3 ms·

I've always been skeptical of the Windows security model as a user but I didn't think it was that porous. Thanks for setting me straight. I found these articles

I've always been skeptical of the Windows security model as a user but I didn't think it was that porous. Thanks for setting me straight. I found these articles explaining why it's so bad: https://tyranidslair.blogspot.com/2017/05/reading-your-way-around-uac-part-1.html https://tyranidslair.blogspot.com/2017/05/reading-your-way-a... https://tyranidslair.blogspot.com/2017/05/reading-your-way-around-uac-part-2.html https://tyranidslair.blogspot.com/2017/05/reading-your-way-a... https://tyranidslair.blogspot.com/2017/05/reading-your-way-around-uac-part-3.html https://tyranidslair.blogspot.com/2017/05/reading-your-way-a...

ChrisSD 7y ago
For enhanced security you can run as a "standard user" then switch users whenever you need to run something with admin privileges. And by switch users I mean literally go through the login screen to change desktop to an admin user. Obviously this isn't ideal. I've been using this set up for awhile and mostly I can live with it but installing/updating programs is a pain. Especially if they bizarrely don't expect to be installed from a different account then the one that runs them (games can be particularly bad about this, even modern ones). Of course there's a lot a malicious application can do even with standard user privileges (e.g. it has access to all your files and the internet). It's easier to get rid of though.
- freeAgent 7y ago
  You don't have to switch to an admin user account. You can provide admin credentials when needed or right click an installer and run as admin manually (and provide the credentials then).
  - ChrisSD 7y ago
    No. That causes a process with admin rights to run in the context of your desktop session. This is exploitable by non-admin processes running in the same session. The inter-process security in Windows is unfortunately weak when they share a desktop session.
    - freeAgent 7y ago
      You're assuming at that point that you're already compromised or running malware, though. If you aren't already infected with malware, this is not a problem. If the installer itself is malware, then switching to an admin account to install it obviously offers no protection.

ChrisSD 7y ago

For enhanced security you can run as a "standard user" then switch users whenever you need to run something with admin privileges. And by switch users I mean literally go through the login screen to change desktop to an admin user. Obviously this isn't ideal. I've been using this set up for awhile and mostly I can live with it but installing/updating programs is a pain. Especially if they bizarrely don't expect to be installed from a different account then the one that runs them (games can be particularly bad about this, even modern ones). Of course there's a lot a malicious application can do even with standard user privileges (e.g. it has access to all your files and the internet). It's easier to get rid of though.

freeAgent 7y ago
You don't have to switch to an admin user account. You can provide admin credentials when needed or right click an installer and run as admin manually (and provide the credentials then).
- ChrisSD 7y ago
  No. That causes a process with admin rights to run in the context of your desktop session. This is exploitable by non-admin processes running in the same session. The inter-process security in Windows is unfortunately weak when they share a desktop session.
  - freeAgent 7y ago
    You're assuming at that point that you're already compromised or running malware, though. If you aren't already infected with malware, this is not a problem. If the installer itself is malware, then switching to an admin account to install it obviously offers no protection.