You only have to make it as far as the fourth section to see that this doesn't apply only to accounts with auto login enabled. I also don't think it's fair to

You only have to make it as far as the fourth section to see that this doesn't apply only to accounts with auto login enabled. I also don't think it's fair to say there isn't a description of mitigation. They outline exactly how this could be mitigated: microsoft should disable lock screen applications. this quote from the article really distills what this is so bad: > Unlike the first implementation, the new vulnerability is not a developer mistake, but a forced compromise of security and usability, so to speak. If microsoft didn't have a secure way of implementing lockscreen applications, they shouldn't have implemented it at all. Edit: to clarify, the solution isn't even that drastic — simply don't enable lock screen notifications until the user is logged in. It's pretty funny that this vulnerability is partially a side effect of microsoft attempting to mitigate the intrusiveness of their aggressive auto update policies.