Hacker News Reader

Comment by AnIdiotOnTheNet | Hacker News Reader

> Microsoft considers this kind of escalation a security issue and will issue patches if this is found in Windows components.

Makes sense, because Windows is also used for servers. The Steam client is not.

> If Steam is installed on a corporate network PC (game development, QA services, esports teams, etc?), regular users being able to elevate to machine admin is a big deal.

No it isn't. This is effectively the same as being installed on some home PC. Being local admin on the workstation doesn't really give you any more ability to do damage than just a regular user account. A non-administrative process still has access to all the user's stuff, and all the network resources that user account has access to. Local admin doesn't really give you anything new.

View on HN

> Being local admin on the workstation doesn't really give you any more ability to do damage than just a regular user account

That's dangerously untrue. On all the Windows systems at home, everybody else is a non-privileged user and I set sane file permissions so they can get to shared movies, etc, but not read my bank details and tax records. Privilege escalation means that they could trivially change those permissions. The same is true of a corporate environment -- just because you can't also make changes to AD doesn't mean the threat of accessing local files under other users' accounts is trivial.

ETA: I just read a bunch of this user's other posts in this thread and I'm beginning to suspect they're trolling, so I'll disengage.

> On all the Windows systems at home, everybody else

Ok, in that scenario it is true, but multi-user desktops in the age of smartphones and tablets are a vanishingly small niche. My experience in corporate environments suggests they are also almost entirely 1:1 as well.

local admin on windows is similar to having sudo rights on linux. It can be used to access personal files and running sessions of other users on the same machine, to install malware that will affect other users, to change drivers, to block AV or GPO policies from being applied to protect them, etc.

Local admin just makes the life of IT guys more difficult. It's why we don't give it out to your typical "worker drone" employees because they'll manage to install many flash players that want to admin escalate....

I've found the opposite, that for the most part people just want to be able to do their job and sometimes they need administrator rights for that, and it is incredibly annoying and frictionful if they need to contact IT every time. Since workstations are almost always 1:1, we don't consider whatever advantages local admin might provide an attacker to be worth the extra friction caused by disallowing it.

Reply on news.ycombinator.com