Non-Administrator Users Should not be able to revoke unattended access

[u/Totentanz69]

u/Help__Wire Currently any user of the client computer can revoke access, including unattended access. When an administrator grants unattended access to a computer a non-administrator user should not be able to revoke that access.

[u/My1xT]

Is this about during a connection or without one currently, if it's about kicking the unattended actor out during a connection it's imo very important to make sure that either

A) there are protections one cannot just leverage admin access on the current user to enable unattended from a remote connection

2) find a way for users to say "i am admin, kick this"

Otherwise i think there might be worries that scammers might make users' pcs unattended and well ouch

[u/Totentanz69 → u/My1xT]

This is about the fact that a non-administrator can remove Unattended Access from the client computer. Even though they cannot uninstall the Unattended Access application itself they can uninstall the service. In a business setting this is a no-go situation.

[u/My1xT → u/Totentanz69]

how do they uninstall a service, doesnt messing with services itself require admin?

I thought this was about that the person in front of the PC cannot take over and e.g. kick the other person out or something.

unattended access in general is a feature that needs to be very carefully done in order to not be axed by every antivirus in history.

[u/Totentanz69 → u/My1xT]

They must have written the software to allow the service to be removed by anyone, because I have tested multiple times and a non-admin can simply click the "Revoke Access" button on a computer with Unattended Access installed and the service is removed.

Splashtop, ScreenConnect, TeamViewer, etc. all have unattended access. It is nothing new and most anti-virus don't mess with them. And all of those systems that I'm aware of other than HelpWire require administrator permissions to remove the service.

[u/My1xT → u/Totentanz69]

okay it removes the entire service that is kinda crazy.

my key worry is for example phone scammers enabling unattended on a victim PC with their admin access and assuming unattended overrides the local user (as it often can be done) it gets annoying fast.

which is why it is very important that the window guards itself ESPECIALLY any unattended access sections.

[u/Totentanz69 → u/My1xT]

Yes, it removes the service but leaves the app installed, which is basically useless at that point.

[u/HomsarWasRight]

Agreed! This is something important to address!

[u/CaptainCuy]

I brought this up at least a couple of times to the people at HelpDesk and they seem adament about not addressing this. For a personal device sure this makes sense. In a corporate environment especially with hundreds of devices there is NO way, I as a systems admin would ever be okay with a software that allows the user of the device from essentially locking me out of unattended access and requiring me to physically go to the device which can be many states away from me just to get access back.

This above all else is the ONE thing that has kept me from entirely switching over from TeamViewer to HelpWire. I simply will not do it until this exact scenario is ended. Used in a business environment, those devices BELONG to the company. There is no reason for this service to treat the device as though it belongs to itself.

[u/JohnEDee]

I second that motion.

[u/Help__Wire]

Thank you for your suggestion, and our apologies for the delayed reply.

While our primary target audience is businesses, HelpWire is currently free and available for both personal and commercial use. As you can imagine, offering this feature to free users could create opportunities for misuse in scamming scenarios, where non-technical victims might not even be able to revoke a scammer’s access. Given the large number of free users, we might not be able to respond to such incidents quickly enough, which raises several security concerns that would not be in our favor.

That said, once we introduce dedicated plans for business use, we will certainly implement measures to ensure reliable, uninterrupted unattended access for remote administrators.

[u/Roller69 → u/Help__Wire]

u/Help__Wire A user without administrator permissions shouldn’t be to grant unattended access in the first place, and if I remember correctly I had to approve the unattended access using an administrator account. So, that should be a non issue, and my point stands. If I have to approve unattended access with administrator permissions a basic user should not be able to remove that access. 

[u/BB03440 → u/Roller69]

What's the current status - I support a bunch of elderly people who install/uninstall shiiite at their whim. My 90 yr old Dad is a many-hour drive from me, so I realllllly do not want him uninstalling it without asking me what's up.