Secure attention sequences force a switch to an unforgeable context
Aliases: SAK · secure attention key · Ctrl+Alt+Del
What it is
A secure attention sequence (SAK) is a key combination intercepted by the operating system below all user code — Windows' Ctrl+Alt+Del is the only mass-deployed instance: pressing it forces the system to tear down every user-mode surface and show only the protected, genuine login or confirmation screen. It is the user-side trigger of the trusted path: one gesture that bypasses all spoofing.
Why it happens
The guarantee comes from where the key is handled: the combination is intercepted in the kernel, and no user-mode app can register to catch it first, so forged dialogs die at this keystroke. The screen shown afterwards is drawn by a protected system surface outside the ordinary window stack, where overlay spoofing cannot reach. The costs come from the same mechanism: the sequence must be fixed, simple and teachable, and tearing away all context interrupts the workflow — so it is enabled only for the highest-value surfaces (login, elevation). Mobile platforms have no equivalent: there is no global key layer and all touch input passes through the user-mode stack, so mobile substitutes system-process drawing plus a hardware trust anchor (confirmation inside the TEE), moving the anti-spoofing duty from a user gesture to a platform channel.
Where it stops holding
The sequence protects only the span from keypress to protected screen, not the session afterwards. Education costs are high — most users do not know what the combination means, and those who do can be spoofed by the phrase "press Ctrl+Alt+Del to confirm," which occupies the same mental slot while directing a different action. Web and mobile have no portable equivalent; on the desktop, third-party tools that remap the combination hollow out the protection.
Applying it
- Keep an OS-level, unforgeable surface for login and full elevation entry points; never ask users to "first press the combination" inside a third-party interface.
- When documentation explains the sequence, include the counter-example: "the system will never ask you to press it inside an ordinary window" — that sentence doubles as a tell for social-engineering scripts.
- Verification: inventory every interface that collects sensitive input and tag its anti-spoofing dependency (SAK / protected surface / hardware confirmation); anything untagged is a gap.