I'll take an annoying Windows 7, if it's more secure

Last Friday, Ina Fried detailed an interesting report from blogger Long Zheng, who "is drawing attention to an apparent shortcoming" in Microsoft's desire to make Windows 7 less annoying.

According to the report, Zheng believes that because Windows 7's User Account Control isn't as annoying as it was in Windows Vista, Microsoft is leaving its users open to more threats by third parties trying to exploit vulnerabilities. Zheng contends that due to changes in UAC, "malicious code could turn off alerts entirely with the user getting little notice that such a change had been made."

Zheng said in a blog post that he and a fellow blogger, Rafael Rivera, have designed a proof-of-concept code to prove his theory. He believes, "at a minimum, that Microsoft's default setting (should) also warn users if a change is being made to UAC itself."

In Windows Vista, a UAC prompt popped up each time any major change was made to the system. Some users found that annoying. Realizing that, Microsoft decided that in Windows 7, users would be able to decide how often they want to be notified. The default setting in the beta release of the OS only notifies users when a third-party application is making a change.

It should be noted that Zheng's contention is based on the Windows 7 beta, which means practically nothing until the final build hits store shelves. Microsoft can change that setting at any time and make this issue go away. More importantly, it can be changed by the administrator, so the issue, while present, shouldn't be blown out of proportion.

But it's because of that setting that Windows 7 is less annoying. But should we accept annoyance anyway, if it means more security? I think we should.

Annoyance with more security isn't necessarily a bad thing. But Microsoft is trying to find a way to achieve less annoyance while maintaining security. That won't be easy.

"We understand adding an extra click can be annoying, especially for users who are highly knowledgeable about what is happening with their system (or for people just trying to get work done)," Ben Fathi, a Windows 7 engineer, wrote in a blog post. "However, for most users, the potential benefit is that UAC forces malware or poorly written software to show itself and get your approval before it can potentially harm the system."

In the same blog post, Fathi posed the question of whether or not UAC actually makes your system more secure. Unfortunately, the answer was less than ideal.

"Does (UAC) make the system more secure?" Fathi said. "If every user of Windows were an expert that understands the cause/effect of all operations, the UAC prompt would make perfect sense and nothing malicious would slip through. The reality is that some people don't read the prompts, and thus gain no benefit from them (and are just annoyed)...There is the potential for a definite security benefit if you take the time to analyze each prompt and decide if it's something you want to happen. However, we haven't made things easy on you--the dialogs in Vista aren't easy to decipher and are often not memorable."

Worse, the company found in an internal study that users are "approving 89 percent of prompts in Vista and 91 percent in SP1." In other words, users are "responding out of habit due to the large number of prompts rather than focusing on the critical prompts and making confident decisions."

So maybe the issue isn't necessarily the number of UAC prompts, but the quality of those prompts. Maybe Microsoft needs to focus on making those UAC prompts more intelligent, more informative, and less derivative. After all, if users are better informed, they may be less annoyed, creating a situation where UAC actually cuts down on many of the issues facing Microsoft's operating system.

So, there's your challenge, Microsoft: make Windows 7 more secure, but cut down on UAC annoyances. Is it possible? Sure. But in its current state in Windows 7, it's not enough of an improvement to ensure more security, since many users won't change the default setting, leaving them open to exploitation, while others will ignore most of the prompts.

No one said securing Windows 7 would be simple. But Microsoft has a vested interest in keeping us safe when we use its OS and UAC is a key component in that. Now it needs it to figure out how to make everyone happy. And maybe, eliminating annoyance isn't the best way to do that. Perhaps, annoying us just a little less, is the best way to secure Windows 7.

Check out Don's Digital Home podcast, Twitter feed, and FriendFeed.