News for hackers. Stuff that matters.

A comment on German BSI withholds Truecrypt security report. Parent comment

Re:German BSI withholds Truecrypt security report by 001spartan on Monday December 16, 2019 @02:58PM (#21806567)
Even Windows gets this wrong at times, with several UAC bypass techniques exposed by auto-elevating binaries. Still, Microsoft has done a great deal of work with the Windows privilege model to prevent things like this, and these issues are steadily being resolved.
[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by gruez on Monday December 16, 2019 @04:48PM (#21807628)
>with several UAC bypass techniques exposed by auto-elevating binaries

According to Raymond Chen, a MSFT employee:

>There really are only two [UAC] settings.

>* Always notify

>* Meh

https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94...

[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by mehrdadn on Monday December 16, 2019 @03:04PM (#21806615)
https://www.networkworld.com/article/2295224/microsoft--uac-...
[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by orf on Monday December 16, 2019 @03:59PM (#21807131)
Pasting a random article from 2007 with no other comment is not a great rebuttal of what they said.

A _lot_ has changed since 2007.

[ Parent | on HN ]
Re:German BSI withholds Truecrypt security report by mehrdadn on Monday December 16, 2019 @04:06PM (#21807191)
I'm pretty sure the fact that it's not a security boundary has not changed since 2007. They should've probably marketed it better to clarify this, but that's not a technical issue. It was always a horrible idea to run a malicious program under your credentials relying on UAC to enforce any security. That's never changed.
[ Parent | on HN ]