Just as I suspected, a Microsoft executive admitted that Vista’s UAC (User Account Control) is designed to annoy users.
In a Thursday presentation at RSA 2008 in San Francisco, David Cross, a product unit manager at Microsoft who was part of the team that developed UAC, admitted that Microsoft’s strategy with UAC was to irritate users and ISVs in order to get them to change their behavior.
“The reason we put UAC into the platform was to annoy users. I’m serious,” said Cross.
Microsoft not only wanted to get users to stop running as administrators, which exacerbates the effects of attacks, but also wanted to convince ISVs to stop building applications that require administrative privileges to install and run, Cross explained.
“We needed to change the ecosystem, and we needed a heavy hammer to do it,” Cross said.
Most likely it actually makes the system less secure since most people I know turn off UAC. Anyone who doesn’t turn it off soon gets so used to clicking ‘yes’ that they don’t even bother to read the alert and just respond automatically, so when it’s caused by real malware they won’t realize the difference.
1 thought on “Microsoft admits Vista UAC is designed to annoy users”