There are two vectors here; the one that the post was talking about is the fact that as long as an application controls the screen, they can show whatever they

There are two vectors here; the one that the post was talking about is the fact that as long as an application controls the screen, they can show whatever they want -- for example, an app (or a full-screen web site) could render a pixel-perfect version of this: https://i.stack.imgur.com/LHDfV.png https://i.stack.imgur.com/LHDfV.png And the user would say "oh, another stupid UAC prompt", enter their password, and that would be that -- UAC doesn't stop and say "press ctrl-alt-delete to enter your password". If it did, then that would significantly decrease the risk here.