doesn't understand.
Re:I wonder why (Score:2, Funny)
Now if the help info was just packaged in the eminently user-friendly 'info' system. .
Re:I wonder why (Score:2, Interesting)
"ok" "cancel" at bottom there is a tiny triangle can be opened and shows full path to whatever needs it.
As they steal everything, why not steal that scheme of OS X so at least we mac users have a "more free" port 135?
Re:I wonder why (Score:2, Funny)
Re:I wonder why (Score:5, Insightful)
Re:I wonder why (Score:2, Insightful)
Thats enough reason there to ditch it.
Re:I wonder why (Score:3, Insightful)
Re:I wonder why (Score:5, Informative)
Re:I wonder why (Score:5, Informative)
By default, new accounts created during a windows install/first use interface are administrator accounts. As are new accounts created through the generic, task view Control Panel interface for account management.
It's one of the reasons that Windows is unsecure out of the box.
If MS merely made accounts user only be default, that would take care of it.
Of course, then you'd have to fix all of the crappy software out there that can only run as admin. And there's a lot of it. Major software packages like WordPerfect still don't handle user accounts and preferences correctly and it's a very simple thing to do.
Re:I wonder why (Score:2)
Try saying what you wrote to a non-geek user. The ensuing blank stare could thwart the machinations of Medusa.
Re:I wonder why (Score:3, Insightful)
Re:I wonder why (Score:3, Insightful)
True. However, when one is accustomed to strange noises under the hood and strange handling characteristics (which manifest/change every time they change the air freshner hanging from the mirror), then another new noise or odd handling characteristic doesn't get much if any
Re:I wonder why (Score:5, Insightful)
Of course, I totally agree that they claim of lack of user awareness when it is really a lack of MS support. Microsoft has also done nothing to simplify this issue for developers. There are no simple "test and prompt for elevation" routines. It's not a general Windows logo requirement; in fact it's buried in one paragraph in the enterprise logo. And to top it all off, aside from a few proactive devs making blog entries, there's been no attempt to educate users.
Way to go MS, blame user apathy for your own poor performance.
doh (Score:5, Informative)
Re:doh (Score:5, Insightful)
A limited account in linux still allows you to do most things without a hitch. Plus, when you need root access, you can do that within the logged on account without logging off.
I also tried setting up my SO's account as limited but she ran into problems all the time. It is hard to explain (excuse?) something as a feature when it is such a pain in the ass.
Hopefully, they will get this one thing right in Longhorn.
Re:doh (Score:5, Informative)
runas
Or any other program can be launched.
Re:doh (Score:3, Interesting)
Here's a good blog with much more info [msdn.com]
Some people even prefer this to su.
Re:doh (Score:5, Informative)
Re:doh (Score:3, Insightful)
Re:doh (Score:2)
Re:doh (Score:3, Insightful)
You're forgetting, though, that the average user will only ever use a command prompt under strict instruction of someone else who is walking them through the process. The same is true of an "average user" that runs Linux. (That's "average user", not "average Linux user" - the two are very different)
Re:doh (Score:2, Informative)
Exactly. Even the most mundane and trivial application or game these days tends to require some sort of adminstrative privileges or access during install and commonly also during use. Numerous small business accounting packages require adminstrator privileges, especially a much-maligned yet inexplicably common package that requires online activation.
Look, I can understand that low-access user accounts are the way to go, but when the most common programs require admin rights to use and install, how can yo
Re:doh (Score:5, Interesting)
This is why most people don't know about it; developers and vendors barely understand Windows security, so it's ignored. The users instinctively know this and they play along, ignoring the existing capabilities.
The Microsoft platform is closed, poorly designed, obscure and ambiguous. Side effects are common and difficult to prevent or correct. Frobbing things that vendors aren't paying close attention to is a good way to invent new breakage.
Go ahead, be the first on your block to harden Windows with naive LUA. Spend the next two years chasing down truly arcane breakage. Teach Microsoft and third party vendors how to promulgate securable products. Meanwhile, I'll be using software on platforms that figured out most of this stuff a decade ago.
Installing Apps vs. Running Apps multiuser/admin (Score:3, Interesting)
Unfortunately, there are a bunch of applications for which this doesn't work right, including iTunes - the first piece of Apple softwar
Cluelessness at Microsoft (Score:5, Informative)
Re:Cluelessness at Microsoft (Score:3, Insightful)
You can't install anything without being an administrator, however most programs install to the current user not the global user settings...
So, user installs program as admin, logs back into user - program gone!!!
That's damned stupid..
Re:Cluelessness at Microsoft (Score:3, Interesting)
https://bugzilla.mozilla.org/show_bug.cgi?id=2665
(Copy/paste since Bugzilla blocks Slashdot)
Tell that to the developers (Score:5, Insightful)
Re:Tell that to the developers (Score:3, Interesting)
Re:Tell that to the developers (Score:5, Informative)
Certain Programs Do Not Work Correctly If You Log On Using a Limited User Account
Microsoft Flight Simulator 98
Microsoft Flight Simulator 2000
Microsoft Flight Simulator 2002 Professional
Microsoft Flight Simulator 2004 Century of Flight
Microsoft Train Simulator 1.x
Microsoft Money 2000
Microsoft Money 2001
Microsoft Money 2002
Microsoft Money 2003
MSN Messenger Service
Microsoft seems to have discovered the command-line, so maybe they'll discover the root account? Maybe they can fix their broken 'runas' soon thereafter.
Re:Tell that to the developers (Score:2, Insightful)
It certainly sets a terrible example.
I think Howard is simply trying to shift the blame for the exceptional lack of security in Windows by default.
To summarise the reasons for developers and users ignoring LAU mode:
It's also ignored by developers (Score:5, Insightful)
There are numerous games that cannot be installed without admin rights, and plenty who cannot even be EXECUTED without admin rights. All because the devs are lazy morons.
Same goes with numerous applications.
Not to mention the fact that in many case applications break in random ways, without actually telling why they break.
So right now if you actually want to use XP, you pretty much are stuck with admin mode (or you have way more patience than I do in using 'run as..' or switching users)
Re:It's also ignored by developers (Score:3, Informative)
Re:It's also ignored by developers (Score:5, Informative)
Re:It's also ignored by developers (Score:2)
For execution I agree with you, but for installation I'd expect it to be impossible to install without admin rights.
Cheers,
Ian
Re:It's also ignored by developers (Score:3, Funny)
I'm a Gentoo user at home and I'm too used to being able to modify my system to suit my needs.
Re:It's also ignored by developers (Score:2)
As a developer, if I want to code for LUA, I need to make sure that all of my dependant libraries are LUA friendly. Not a hard job for the likely system libraries, but next to imposbbile for most popular 3rd party libraries. Resons differ from case to case, but
Re:It's also ignored by developers (Score:2)
Well, then it came time to take company training tests. They're based in Flash, and Flash couldn't install without admin access.
Then I tried to install a printer. No go on that one.
I ended up having to install VNC (since Remote Assistance was disabled) and have a tech install it as well, and connect to my computer to put in the admin password and grant me access.
Re:It's also ignored by developers (Score:5, Insightful)
Actually, this has nothing to do with the developers being lazy morons (which they're not). It has to do with MS' broken security model. The place where they chose to draw the line between user and admin restrictions in the API is so asinine that it's virtually impossible to write any sort of complex app that *doesn't* require some admin functionality to run.
But to be honest, why does it even matter? A lot of the vulnerabilities on Windows have nothing to do with installing software, or who has the permissions to run operations. They have to do with services' exploits and buffer overruns, which are already running as 'System' level (super-user) in the background.
Non-admin Wiki! (Score:5, Informative)
Acronymtastic! (Score:2, Informative)
defaults (Score:4, Insightful)
Windows' fault (Score:5, Interesting)
Maybe MS should start educating the population and force them to create passworded least-priviledged accounts and choose a password for the administrator account when installing or booting an OEM for the first time. Maybe also the administrator should be blocked out of surfing the web and playing games so that people just don't use the admin account for everything.
Too many broken apps (Score:2, Interesting)
One typical example is Dark Age of Camelot [darkageofcamelot.com] by Mythic Entertainment. The game itself is installed to a C:\Mythic\ directory usually, as well as all the profiles for every character. Even World of Warcraft is just as bad, all the profiles are stored in a subdirectory in the C:\Program Files\World of Warcraft\!
Until developers start supporting limi
Too many apps won't run without Administrator Priv (Score:5, Informative)
This is nothing new...
Sad state of affairs (Score:3, Insightful)
Lazy programmers (Score:3, Interesting)
Of course, a lot of the blame goes to Microsoft for encouraging the idiotic "everyone's an admin!" mentality.
Longhorn should implement these (Score:3, Interesting)
This is why during the set-up of Longhorn it'd be a really cool idea to create all the accounts for the welcome screen, or it's equivelent, as non-adminstrative users. In fact, it should go further than this, it shouldn't give you the option of creating an administrative account at all on this screen. The administrative user should be banned from internet access by default (with the exception of Windows Update) and if you decide to add another administrive account it should warn you profusely that this isn't a smart idea.
In .NET there are attributes that allow you to define permissions on methods. For example, if I know that my method only
ever does algebra then I can ban it from network IO, File IO etc. It'd be a good idea to make these attributes required before the source will actually compile. You could have intellisense in Visual Studio autogenerate the most restrictive settings whenever you create a new method.
Some security counter-measures can be really a pain in the ass but these couple i've mentioned here would really help bring windows security under control. Windows security is not bad, per se, it just needs more configuration than we can expect from Joe Sixpack. We need to make security easier for them and that's in everyones best interest, Microsoft included.
Simon.
Re:Longhorn should implement these (Score:3, Informative)
How well it works remains to be seen.
There are reasons it's ignored (Score:2)
The reasons users are "ignoring" it are at least twofold.
There's the old standby of making it harder to do some things (which is the point) as an unprivileged user. To be honest, I'm okay with that; it's the reason for being unprivileged in the first place. My significant other's Windows XP account is set up as a "Limited Account", and she has no problems using it to check email, run Firefox and MS Money, and so forth.
The biggest issue, however, is that's it's not the default for new accounts, and th
Re:There are reasons it's ignored (Score:2)
That's odd. I tried setting up a similar account for my girlfriend and she had no problem running Mozilla... except that it was impossible to view anything on the Internet because the DSL dialer _REQUIRES ADMINISTRATOR PRIVILEDGES TO CONNECT_.
So you're right: for a few people running a few specific simple applications, you can manage with a n
Poor power users? (Score:2)
Defeats the purpose. Upgrading to XP Pro isn't an option because that costs too much money (YMMV). When I first used Linux, I found it easier to allow and restrict access to devices and files. In Linux it was m
Because it's a pita (Score:2)
Even now it's not really comfortable. It's not that the users wouldn't care. It's just barely useable.
Since Windows needs lot of maintenance throughout it's silent decay until reinstallation, most users feel they are better of working as admin right away.
Re:Because it's a pita (Score:2)
The thing I've always found bizarre is that for a user to "own" his/her files, a GPO needs to be set (running secpol.msc and clickity-clicking your way through Local Policies, Security Options, System Objects, and then changing "Default owner for objects created by members of the Administrators group" to "Object creator" instead of "Administrators group".) But that's just for XP systems. And for folks wh
Most software can't install without admin privs (Score:2, Informative)
I wonder, if Michael Howard is aware, that most of windows software requires admin priviledge to be succesfully installed?
Is it somehow also users problem, not architecture problem?
Not a fault (Score:3, Interesting)
It's a fault that non-util software also requires admin to run, but whether that's Windows' fault or the developer of the software is open to question at best. Personally I'd say that's the developer's fault. A great example of
Allow both admin and non-admin install (Score:2)
Re:Most software can't install without admin privs (Score:2)
If you're running a business with an IT department, or even have a household machine that you're responsible for fixing when someone breaks it, do you want unprivileged users to be able to install software, except for in their own accounts' space?
Reminds me of Red Hat... (Score:5, Informative)
M$ should learn from this, and their little article there, that instead of the stupid tour that appears when you first login after a fresh install, there should be a message alerting the user to create a new account.
Re:Reminds me of Red Hat... (Score:2, Insightful)
That's non-security. Make a user type his password n times a week and he'll type it in every single dialog window that asks for his password. Even the malicious ones.
So now you have your user enclosed inside an annoying stainless steel safe, except for the fact that it isn't safe at all, because he'll yell the door code at anyone standing outside.
Home users don't need
Re:Reminds me of Red Hat... (Score:3, Insightful)
I disagree. Having the password prompt gives the user the power to decide when elevated privileges are required. If a user disregards this power, then that is their fault. On OSX, I get prompted about once a month for the admin password, and it's usually when I run Software Update. If I were simply browsing the web and a trojan sheet came down, asking for the administrator password to continue, it would obviously be a phishing attack. I've trained my users to not check the "rememb
Linux v. MSFT SW installs (Score:3, Insightful)
There's a nugget of truth to that comment, but it misses both more significant points and differences between the GNU/Linux way and the Microsoft way.
It also misses the point that you can, largely, install binary software on different GNU/Linux systems, so long as core dependencies (usually your glibc version) are satisfied. E.g.: Macromedia Flash, Opera, Oracle, Realplayer,
Backwards compatibility (Score:3)
In contexts where the system administrator and user are two different people (and the system administrator is on the job), things usually work smoothly. These contexts are also those for which software is properly written; how much office software needs administrator access to run? The problem comes when you have a clueless user who is also admin for a machine; you try explaining to people why they should have to type a password (administrator password) to install something and when they should enter this password without confusing them or discouraging them from using limited privilege accounts altogether. Unfortunately, this sort of protection is almost useless if the user with the admin password is clueless.
However, I see no reason why Internet-facing software shouldn't be written to drop privileges on startup, much like a lot of suid root binaries open the files they need and then drop to normal user privilege levels. For example, preventing IE from installing or modifying stuff all over the OS would help a lot.
An Example (Score:3, Informative)
I tried this for a day... (Score:2)
that lasted for about... a day.
Logging in and out of 2k just to do maintenence sucked ass in ways that can't be described.
Even though WinXP has a "Run As..." option, I'm hesitant to take it up on it's offer in fear it'll break something else.
Re:I tried this for a day... (Score:3, Interesting)
[Yes, I do have to admit -- that for the home user all the fluff can be very us
Summary (Score:2)
It's Intentional (Score:3, Insightful)
Within a month, I got a call where he said, "Dude! Can we get rid of this admin account and the goddamn firewall? Everytime I want to do anything useful, I have log into the admin account. And I'm always having to log into admin and turn the firewall off to play online games". So, I suggested that he spend the money to get an external hardware DSL/Cable router. He did, and we turned off the firewall. But he still wanted his regular user account to be admin because that's where all his data was. After arguing with him for a bit, I told him we could set it up as an admin user (he didn't want power user because we'd tried that and there were still a few programs he claimed he couldn't run even as power user. CDRWIN was one of them) but that if anything resembling the worm/trojan that hit him in Win98 happened, it would be a full reinstall. I wouldn't try to figure out what happened. He agreed. It's been a year and a half since then. He's really good about applying the latest critical updates and that hardware router has probably saved him numerous times. But I still think he's in a risky position.
Most people just don't want to have to deal with the hassle of switching between two user accounts or learning to use "runas". It will always be this way. End users need full privs on their boxes. The only way around this is to set OSes up so that each user's "desktop" is actually a full VM. Then if it gets hosed by them running as admin, the only thing that needs to be wiped is their profile and that VM's image. Much cleaner than having to do an OS reinstall or a postmortem.
Re:It's Intentional (Score:3, Informative)
Well, you appear to pretty knowledgeable about windows, but I'm going to guess you don't have much linux experience (and there's nothing wrong with that).
I'm not going to claim linux user-friendliness for end users, but at least you can still run every program you need under the non-admin accounts (and the prog
Some reasons... (Score:3)
Once the admin account is set, it is a PITA to do the same stuff for other accounts. XP needs a button that says "make ALL accounts use this as default" button on those settings.
2) No damn rhyme or reason behind what requires admin access and what doesn't. Sure, adding Office or Baldurs Gate should require admin, changing screen resolution? Hell no. Half the spyware normal users get uses privledge escalation holes anyway so it does not keep that crap down.
Make the stuff make sense.
Anyway, I have been told (but have not tried) that making the "temp" folder trees "Everyone" read/write explicitly, and adding each account explicitly fixes most of the "run as admin" problems. Most programs dont do much registry editing, but a lot need scratch space and if they use the temp folders, they need access to them.
Re:Some reasons... (Score:2)
Yep. Can't set the clock, but I can shut down the system!
Re:Some reasons... (Score:5, Insightful)
Changing the screen resolution in Windows does not require admin privileges.
Half the spyware normal users get uses privledge escalation holes anyway so it does not keep that crap down.
Which ones ? Privilege escalation bugs aren't exactly common.
Anyway, I have been told (but have not tried) that making the "temp" folder trees "Everyone" read/write explicitly, and adding each account explicitly fixes most of the "run as admin" problems.
You've been told wrong. For starters, every user on the machine can create new files and modify existing files that belong to them in C:\Windows\Temp. Secondly, most all apps (even the badly written ones) use the per-user TMP variables that point to directories within the users profile (that they have "Full Control" over).
Most programs dont do much registry editing, but a lot need scratch space and if they use the temp folders, they need access to them.
No, in fact the most common problem is applications that try to store things that *should* go in HKEY_CURRENT_USER in HKEY_LOCAL_MACHINE. Bugs like this are actually a good indicator of the developer's lack of interest in updating their product, because per-user registry hives were introduced to Windows 9x back with Windows 98 (they've always been in NT AFAIK).
The second most common problem is stupid developers trying to write to files (often user or application preferences) in either their program's directory or the Windows directory (DOOM 3 has this problem).
Win XP Is An Ugly Kludge (Score:4, Interesting)
DOS 3.3 was the first MS OS I understood, so much so that, when the first DOSSHELL came out, I asked why would someone need that? I jumped on the NT technology because, when it first came out, it was well documented, (vis a vis my experience) and it allowed a whole new playing field. When NT 4 came out MS moved Video and Printer drivers from User mode to kernel mode. This was, IIRC, about the time Bill Gates had his vision of the PC integrated multi media household. I believe the PC version of Windows has persued this vision of multimedia OS to the point of having become in WinXP an ugly, bloated kludge, but it does, as much as possible, deliver in an ugly way, as a backward compatible multimedia OS.
Win 2K was the last OS to maintain the promise that Win New Technology brought with it. Win XP saw the culimnation of MS' effort to integrate Win95/98/ME with some of the benefits of NT, but the end result is an all and everything everyman's stew meant to satisfy the cravings of the masses.
I run WinXP on a web box for multimedia but thanks to the lessons gleaned online (/.:) I'm moving on to a *BSD, or one of the upcoming microkernel OSes to do research.
Single User Boxes? (Score:2)
By the way, I'm constantly frustrated by my new Windows XP machine that won't let me do what would be normal tasks under Windows 98, even as the administrator (running legacy programs that need access to the parallel port, for example).
What about OSX users? (Score:2)
Apple also tries to speak to the *user*, not 'yet another IT support person'.
The funny thing is (Score:2)
On the other hand, my 17 year old is a limited user and everything he plays will work ok with that setup. Sometimes I have had to grant permissions to the program directory or on a couple even the registry key in the hive, but I don't know of a single game we haven't been able to get working that way, and he plays most of the current ones such as World of
This is not too hard to figure out (Score:5, Funny)
User - That sounds like it might suck.
MS - No no no, it's great! And it's pretty hard to implement. Oh and a whole shitload of legacy apps won't even install.
User - Why would I want that?
MS - It's safer.
User - Do you still let programs run as System?
MS - Well yes.
User - Why?
MS - Symantec asked us to support the Open Source Virus Community and we are!
Nice of Microsoft to say that.... (Score:2)
The Mac OS X approach is better IMO. You can't actually create a true Super User account (and the UNIX root account is disabled), at least not without *nix hackery. Instead the default account created is an Administr
Make it actually *work* with LUA (Score:2)
You can let your granny loose on KDE with little instruction, to set her up as LUE under Windows would invoke such a barrage of support calls it would be a simply insane choice.
I guess it's another one for the "Gut the facts" campaign..
I'll just repeat... (Score:3, Insightful)
So now you have your user enclosed inside an annoying stainless steel safe, except for the fact that it isn't safe at all, because he'll yell the door code at anyone standing outside.
Home users don't need annoying internal security. They need transparent outside access security. That's all. Give an annoying security tool to someone who is only interested in bein left alone to use his computer, and he'll break it in a minute.
Face it, people: users will always want to be in charge of their computer, to install the latest (card/3d/simulation/fishing) game, "multimedia" tutorial or whatever. So now you have two choices: 1. Give them a crippled (no admin access) computer and they'll give you the finger. 2. Give them the admin password and they'll render it useless.
And no, this is not a matter of education. Even the most experienced geek can get distracted and annoyed as hell with password prompts. Create a security system that gives you routinely security prompts and they're going to be... routine.
What we need to fix is the way computers execute applications. We need a secure list of routine applications and procedures and a secure code signing system. A system where funny-cat-game is really from a company that was previously-approved by -SOME SERVICE-. So that way we'll only have important security prompts at important situations.
No, this is not the solution for most security-related problems, but it's a rough notion of the direction we should be heading at: create a system, any system, that allows the computer to stop asking (the home user) passwords all the time.
Poor Apps Make Standard User Impossible (Score:3, Insightful)
As a savvy PC user I tried to setup my XP system following best practices. Only run as admin when necessary. However, the two applications I use everyday make this impossible. Quicken and NewsBin Pro. Both of these applicatons require write access to their respective program files directories which forces you to run the application with elevated priviliges.
Until either application developers create proper software that actually obeys the security model or Microsoft enforces this policy then Windows users will always be admins.
LUA hahaha.. (Score:3, Informative)
Needless to say, this was not even CLOSE to what a UNIX user account is like.
Few thoughts..
1. App compatibility - very annoying. While some apps are kind enough to out-right say they suck and are not compatible, there are LOTS of apps that fail in *silent* ways. Mostly writing to folders and registry w/o checking for access rights. There are many apps that attempt to write temporary files outside of user folders (ie the Program Files folder) or even store user prefs in the system registry.
2. Along with #1 -- there are many things INSIDE WinXP that fail. One very annoying example is msconfig
3. runas
4. Fonts
Why LUA didn't work for me (Score:4, Insightful)
Installing applications was mostly a non-issue, with Windows prompting me for my Administrator password when I tried to install something that needed Administrator permissions.
However, almost everything else was a giant pain in the ass. If I wanted to use any of the control panels, I either had to log out/log back in as Administrator, use Terminal Services to connect to localhost and log in as Administrator, create yet another shortcut to run it as Administrator, or use the runas command. None of those options are nearly as slick as Windows Installer asking me for my Administrator password. Why they couldn't use the same model is beyond me.
It's not only the control panels that I had problems with. If I wanted to use Windows Update, I had to be Administrator, and it gave me no easy way to become Administrator. If I wanted to develop and debug something in Visual Studio, I either had to be Administrator or be in the debuggers group, which essentially gives you free access to poke at the system any way you like. And of course, numerous applications and games have copy protection systems that require system drivers and services to work.
Of course, LUA doesn't do a damn thing against network-based attacks.
In the end, it's much easier to run as Administrator and drop priviledges when running certain applications.
Re:Duh (Score:3, Insightful)
It's ignored because Windows was never designed with security in mind and grew to be the mess it is because that's the only way you can properly run Windows, as admin.
To come along much later and fix this, then blame the users is very poor on Microsoft's part.
closer still... (Score:5, Insightful)
I can't even count right now how many clients I have running users with admin membership because of crappy software.
And the kicker is, it's not that hard a programming task to make software run in the regular user context! argh!
eric
bah, I just ran out of mod points. :( (Score:5, Informative)
Intuit is criminal number 1 in this area (this month anyway, I have my targets change from time to time...)
Get this: The "enterprise" version of QuickBooks that will allow you to run in terminal services (gotta spend that extra cash to run the same software remotely you know!), requires that you have Power Users or Administrator priveleges.
Here's the catch however: I have a client running Small Business Server 2003, and they just went through a company restructuring where the CFO is going to be 200 miles away for the next few months, and needs to be able to hit QuickBooks from a terminal server session (yes, I know, VNC, PC Anywhere, bitmap pusher x..., work with me here though).
So, on an SBS, you can't have any trusts, no member servers (I might be wrong on that last one, apparently there'a hack that allows this, but again...), so the only server on the domain is the DC. You DC does not have "local" accounts and groups, only the AD users and groups. So a local power user doesn't exist. The only rights I can give them to be able to work is Admin.
The whole point of remote users is to.....access things remotely. You're requiring that every one of my users that wishes to use QuickBooks have Admin rights, and if they want to run in term serv, I have to allow dial in rights to that Admin account.
So I got on the phone with them. I suggested the following workaround:
"What if I just create a domain account, say ""QuickBooks User"". Set it to an obscenely secure password that no one but the admins could possibly know. Make it long, make it random, make it not-so-easy to remember. Grant that account Admin rights. Set Quickbooks to "Run As..." that user. Now Quickbooks gets the Admin privs it needs, but not the user."
After going through a supervisor, I was explained that this wouldn't work, and in fact they misconstrued it as an attempt on my part to subvert their licensing (because now I only have a single Quickbooks user, and we're supposed to pay per-seat for the license), and "Run As..." is intentionally broken to prevent this, along with the ability to run in Terminal Server if you haven't purchased the enterprise version.
Wow.
Cash more important than security.
Hey guys? What is so important at the system level that the *user* needs to make modifications to the OS? Why not store the data in the user's profile? Or in a shared directory with rights granted to the users in the "QuickBooks Users" group?
I just don't get it.
Re:closer still... (Score:4, Interesting)
You have to accept the fact that certian people shouldn't do certian things on computers.
The fas is that it should be dead simple for a grandma so able to do so, to install a card game in her home directory, without bothering anyone else on a system--a unix system. It goes there, and, what? There's no issue. Quake 3 has the ability to install into a non-root privlidged user's account. If grandma rm -rf
In Windows land, that card game may well have a fit if it dosen't get installed to c:\program files\bullshit cards. If it dosen't work that way on any system, the program is b0rked. Written by an idjet. It dosen't help that MS has programmed people and software writers to behave this way since, well, ever.
****EVERY**** MS home directory should by default have a My Programs folder, and software installed by that user should end up there--unless it really, really does need administrator access, or it needs to be shared by multiple users. Otherwise, who cares if grandma installs bonsai buddy, it's only going to affect her account and not spread to administrator--where everything can be gleefully cleaned.
Re:closer still... (Score:3, Insightful)
I think you've missed the point. Let's look at this from a family point of view (although this applies just as much to business usage but I think a family example is more simple) where Dad is the admin and is the only one who knows root's password and little Johnny is just a user.
So you have to be root to install software. Do you want Johnny to be able to install any software he likes without Dad knowing?
So you have to be root to change system wide settings. Do you really want Johnny to be able to play wi
Re:Duh (Score:5, Interesting)
Look how CreateProcess will progressively search for an executable at each space delimited chunk in an unquoted path; that makes a great trojan attack. Consider the shatter vulnerability and associated dangers that result from simple window input; that's why services have to be run on a seperate ACL'd desktop to be safe. Consider how trivially a power user can escalate to admin; look at how many apps need at least that privelege. Look how much code you have to write to set a simple multi-user DACL on an object.
The fact is that security is very hard to do properly in an MS environment, and historically MS has done a very poor job of promoting and simplifying it. I audit security software now, but when I wrote software I had a ton of homegrown libraries to handle things shouldn't have been necessary. So while I agree the tools are there, you almost have to be a security expert to use them properly.
Re:Unix was never designed with security in mind (Score:3, Insightful)
That may have been true in 1979, which, as you may be able to compute, was just a few years after UNIX was designed.
In case you aren't aware, the original UNIX HAD NO FILE SYSTEM AT ALL. It was intended to be a bunch of bytes on the system, being searching by grep and processed by tiny apps linked together with pipes!
The original UNIX was also where viruses were originally developed - because sys admins in those days didn't have to worry about them because they'd never heard of them.
None of that is true