&gt; From my experience there are very few legit reasons for intercepting keys, and the use cases you mentioned are better solved by implementing a device driver (which would be signed by MS).<p>That&#x27;s assuming you have control over what third parties who write the software have done, and needing to go through the expensive bureaucratic process to get a driver signed is a major reason why they <i>wouldn&#x27;t</i> do it that way if there was any alternative.<p>&gt; Allowing non-elevated code to install system hooks also enlarges the attack surface, since now a malware piece can just infect your keyboard layout translator for getting keyboard access.<p>But now you&#x27;re not talking about antivirus anymore. Installing things is expected to require privileges. There is a huge difference between a password prompt that says &quot;authenticate if you want to install&quot; and a red alert that says &quot;malware detected and blocked, override may cause fire and mayhem.&quot;<p>Which is <i>especially</i> problematic when it&#x27;s done by third party antivirus because it means the vendor of whatever software is being misdetected as malware probably didn&#x27;t encounter that in their testing.<p>&gt; Me, I would like an Intent&#x2F;Permission mechanism on Windows, where certain actions like keylogging or accessing other processes memory require explicit white-listing (like on Android&#x2F;iOS). Currently some actions do require a certain privilege, but that privilege is granted per-user, not per-app, so it doesn&#x27;t help that much.<p>Fundamentally non-technical people don&#x27;t understand what they&#x27;re authorizing. It doesn&#x27;t matter how granular the choices you provide are if the person in front of the button doesn&#x27;t understand the implications.<p>You have to be able to trust the software you run, which implies trusting the people who made it. And people keep trying to solve that problem centrally when it isn&#x27;t a central problem. Microsoft can&#x27;t tell you if you can trust your brother, or the girl you met at the computer club. They can&#x27;t tell you if you can trust Lenovo or Sourceforge. Microsoft certainly can&#x27;t tell you if you can trust <i>Microsoft</i>. You have to decide, or decide who to trust to decide for you. And if you aren&#x27;t going to decide for yourself then the person you trust to decide can&#x27;t be Apple or Microsoft, it needs to be someone you personally actually trust, because central gatekeepers can&#x27;t be trusted not to act against your interest when it&#x27;s in theirs.