3 ms·

> What prevents any random Windows application to make a screenshot and apply "greying out" filter to it? I mean, I launch a game and it puts full-screen image

> What prevents any random Windows application to make a screenshot and apply "greying out" filter to it? I mean, I launch a game and it puts full-screen image of whatever it wants. It doesn't take any special permissions to make a screenshot either. Because you would be able to alt+tab to other tasks, and that application would be able to still execute code as it was able to before. It's not any kind of security 'behind the scenes'. > The only true security feature I remember was implemented in Windows many years ago. Or perhaps you didn't realize all the engineering that was taking place behind just what you see. This[0] blog post gives a good overview of some of the security architecture that went into making that elevation prompt. Honestly, MS has been leading the pack in OS security for some time. They are leagues ahead of MacOS and Linux. [0] https://learn.microsoft.com/en-us/archive/blogs/uac/user-account-control-prompts-on-the-secure-desktop https://learn.microsoft.com/en-us/archive/blogs/uac/user-acc...

vbezhenar 3y ago
Why would I do "alt-tab"? Do you think users typically type alt-tab when asked for admin permissions? I never did that. It's all security theater.
- DEADMINCE 3y ago
  It isn't security theater at all. Did you read the link? You wouldn't be able to switch to another application is the point. What you suggest greying out, would easily allow other applications to hijack that prompt or replace it with their own. That's a large part of what 'Secure Desktop' aims to prevent, and it succeeds at doing so.
  - asimops 3y ago
    That's not the point they were trying to make. They were asking what would prevent malware from imitating the UAC prompt to steal administrator privileges.
    - DEADMINCE 3y ago
      I understand and answered that. The answer is Secure Desktop, details on which can be found in the link I posted in my earlier comment.
    - Scion9066 3y ago
      https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works https://learn.microsoft.com/en-us/windows/security/applicati... > If the policy setting is set to Prompt for credentials, malware imitating the credential prompt might be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. So just knowing the credentials is not enough, they have to be used in the right context (the secure desktop).

vbezhenar 3y ago

Why would I do "alt-tab"? Do you think users typically type alt-tab when asked for admin permissions? I never did that. It's all security theater.

DEADMINCE 3y ago
It isn't security theater at all. Did you read the link? You wouldn't be able to switch to another application is the point. What you suggest greying out, would easily allow other applications to hijack that prompt or replace it with their own. That's a large part of what 'Secure Desktop' aims to prevent, and it succeeds at doing so.
- asimops 3y ago
  That's not the point they were trying to make. They were asking what would prevent malware from imitating the UAC prompt to steal administrator privileges.
  - DEADMINCE 3y ago
    I understand and answered that. The answer is Secure Desktop, details on which can be found in the link I posted in my earlier comment.
  - Scion9066 3y ago
    https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works https://learn.microsoft.com/en-us/windows/security/applicati... > If the policy setting is set to Prompt for credentials, malware imitating the credential prompt might be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. So just knowing the credentials is not enough, they have to be used in the right context (the secure desktop).