Over the past week Long Zheng has been all over flaws that were discovered in Windows 7's implementation of User Account Control by Rafael Rivera. Long and Rafael are terrific young guys, and are among the most technically savvy Windows enthusiast bloggers. When they make a point, Microsoft should listen. Mary Jo Foley has written a great summary of the duo's findings, and came to the conclusion that Windows 7 could be less secure than Windows Vista.

The flaws are so serious that malware can elevate its privileges by exploiting flaws in Windows 7's UAC implementation or even turn off UAC entirely. Yikes! Microsoft has repeatedly said that it is by design, but it has become clear that the default UAC settings aren't secure enough. Microsoft might want to make Windows 7 more user friendly, but it would be a bad idea to backslide on security. There is still a lot of time between now and RTM, so hopefully Microsoft will correct the problem(s) before it(they) becomes our problem(s)

If Microsoft tweaks the default UAC settings (and doesn't submit into stubborness) Windows 7 will be more secure. However, it is not secure by design. Microsoft knows how to design a secure OS, but the trouble is that it cannot acheive the level of security that its engineers desire without starting from scratch.