Access Control questions

[BillH99999]

I am using MB 4.0.4  1.0.785.

I have turned on the user access option.  Under Settings I have selected all 4 options, General, Notifications, Security, and Account.

When I start MB and click on the Settings cog wheel it doesn't prompt me to enter the password.  Why not?

Also, it opens the settings on the Account Details tab. There I can click on the Deactivate link and deactivate MB without being prompted for the password.  Why not?

I would have expected to have to enter the password in both cases.  In fact I would have thought I'd have to enter the password even before seeing the account details.  

What am I missing?

Bill

Edited December 30, 2019 by BillH99999

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab on the left column
   
   
    
7. Click the Gather Logs button
   
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
   
    
9. Upon completion, a file named mbst-grab-results.zip will be found on your Desktop. Click OK
   
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
    
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

[exile360]

Greetings,

It appears that you have discovered a bug.  I was able to confirm your findings.  If you click to access a different tab in settings that you don't have password protected (such as About or Allow List) and then try to return to the Account Details tab you will find that it does indeed prompt you for the password so I suspect that for whatever reason it is defaulting to that tab and allowing access without requiring a password when the User Access function is enabled.

I will be sure to report this issue to the Product team for analysis.

Please let us know if you find any further issues.

Thanks

[BillH99999]

@exile360

Thanks for the reply.  I was able to confirm that going to a different tab and returning to the account details tab does require entering a password.

Thanks for passing this on the product team.

Bill

[BillH99999]

Now when I open and click on the settings cog wheel it is opening the settings to the Allow List tab without prompting me for my password.  Once there I am able to add items to the allow list without having to enter my password.

For a security program this seems like a major bug and should be fixed asap.  At the very least About tab should be the default tab so that nothing of any importance is available prior to entering the password.

Bill

Edited February 13, 2020 by BillH99999

[exile360]

Thanks for the update.  I'll be sure to pass this on to the Product team.

[LiquidTension]

Thanks for reporting this, @BillH99999.

We're aware of this issue and hope to have a fix in the next update.

[BillH99999]

Thanks for the update.

Bill

[BillH99999]

It the new version 4.1.0 clicking on the settings cog wheel usually takes me to the About tab.  If I try to access any other tab I am prompted for my password... with the exception of the Display tab.  I'm assuming this is as planned as there is no option in access control for that tab.

When it doesn't open to the About tab, it opens to the Display tab.   

Why would it sometimes open to the Display tab instead of always opening to the About tab?

Does this mean a fix for this issue was in 4.1.0?  If so, the issue appears to be fixed.  if not, I guess it is just coincidence that it is now only opening to the About or Display tabs.

Bill

[exile360]

Whenever I access settings for the first time it starts in the General tab (no password set/user access control disabled) and whenever I close the settings panel and then reopen it, it opens to the same tab I was previously viewing so I'm guessing that in your case, whenever you last accessed the Display tab it will open to that tab the next time you access settings.

[BillH99999]

Doesn't happen that way for me.  I went into settings and it opened to the About tab.  I went to the Display tab.  I then closed the settings "window".  I went back into settings and it opened to the About tab.  So I'm not sure why sometimes it opened to the Display tab.

Does anyone know if this issue was supposed to have been fixed in 4.1.0?

Thanks
Bill

[exile360]

Weird, I guess as long as neither tab is protected then it doesn't matter which it opens up to.  Just odd that it is inconsistent I guess.

[BillH99999]

Yes, that is why I wondered if the original issue in my post was supposedly fixed in 4.1.0.  So far it seems to have been fixed in that it seems to never open to one of the protected tabs.

Bill

[LiquidTension]

Hi Bill,

The user access restriction hasn't fully been implemented for the Display tab. We have a story filed to get this implemented with an upcoming update.

Edited March 2, 2020 by LiquidTension

[BillH99999]

@LiquidTension

Thanks for the update.  

Bill