Hacker News Reader

Hacker News

Comment by nxrabl | Hacker News Reader

Full thread

nxrabl

> There is no question that Windows 10 is ... quite the most secure operating system ever devised.

Telemetry aside, can anyone comment on this?

View on HN

* Secure Boot

* BitLocker: Hard-drive encryption backed by TPM & Secure Boot

With the above two and DMA protection, physical access attacks become very difficult.

* Virtual Secure Mode (VSM) - separate OS running on the hypervisor that can perform sensitive operations. Which enables:

1. Device Guard - Runs code integrity protection, i.e. only allowing signed code to run, from within the VSM.

2. Credential Guard - Runs user-mode security subsystem (LSA) inside VSM.

Regarding hard drive encryption backed by TPM, a) this has been a thing since Win7, and b) google tells me it only works OOTB on Win10 if you sign into Windows with your Microsoft account; how many people do that?

If that's the secret sauce that makes Win10 so much better, color me unimpressed. And neither of those features offer additional protection against zero-days (neither does VSM), which are what the TFA discusses.

It only works OOTB with a Microsoft Account because the OS needs a place to backup the key. The alternative is that if the user forgets their password, they lose their data forever. You can still turn it on manually very easily with a local account.

I am running Bitlocker without a Microsoft Account. You can just print out the recovery key instead (or you can just configure bitlocker through command line).

> With the above two and DMA protection, physical access attacks become very difficult.

Physical attacks aren't part of my threat model on a desktop PC. Indeed these protections feel more like DRM - trying to protect the computer from the (legitimate) user.

Preventing unsigned code from running, and choosing which sources of software you do want to trust, is not just for DRM. It severely reduces the attack surface of a device and makes it much harder for user error to cause a compromise. Accidentally getting compromised is possible for advanced users, let alone the most tech-illiterate person in the company.

iOS being totally locked down in this way is no small part of why exploits for that platform sell for so much more money than exploits for other platforms. Of course, it is also used for DRM on that platform.

And to add to my previous comment, I can't see why you would want to keep your laptop or desktop unencrypted. If someone steals your computer, they have access to all of your data.

And without Secure Boot and/or TPM-backed key management, hard disk encryption becomes vulnerable to someone planting a modified boot loader or firmware on your system.

Weren't all of those in 8?

Well, the most secure OS is something that's going to be endlessly arguable, but its probably the most secure Windows considering how people use computers today and how many attack surfaces a modern OS has.

A lot of security features found in the previously stand-alone EMET are slowly being ported over natively to Win10, for example. It comes with a built-in AV which is pretty good. Smartscreen is unusually good at warning about suspicious executables and I've seen it stop ransomware attacks. VBS makes it harder for hackers to modify system or protected files. Secureboot and bitlocker support are useful in some scenarios. Device guard is supposed to helpful but I'm not sure how it works. Windows hello can replace the traditional password with camera or fingerprint auth cooked-in, which is probably a step in the right direction, although I'd rather see passphrases become more common. Cameras and fingerprints seem gimmmicky and not all my computers have those things.

Windows Hello is the new platform for authentication. I imagine that all authentication APIs are grouped into Windows Hello, including traditional passphrases.

I question it. In my opinion, OpenBSD is the most secure OS that is likely to be used on a home computer. As for the most secure OS devised for any commercially available computing-capable device, I'd probably pick VxWorks.

But for an RMS-level of paranoia, I might have to go with RTEMS on a FPGA acting as a J-Core (SuperH-2) CPU.

Compared to BSD? (One of the BSDs, that focuses on security, I forget which one.) Yeah, I don't buy it. But I bet the writer at The Economist never heard of BSD...

OpenBSD, if you weren't being sarcastic

No, I wasn't being sarcastic. I've never used BSD, of any flavor, but I recall that was was focused obsessively on security.

Absent evidence to the contrary, I presume that OpenBSD is more secure than any Windows, even Windows 10, but has considerably fewer features. Do you know of actual evidence?

Reply on news.ycombinator.com