Finally, a bright mind open to new things and the way things are done in Vista.
In this case, Brandon writes and makes a good point on why users will NOT just click OK to all those security warnings in Vista.
Here is his scenario:
- Joe User starts up his Windows Vista machine and logs into an Administrator account with UAC [User Account Control] enabled.
- Joe opens up Mail Program Express* - which automatically runs with reduced privileges because of UAC.
- Joe clicks on a malicious HTML e-mail message that triggers a buffer overrun exploit against Mail Program Express, which executes some malicious code. Perhaps this code includes instructions to delete important system files, muck with the registry, or access sensitive information about your computer or other users of the machine.
- The attack against Mail Program Express succeeds, and the code is run - but the code fails to have any impact on the system because it is running in the context of Mail Program Express - which does not have Administrator privileges.
The user will never see the dialog Pop-up, everything is nice and secure.
Sure, there are many different scenarios, but I actually think that users will get used to the most common dialogs and why they usually pop-up, therefore, when a dialog pops-up thanks to some malicious app trying to get administrative privileges, most users will be like "Hey, WTF? This is odd."
Also, in my comment to his great post, I expressed that I also Love that my Internet Explorer runs in even more secure and restricted environment, and if IE, or a code within, tries to get access to anything other than typical things a page might need to render properly, user will be warned and asked if such action should be allowed.
Try viewing a source of a page in notepad or DreamWeaver - IE will ask you if that's something that should be allowed or not.
Leave the UAC on guys! Not that it may, but it will save you from trouble one day.
Check out his great site: BrandonLive.com