Microsoft forced users to install a password manager with a critical flaw
arstechnica.com
arstechnica.com
They're obviously playing on the majority of users' ignorance. This is despicable.
I think this might be an indicator of a larger trend that's at its tipping point.
I've been meaning to ditch Windows (again) for a while and this is the final straw.
I'm picturing a very upset buccaneer.
MS have always been known for producing poor quality software, but they'd never been actively untrustworthy and hostile to the end-user... that completely changed with Windows 10
2.5 years later and I don't feel as if I've lost anything, I guess it was the push I finally needed to dump Windows forever
The core thing imho is: the software quality has gone up
- security - just remember Win9x which didn't even have security as a concept and exploit-ridden WinXP
- native Linux subsystem, ssh server
- decent shell if you care enough to learn Powershell
- a well set up AD/Exchange is blowing away all FOSS comparables due to the insane level of integration - it all feels like it's cut out of the same block, from an admin POV
What has gone downhill is the lengths of where MS decided to go to earn money. The market for selling an OS just isn't as huge as before - Apple provides OS upgrades for free since 2013, Linux was free the whole time and Googles Chromebooks don't need any major OS as they're essentially Chrome-in-a-box - and selling Office also went downhill since the competition in form of Google Docs and Libre/OpenOffice became actually usable even for corp and government environments. In addition, revenue from Bing fell through the roof because Googles dominance keeps growing and growing.
The direct consequence is that MS must keep earning money somehow: corps and governments will continue to be the biggest buyers (but the numbers are set to fall, given the rise of Apple but also the trend towards Linux in governments), but ordinary people? MS has to compete with Apple and Google's "free", and so has to subsidize with ads and boatloads of tracking.
Anyway I've gone off the rails a bit - what MS, or rather, power users, desperately need is Win 10 LTSB actually available for sale and not just for embedded stuff. Plain good old Windows Classic UI, no ads, no "magically appearing" "features"... aka Windows 7, only with optional features like the Linux subsystem.
did we read the same article?
there is no security as it's not your machine, it is under Microsoft's control and now they've been caught installing unwanted crapware with 16 month old vulnerabilities
(not to mention the OS is infested with undisablable adware, spyware and other unwanted uninstallable applications)
lip service to developers (bundled openssh et al.) doesn't hide that the core of the company is now demonstrably rotten
> (not to mention the OS is infested with undisablable adware, spyware and other unwanted uninstallable applications)
This is why I advocate for something like W10 LTSB - free of the experiments, but paid. If I had the option to switch to paid and only get security updates but no "features", I'd do so in an instant. I don't want to be forced to trade privacy for being able to use the OS.
Can you please provide at least a few citations? I've run ShutUp10 after the installs and upgrades and I don't recall seeing much of anything of what you report.
... then they go back to telling you "I've never had a problem with it."
I use Windows 10. I support it professionally. The underlying system is good. And then someone at Microsoft decided to completely fill all of those kernel upgrades, with a gigantic pile of spyware, adware, and useless crap. (4 GB+ of Windows Store videogames?!)
One of my laptops is a "windows 10 ready" work laptop with a 5400 RPM hard drive. Between defender, indexing, telemetry, and app compatibility scans, it takes over 60 seconds to get to desktop. If you load the task manager, the disk usage is 100% for hours. And any time Windows decides to install or compile something (without warning or even a notification, like rebuilding .NET) the entire computer becomes a useless brick. I used to be able to make the machine functional by turning off unnecessary, bloated services like Defender and Telemetry. Except every Windows Creators update they not only reset my settings, its disable Classic Shell, UNINSTALLS Core Temp and a WindowsGadgets re-enabling tool because they're "not compatible" (even though they work fine), and... they change the menus so that it's harder to find the button to disable Defender, and they make it harder (if not impossible) through Group Policy changes to disable those very same, taxing, services.
Try this: Install Windows 10, upgraded from 7/8/old-10. See Windows.old on your C:\? That's your old windows copy. Try to delete it. After all, it's useless right?--and takes over 20GB. Nope. Sorry. You don't have permission to delete it. That's right. Your own hard drive you don't have permission to touch. And, laughably, Windows will tell me "You're running out of HDD space, want to delete the old folder?", I say "Yes." Then nothing happens and the message appears again.
I tried taking "ownership", used admin account, I tried changing permissions. Nothing. A professional windows IT support employee should not have to look up countless articles TO DELETE A FREAKING DIRECTORY. Even after I took "complete" ownership of all that, many files still didn't set, and I couldn't delete the whole thing.
I'm half tempted to boot into a Linux Live USB and delete it by force. But then I realize, "I'm going to download an ISO for another OS, burn it to a USB, then shut down my machine and reboot it... JUST TO DELETE A FOLDER?!"
Oh, and this is Enterprise edition. So I'm running the edition that everyone says "if you care about tuning Windows, you should have already bought Enterprise." Thanks for that lie.
Load the performance monitor (button on the Performance tab in task manager), go to Disk and see what process is doing it. You may have something like full disk indexing going.
Regarding Windows.old,isn't that supposed to auto - clear after ~30 days? Also, the first two articles on a search for "remove windows.old" appear to confirm my expectation that the disk cleanup tool will remove it, possibly without even running it as administrator. Frankly this sounds like it's getting into "respect mah authoritah" territory.
For the games, are those preinstalled? I haven't seen such, but most of the Win10 systems in dealing with so far are either upgrades or business class machines. If you're getting Enterprise systems preinstalled with 4gb of games someone needs to talk to your supplier.
App telemetry, defender, compatibilty, etc.
>Frankly this sounds like it's getting into "respect mah authoritah" territory.
Yeah, it must really suck to have the burden of being able to delete files that aren't in use on your machine that you own, run, and paid Enterprise edition for.
What possible use could a professional system administrator need for changing files on a machine... except the exact use I just mentioned.
If you can't understand why having admin file access is important, then I suggest you never try Linux (or... Windows 7... or any IT job) because you will be horrified by the potential control you have over your system.
The standard solution to that is compeltely anticlimactic. Just run the disk cleanup program (diskmgr), and there’ll be an option to remove “previous windows installations”.
It IS possible to manually delete it, but you would need to do the “take ownership” thing; being an admin user does not immediately give you permission to override security on files owned by TrustedInstaller, but you COULD still take ownership.
That being said, the last time I checked it wasn’t easy to get the “take ownership” thing work recursively.
It seems to me that under the hood, Windows is actually reasonably good. But the user experience had been slowly going downhill for a while since Windows 8, even though IMO it’s still okay-ish, despite Windows 10’s many annoyances.
While true, it should be noted that Tavis Ormandy is not just any "outsider" and is something of a god when it comes to finding vulnerabilities.
"If they did it, then our game dev can too!" Like large programs are just some kind of widget you can just move from place to place.
I make functional requirement emphasizers starting by product managers directly responsible for this.
Their fantasy is to be the next Steve Jobs' era Apple but usually they first become the next Equifax.
Good like buying it easily if you not a premier partner or msdn subscriber.
We just qualified for our new client machine builds and will be providing that to customers only going forward for win10 requests.
Have not checked if this password keeper still gets deployed, will have to check monday. If it's distributed part of Windows store, then it won't be cause that's stripped out itself
However, I like the flexibility to use any "file sync" tool I want to pass KeePass files around between my devices (or none at all, depending on the threat model of individual password files). That opens up flexibility to use things like Keybase File Share and Resilio Sync Encrypted Shares where you have additional options in in-transfer and at-rest encryption of your files.
[1] In that category some security-minded friends that I trust have done their own research on the subject recommend Dashlane over LastPass.
For a graphical password manager, consider instead PasswordSafe, KeePass, KeePassXC. They're not complicated. Don't look for or enable any integrations. Manually copy your encrypted password database to google drive or dropbox. It's simple and secure.
Anything more automated and "easy" is almost always found to be vulnerable. LastPass and OnePass have both had problems with their fancy online accounts and recovery systems and browser integrations. Just don't bother with all that crap, you don't need it.
But I'd recommend keepass if you want something graphical.
I just tried it and the lack of plugin or sync support was a deal-breaker for me. I have plugins for syncing to cloud storage, for browser integration, for OTP generation, etc., none of which it seems to support?
These days AgileBits(the 1password people) are doing everything they can to get everyone onto a subscription plan, and are breaking local vaults slowly. Most people don't seem to recommend it anymore.
The only security issue really is the online vault(which isn't a security issue per-say, but is a security weakness since your passwords are no longer under your direct control). This may or may not be an issue for you, depending on your security posture.
But other researchers have played with 1password and most have historically had good things to say about it, except recently when they started pushing everyone to the online vaults like I mentioned.
And yes, he is a security researcher for Google.
This technique might not work so well for people who actually have to share devices, log out of things, etc.
Really? Why?
WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues
This page exists only to help migrate existing data encrypted by TrueCrypt.
The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms (click here for more information). You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform.
If you're just starting, here's some guidance on setting up a password manager.
First of all: Don't be afraid of using one. It's not just more secure, it's super convenient. Never again will you ask yourself: Did I make an account for this website/service? What email did I use? Never again will you have to remember a password. Using a password manager is a quality of life improvement.
KeepassXC is what I recommend to people at this point. It's free and you own your data (your passwords). They live wherever you want them to live. There are plenty of online services that are supposedly more convenient but I have to say I trust them less -- YMMV (1Password is the best I'm aware of).
If you do use keepassxc, you get the added benefit of being able to store 2FA settings in it as well (if you store them in the same database as your passwords, be aware that you lose the security benefit of a second factor, however it is still more secure than not having 2FA enabled due to the One-time password component).
Put every account you ever made and ever make into keepass. Enable 2fa wherever you don't have it enabled. Add login URLs and notes. Generate your passwords from keepass itself; the password generator is really powerful and lets you very easily deal with site-specific shitty password limitations. I'm telling you this because, seriously, it's incredibly convenient to have this stuff as long as you're rigorous about maintaining it.
Oh, also, keepass has the full history of all your passwords. Need to look up an old password? Go into details and look at "History". You can also attach files to items (items don't have to be accounts at all, you can use keepassxc as a simple encrypted storage db).
Mobile support: Keepass2Android. Best android client, with google drive support. iOS I have no idea, suggestions welcome.
IMPORTANT: BE STUPIDLY PARANOID AND RIGOROUSLY CAREFUL ABOUT YOUR MASTER PASSWORD. That thing, together with your keepass database, unlocks all your accounts ever. Use a really long passphrase that you will never have to write down (if you do decide to write it down because you don't trust yourself, store it in a safety deposit box, don't put it in a bloody drawer). Make sure the device you unlock the database on is malware-free.
PS: Wondering what's up with Keepass vs. KeepassX vs. KeepassXC? Keepass is the original app, written in .NET but with poor multi-platform support. KeepassX is a rewrite in Qt and is a fantastic password manager, but has gone unmaintained recently. The open source community picked up the slack in the KeepassXC fork (after continuing countless attempts to upstream the patches) and has implemented lots of powerful features. I've switched to it and at this point I strongly believe it's the better client.
These days AgileBits(the 1password people) are doing everything they can to get everyone onto a subscription plan, and are breaking local vaults slowly. Most people don't seem to recommend it anymore.
Now you have other options:
* KeepassXC (the latest seemingly well-recommended keepass variant - but there are a bunch of them)
* Bitwarden (it's OSS and can support author(s) with payment. Can run on your own server/machine while still supporting cross device sync)
* Pass (and the go variant, and the Qt variant) uses GPG under the hood, basically just a directory/git repo full of encrypted text files. Sync across devices is your problem.
I'm seriously evaluating Bitwarden to replace 1Password as it's pretty simple to understand and has a similar strategy as 1Password security wise, but is OSS.