Windows UAC Security

Isn't this a security hole if an app can change Windows behaviour without prompts?

It does, it's called secure desktop.https://en.wikipedia.org/wiki/User_Account_Control#Features

Is this only on Mac, what about Windows (bypassing UAC?)

In XP, all bets are off, as the vast majority of users run with local admin rights.For Vista and 7, I believe that the much-hated-by-numpties User Account Control should prevent this from happening, as it opens a virtual screen or something to give access to the 'OK/Cancel' dialog.From UAC on Wikipedia: 'User Account Control asks for credentials in a Secure Desktop mode, where the entire screen is temporarily dimmed, Windows Aero disabled, and only the authorization window at full b

Because it would work like permissions on Android or Windows UAC, regular users would just turn everything on anyway.

Windows absolutely does unless you turn User Account Control off. This has been part of the operating system since Vista.

How does Windows get it right? Windows has User Account Control for UI apps, which is a “security” feature that they refuse to fix bypasses in.

Probably because this is not a security issue, as you have to be an administrator on the machine to be able to do that.

I have very limited experience with Windows and don't claim to know much of anything about its security. I was referring to the User Account Control system introduced in Windows 7. Whatever might be happening underneath, the system appears to end up doing the same thing: the user operates in a reduced-privileges mode until specifically authorizing a local, temporary elevation.

Sorry, the argument is:> Windows doesn’t allow you to do that by default unless you’re an admin.The refutation is that by default users are an admin. So no, they’re not protected against persistent threats like UEFI malware.