5 ms·

> There is no question that Windows 10 is ... quite the most secure operating system ever devised. Telemetry aside, can anyone comment on this?

• drzaiusapelord 10y ago
  Well, the most secure OS is something that's going to be endlessly arguable, but its probably the most secure Windows considering how people use computers today and how many attack surfaces a modern OS has. A lot of security features found in the previously stand-alone EMET are slowly being ported over natively to Win10, for example. It comes with a built-in AV which is pretty good. Smartscreen is unusually good at warning about suspicious executables and I've seen it stop ransomware attacks. VBS makes it harder for hackers to modify system or protected files. Secureboot and bitlocker support are useful in some scenarios. Device guard is supposed to helpful but I'm not sure how it works. Windows hello can replace the traditional password with camera or fingerprint auth cooked-in, which is probably a step in the right direction, although I'd rather see passphrases become more common. Cameras and fingerprints seem gimmmicky and not all my computers have those things.
  • alexkavon 10y ago
    Windows Hello is the new platform for authentication. I imagine that all authentication APIs are grouped into Windows Hello, including traditional passphrases.
• marcoperaza 10y ago
  * Secure Boot * BitLocker: Hard-drive encryption backed by TPM & Secure Boot With the above two and DMA protection, physical access attacks become very difficult. * Virtual Secure Mode (VSM) - separate OS running on the hypervisor that can perform sensitive operations. Which enables: 1. Device Guard - Runs code integrity protection, i.e. only allowing signed code to run, from within the VSM. 2. Credential Guard - Runs user-mode security subsystem (LSA) inside VSM.
  • semi-extrinsic 10y ago
    Regarding hard drive encryption backed by TPM, a) this has been a thing since Win7, and b) google tells me it only works OOTB on Win10 if you sign into Windows with your Microsoft account; how many people do that? If that's the secret sauce that makes Win10 so much better, color me unimpressed. And neither of those features offer additional protection against zero-days (neither does VSM), which are what the TFA discusses.
    • marcoperaza 10y ago
      It only works OOTB with a Microsoft Account because the OS needs a place to backup the key. The alternative is that if the user forgets their password, they lose their data forever. You can still turn it on manually very easily with a local account.
    • chrisper 10y ago
      I am running Bitlocker without a Microsoft Account. You can just print out the recovery key instead (or you can just configure bitlocker through command line).
  • AlexandrB 10y ago
    > With the above two and DMA protection, physical access attacks become very difficult. Physical attacks aren't part of my threat model on a desktop PC. Indeed these protections feel more like DRM - trying to protect the computer from the (legitimate) user.
    • marcoperaza 10y ago
      Preventing unsigned code from running, and choosing which sources of software you do want to trust, is not just for DRM. It severely reduces the attack surface of a device and makes it much harder for user error to cause a compromise. Accidentally getting compromised is possible for advanced users, let alone the most tech-illiterate person in the company. iOS being totally locked down in this way is no small part of why exploits for that platform sell for so much more money than exploits for other platforms. Of course, it is also used for DRM on that platform.
• AnimalMuppet 10y ago
  Compared to BSD? (One of the BSDs, that focuses on security, I forget which one.) Yeah, I don't buy it. But I bet the writer at The Economist never heard of BSD...
  • oldsj 10y ago
    OpenBSD, if you weren't being sarcastic
    • AnimalMuppet 10y ago
      No, I wasn't being sarcastic. I've never used BSD, of any flavor, but I recall that was was focused obsessively on security. Absent evidence to the contrary, I presume that OpenBSD is more secure than any Windows, even Windows 10, but has considerably fewer features. Do you know of actual evidence?
• logfromblammo 10y ago
  I question it. In my opinion, OpenBSD is the most secure OS that is likely to be used on a home computer. As for the most secure OS devised for any commercially available computing-capable device, I'd probably pick VxWorks. But for an RMS-level of paranoia, I might have to go with RTEMS on a FPGA acting as a J-Core (SuperH-2) CPU.