News AI
June 28th, 2024

Windows: Insecure by Design

The article discusses ongoing security issues with Microsoft Windows, including recent vulnerabilities exploited by a Chinese hacking group, criticism of continuous patch releases, concerns about privacy invasion with Recall feature, and frustrations with Windows 11 practices. It advocates for considering more secure alternatives like Linux.

Read original articleLink Icon
Windows: Insecure by Design

The article discusses the ongoing security issues with Microsoft Windows, highlighting recent vulnerabilities and design flaws. It mentions a Chinese hacking group stealing US government messages from Microsoft's Exchange Online, emphasizing the lack of security measures. The author criticizes Microsoft for continuously releasing patches to fix security flaws, citing specific vulnerabilities like CVE-2024-30080 and CVE-2024-30078. Additionally, concerns are raised about Microsoft's new feature, Recall, which could potentially invade users' privacy by capturing sensitive information. The article also touches on the difficulty of installing Windows 11 without a Microsoft online account and the automatic setup of OneDrive for file backup. The author expresses frustration with these practices and advocates for alternative solutions like Linux desktops. Overall, the article questions the level of security provided by Windows and encourages users to consider more secure alternatives.

Related

Is 2024 the year of Windows on the Desktop?

Is 2024 the year of Windows on the Desktop?

In 2024, the author reviews Windows 11, highlighting challenges like limited hardware support, lack of installation control, manual driver search, slow updates, and UI lag. They compare favorably to Linux distributions.

My Windows Computer Just Doesn't Feel Like Mine Anymore

My Windows Computer Just Doesn't Feel Like Mine Anymore

The article discusses Windows 11's shift to a more commercial feel, with concerns about ads, updates, and lack of control. Users express frustration, preferring macOS or Linux for simplicity and customization.

Microsoft removes documentation for switching to a local account in Windows 11

Microsoft removes documentation for switching to a local account in Windows 11

Microsoft's removal of Windows 11 local account documentation sparks controversy over mandatory Microsoft account sign-in. Workarounds like command prompts and Rufus tool for local account creation still available. Debate on user autonomy continues.

Windows: Insecure by Design

Windows: Insecure by Design

Ongoing security issues in Microsoft Windows include vulnerabilities like CVE-2024-30080 and CVE-2024-30078, criticized for potential remote code execution. Concerns raised about privacy with Recall feature, Windows 11 setup, and OneDrive integration. Advocacy for Linux desktops due to security and privacy frustrations.

Microsoft a national security threat says ex-White House cyber policy director

Microsoft a national security threat says ex-White House cyber policy director

A former White House cyber policy director raises national security concerns over Microsoft's control in US government IT. Calls for diversification and enhanced cybersecurity amid debates on tech companies' role in national security.

Link Icon 12 comments
By @cjk2 - 4 months
Even as a well known "windows hater", this is hyperbole. It's not insecure by design really. In fact in principle it's a lot better than anything Unix side due to the ACL and security model. It did however exist before anyone gave a crap about security, was implemented in a vastly insecure language and runtime and grew to a huge size and surface area and that is hard to fix retrospectively.

I'll give Linux a stab here: half the stuff I can run can write to my ~/.profile if it wants to. Anything which can read ~ is a problem because there's where all my important shit is...

By @lisper - 4 months
The gulf between what the average person knows and what they would need to know in today's world to live an autonomous self-directed life with full agency, free from covert coercion by large corporate entities, is truly staggering. Every now and then I contemplate writing a book or a series of blog posts with all the things that I wish someone would tell me if I were a young person today, but then I read articles like this which remind me of the magnitude of the task and it takes all the self-control I can muster just to avoid curling up in a fetal position and sinking into the pit of despair, let alone actually start writing.
By @Veserv - 4 months
Of course, we are on what, 30 years of trying and failing to certify protection against attackers with moderate attack potential [1][2].

Page 53: “The evaluator will conduct penetration testing, based on the identified potential vulnerabilities, to determine that the OS is resistant to attacks performed by an attacker possessing Basic attack potential.”

Maybe at some point we will start believing what they achieve in their certifications rather than what their marketing spews.

[1] https://learn.microsoft.com/en-us/windows/security/security-...

[2] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4....

By @electrodank - 4 months
Clickbait titles should be automatically flagged/not even show up on the front page.
By @throw7 - 4 months
Well, Windows UAC was the last user facing push for security. It remains to be seen what Satya thinks, especially of the recent security failures on the backend (the windows client vulnerabilities is a constant and has always been).

The recent "insecurity" pushes are more of getting microsoft to "catch up" to google/facebook in terms of making their users a product they can sell. I'm sure they feel left out as chromebooks have eatin' into their market and supply such nice metrics for advertisers.

By @quietbritishjim - 4 months
Dupe: https://news.ycombinator.com/item?id=40819495
By @AtlasBarfed - 4 months
It IS a national security concern, one that worsens every year.

The US government should be investing billions in Linux to harden it and make it more usable and appealing.

So should Intel, amd, Qualcomm, because that keeps their processors compatible with a rapidly patched mainstream os.

So should the EU.

But... They won't. Surely as long as 90 year old presidents are what we are stuck with.

By @pastage - 4 months
Qube OS is nice, but when people are paid to get things done security is not forgotten but cut by a thousand paper cuts. It might all seem to be based on a secure design somewhere but even in small teams of 50 people you will always find people who have made short cuts.
By @batch12 - 4 months
I dont know what the solution is here short of some kind of vulnerability liability legislation...
By @itsanaccount - 4 months
I remember a few years back AT&T execs/investors talking about HBO when they bought it, that they didn't care what product HBO made, their goal was to capture more of a person's life interacting with media they owned. Like at the highest levels, leadership viewed their lane to extract profits was the entirely of a person's available free time, against hiking or cooking or transit and entertainment just happened to be the vehicle to do it.

When it comes to Microsoft and others, their active business strategy always seems to be overlapping sectors of power and software just happens to be the vehicle to do it. Recall is just the latest tentacle of the strategy.

If a capitalist company with a specific product focus, within a specific market is a healthy cell, I see this type of company as a cancer and think we should treat it just the same. Starve it or destroy it, and if we can't destroy the company then we can imprison investors for this kind of monopolistic behavior.

Knowing hacker news likes myopia and not discussing such concepts as power, my ask to you is how many years do we tolerate this same overreaching behavior from the same places? I'm at 25 now for Microsoft specifically.

By @Genbox - 4 months
What's really annoying me today is the security holes Microsoft is adding – by design – into Windows.

I mean of course Microsoft Recall. This delightful AI addition to the next generation of Windows PCs would have taken regular snapshots of everything you do on your computer.

Security and privacy are not the same thing. I get the frustration about Microsoft's security practices, but equating those two is a mistake.

By @phendrenad2 - 4 months
100% nonsense. Windows itself is as secure as Mac or Linux, and the other points (OneDrive, Recall) are security tradeoffs that make way for features (sort of like how you don't keep your computer in an air-gapped fallout shelter in a file cabinet with a note that says "beware of the leopard". You traded security for convenience, congratulations!)