Apple's Own Version of Windows UAC

[skate71290]

Hey everyone, on the second beta of OS 10.7 Lion, and so far, loving it, Safari seems extremely buggy (downloads stalling internet traffic incoming and outgoing on my notebook) and Facebook, amongst other things where i enter text, including Twitter (until the Official Twitter app works better on Lion) it asks me if i want to close the window even though there is no text in any field, but anyway, not what i'm here for.

Has anyone noticed the extreme number of requests to enter your OS password for deleting apps, installing apps from the App Store (which is annoying the crap out of me) and it even asked for a password when i created a new folder in my applications folder and chucked all the games in there.

hoping this is in fact just part of the beta, because the service - store agent - prompts for my password every time i install an app, and normally wouldn't be to bothered but my password is 26 alphanumerical keys long and as you can imagine, typing this in unless i absolutely have to is a pain in the ass!

Has anyone else noticed an increased number of notifications/password prompts since Snow Leopard, and is there any possible way of stopping anything asking for my password?! thanks, skate71290

[TechCavern]

Its probably because you're doing a lot of installation, so it seems like its too much. I haven't had any trouble what so ever. I can go several weeks with no password stuff whatsoever besides the login.

[skate71290]

No but this is the point i'm trying to make, with the App Store everyone will be buying and downloading free apps a lot more frequently, and i'm sure a lot of people could live without having to put their password in every time App Store comes to install a new app?! I know i have just bought it i don't need OSX to tell me that the App Store is installing it and wants approval!

[Luph67]

The password verification makes plenty of sense when it comes to making purchases. Heaven knows I've mis-clicked the buy button myself. I never understood why the store doesn't distinguish between actual purchases and free content though.

[skate71290]

Not the password I mean but yes thank god for that I also leave the final prompt when the App Store confirms if you want to purchase the App

[Guiyon]

There is a really simple reason for that. IIRC, the privileges on /Applications and anything in it are, ideally, set to 'root:admin' with a mode of 0755 (might be 0775). Since both the App Store and storeagent run under your user, this means that if you wish to install an app from the App Store and have the proper permissions set on it, you can't. In order to change the owner to root, the user must be root (this is a security feature to prevent J. Random User from trivially rooting a system). That password prompt is the storeagent launching a helper process with root privileges so it can install the app with the proper permissions.

[Riemann Zeta]

Since computer security and malware/rootkits have become such a prominent issue, every operating system, be it NT-based or unix-based, is moving towards a 'need to know' locked-down access-control model. Of course, any programmer or security expert will contend that filesystem access should always be as limited as possible. However, this security model comes with the price of having to enter a password (or in the Win NT case, having the AUC prompt for authorization) for every single operation that occurs outside of ones' home directory.

[Mal]

Fortunately for all of this, this behavior has no connection to the useless UAC in Windows, and everything to do with administrator privileges. It's an advantage to require authorization to install applications, because it's an important point for security purposes. The fact that it's slightly inconvenient doesn't negate the fact that it's far better security than not requiring the password.

jW

[thejadedmonkey]

Originally Posted by Mal

Fortunately for all of this, this behavior has no connection to the useless UAC in Windows, and everything to do with administrator privileges. It's an advantage to require authorization to install applications, because it's an important point for security purposes. The fact that it's slightly inconvenient doesn't negate the fact that it's far better security than not requiring the password.

jW

Erm, you do realize that UAC from Windows is specifically to do things that would require admin privileges, right? That means changing anything that you don't have permission to access, or changing any registry values that aren't in the "user" portion of the registry.

[TennisandMusic]

Originally Posted by Mal

Fortunately for all of this, this behavior has no connection to the useless UAC in Windows, and everything to do with administrator privileges. It's an advantage to require authorization to install applications, because it's an important point for security purposes. The fact that it's slightly inconvenient doesn't negate the fact that it's far better security than not requiring the password.

jW

Yeah uhhh...that's actually exactly what the UAC is for. It's the same thing but actually more "user friendly" because you just click yes instead of having to type a password....every. single. time.

I've actually always thought that was funny, that Apple made fun of MS over the UAC in that Vista commercial back in the day, when Apple's own version is way more cumbersome and annoying. So it's worse now in Lion apparently? Good job guys.

[Mal]

Originally Posted by thejadedmonkey

Erm, you do realize that UAC from Windows is specifically to do things that would require admin privileges, right? That means changing anything that you don't have permission to access, or changing any registry values that aren't in the "user" portion of the registry.

Originally Posted by TennisandMusic

Yeah uhhh...that's actually exactly what the UAC is for. It's the same thing but actually more "user friendly" because you just click yes instead of having to type a password....every. single. time.

I've actually always thought that was funny, that Apple made fun of MS over the UAC in that Vista commercial back in the day, when Apple's own version is way more cumbersome and annoying. So it's worse now in Lion apparently? Good job guys.

No, see, the exactly reason why Window's UAC was widely lambasted as being pointless and offering no real security is precisely because it didn't require a password, you simply had to click yes. It was the equivalent of having a button to say, "Yes, I have permission to do this," without any verification that you actually do. It is an absolute mockery of true security in every way.

BTW, UAC comes up for a lot more than installing apps. They toned it back from the level where it was being made fun of by Apple, but Apple asking for passwords during app installs or deletions doesn't come close to the absurdity that is/was UAC.

jW

[Soliber]

Originally Posted by TennisandMusic

Yeah uhhh...that's actually exactly what the UAC is for. It's the same thing but actually more "user friendly" because you just click yes instead of having to type a password....every. single. time.

I've actually always thought that was funny, that Apple made fun of MS over the UAC in that Vista commercial back in the day, when Apple's own version is way more cumbersome and annoying. So it's worse now in Lion apparently? Good job guys.

Are you kidding me?
At least Apple's version is always clearly visible and not so horribly invasive. It has happened to me so many times the past week on my work PC with Windows 7 that I installed something, and I saw the UAC icon pop up in the taskbar, but I actually had to click on that icon before ever seeing the UAC prompt.
And it's so friggin' annoying when both my screens just go black because, god forbid, I'm installing something.
I respect your opinion in preferring Windows UAC, but as far as I'm concerned, you're looney tunes

[diamond.g]

Originally Posted by Mal

No, see, the exactly reason why Window's UAC was widely lambasted as being pointless and offering no real security is precisely because it didn't require a password, you simply had to click yes. It was the equivalent of having a button to say, "Yes, I have permission to do this," without any verification that you actually do. It is an absolute mockery of true security in every way.

BTW, UAC comes up for a lot more than installing apps. They toned it back from the level where it was being made fun of by Apple, but Apple asking for passwords during app installs or deletions doesn't come close to the absurdity that is/was UAC.

jW

UAC doesn't ask for the password because the first user created is an admin in windows. Whereas on a Mac even though you are an admin, you have to use superuser privileges to actually do (certain) stuff. When you are not an admin in windows it actually asks you for a password.

Originally Posted by Soliber

Are you kidding me?
At least Apple's version is always clearly visible and not so horribly invasive. It has happened to me so many times the past week on my work PC with Windows 7 that I installed something, and I saw the UAC icon pop up in the taskbar, but I actually had to click on that icon before ever seeing the UAC prompt.
And it's so friggin' annoying when both my screens just go black because, god forbid, I'm installing something.
I respect your opinion in preferring Windows UAC, but as far as I'm concerned, you're looney tunes

If I recall correctly UAC prompts appear in a session that cannot be accessed with screen sharing (I seem to remember it working with remote desktop though). That is supposedly for protection, as it is supposed to prevent key logging from capturing the password you enter (assuming you are not running as admin).

[timbloom]

Originally Posted by TennisandMusic

I've actually always thought that was funny, that Apple made fun of MS over the UAC in that Vista commercial back in the day, when Apple's own version is way more cumbersome and annoying. So it's worse now in Lion apparently? Good job guys.

I don't believe it's any different in Lion than before. This user is just installing a lot of apps and complaining that it's asking him for his password so much, nothing has changed other than his app installation rate. If the OS didn't ask for your password when installing apps do you have any idea the increase we'd see in Mac malware? Free or not free from the app store, it needs to verify that you are who you say you are, and you have the rights to do what you want to do. Imagine if there was a keylogger installation going on hidden from the UI, with an option to bypass the authentication dialog box, there's nothing stopping it from installing at all. If you have a better idea for event-triggered authentication and authorization, we'd certainly love to hear it.

[maflynn]

I haven't played with Lion, but I've found OSX to strike a good balance. I don't get nagged a lot, only on install and once when running an app.

In windows, any app that requires some level administrator access prompts you.

I run HWMonitor on windows and I get prompted when ever I want to run it. If I turn down UAC, I then get windows nagging me that the security is too low.

[roadbloc]

I wouldn't mind UAC that much if it didn't dim the screen and need your attention immediately. Because of that, I disable it completely.

[munkery]

Originally Posted by roadbloc

I wouldn't mind UAC that much if it didn't dim the screen and need your attention immediately. Because of that, I disable it completely.

If you using an admin account with UAC disabled, you are running with superuser privileges. This is very dangerous as it allows malicious software, such as trojans, to install without authentication.

But, on the other hand, UAC hasn't shown itself to be very robust.