4 ms·

Most Windows malware I see today runs with the rights of the logged-on user. Encrypting file servers (at least portions thereof), exfiltrating data, and spreadi

Most Windows malware I see today runs with the rights of the logged-on user. Encrypting file servers (at least portions thereof), exfiltrating data, and spreading via email are all easily accomplished with the rights available to a normal user. Without a privilege escalation exploit the attacker probably can't install a driver or spread to other user sessions on the same machine, but everything accessible to the logged-on user is accessible to the malware. Without a capabilities-based security model I don't see what good the "for security" changes in Windows 11 really bring to the table for end user security. Capabilities-based security would be a major breaking change for legacy software anyway. More than likely, would just result in IT departments granting all capabilities to all legacy software. The Windows 11 "security" seems more about removing general purpose computing access for "tinkering" end users to enable more draconian DRM, walled-garden type business models, etc.

alexmcc81 5y ago
I kind of agree. Cynically I see Windows 11 as a big leap for Microsoft in terms of getting to their own ChromeOS. Mandatory online accounts, integrated Teams, very dark patterns to force Edge usage (with all the associated tracking), pushing One Drive hard... all to get a totally surveilled, locked-in user dependent on their cloud services who is a rich source of data for advertising and a target for monthly service charges.
- dvfjsdhgfv 5y ago
  Based on the initial reactions I have a feeling this move can backfire. I don't believe most people with obsoleted hardware will switch to Linux - they'll be using Windows 10 for as long as they can, but I think some portion of them will consider a switch, at least on private machines. There is a limit of abuse you can tolerate.
  - einr 5y ago
    There is a limit of abuse you can tolerate. This is the exact belief that lots of people had with regard to the Windows 7 -> 10 migration. Turns out, when people feel like they don't really have a choice, they will tolerate a lot of abuse. In fact, I'm not sure that there is a limit to the amount as long as the abusers make sure to boil the frog slowly.
  - alexmcc81 5y ago
    I don't see it backfiring much to be honest. I see a lot of people keeping Windows 10 as long as possible... until Microsoft pushes an update to their machines with increasingly annoying messages until they accept - a strategy they have already deployed successfully. Defaults always win and laptop vendors will advertise Windows 11 as more secure. What choice do people have? If anything, this may push a few people to Apple. If you are going to give up all your privacy and pay for services, why not choose the company with the best hardware and integrated and polished UIs?
    - HappySweeney 5y ago
      I don't know about the switch to Apple. First, there is the sticker shock, which is no small issue. Also, have you seen Windows users attempt to use a Mac? They enjoy it about as much as Mac users enjoy Windows.
      - alexmcc81 5y ago
        I used to think that too until I saw a family member dump Windows for Mac. iPhones are a hell of a gateway drug.
    - handrous 5y ago
      > I don't see it backfiring much to be honest. I see a lot of people keeping Windows 10 as long as possible... until Microsoft pushes an update to their machines with increasingly annoying messages until they accept - a strategy they have already deployed successfully. At least they can't trick people into accepting upgrades this time.
- 908B64B197 5y ago
  > very dark patterns to force Edge usage vs aggressive opt-out Chrome installers bundled in multiple popular apps like CCLeaner? Or endless pop-outs as soon as someone ends up on an alphabet-owned website? Seriously, settings and files shared among devices (like on iOS) is a pretty great feature for the average consumer. I understand that Pro users that had filesync since DropBox launched in 2007 don't see the added value.
  - alexmcc81 5y ago
    I don't see how Google's bad behaviour with Chrome installers excuses Microsoft in any way. Arguably Microsoft is still worse since they intentionally obfuscate system settings so even informed users have difficulty changing their browser settings (which 'sententiously' reset to Edge every so often). I agree that file sharing is a great feature. I use One Drive every day. However Dropbox is not running an advertising network embedded in their OS nor are they placing ads in the default file explorer in an OS to upsell users on services.
jsnell 5y ago
A guaranteed TPM on all major computing platforms is kind of a big deal, since it is our best chance at making bearer tokens secure against theft by malware. Given how long MS supports Windows, this is exactly the right time for this requirement.
66fm472tjy7 5y ago
I expect this will end with a web API for remote attestation. Several standards for remote attestation are in the works[1]. Servers will be able to check that you are running a popular walled-garden operating system that does not allow sideloading before delivering content to you. That way they can know that you are not running an ad blocker, you aren't able store the video stream, etc. Something similar already exists with Widevine certification levels[2]. It won't matter that you have open source hardware and OS that can run any code, you won't be able to access most mainstream content with it. Devices allowing general computation will be useless to most people and thus be relegated to a small enthusiast niche. I am disappointed by how little skepticism there is on this and how all tech media I've seen simply regurgitate the "TPM == 60% less malware, nothing nefarious going on here" claim. [1] https://tools.ietf.org/wg/rats/ https://tools.ietf.org/wg/rats/ [2] https://technicaljayendra.com/widevine/#Widevine_Certification_Levels https://technicaljayendra.com/widevine/#Widevine_Certificati...
- EvanAnderson 5y ago
  I hate the tech industry so much now. Almost everything I love about computers is being taken away and replaced with pay-per-use subscription-based watered-down facsimiles of the cool stuff that general purpose computers can do.

alexmcc81 5y ago

I kind of agree. Cynically I see Windows 11 as a big leap for Microsoft in terms of getting to their own ChromeOS. Mandatory online accounts, integrated Teams, very dark patterns to force Edge usage (with all the associated tracking), pushing One Drive hard... all to get a totally surveilled, locked-in user dependent on their cloud services who is a rich source of data for advertising and a target for monthly service charges.

dvfjsdhgfv 5y ago
Based on the initial reactions I have a feeling this move can backfire. I don't believe most people with obsoleted hardware will switch to Linux - they'll be using Windows 10 for as long as they can, but I think some portion of them will consider a switch, at least on private machines. There is a limit of abuse you can tolerate.
- einr 5y ago
  There is a limit of abuse you can tolerate. This is the exact belief that lots of people had with regard to the Windows 7 -> 10 migration. Turns out, when people feel like they don't really have a choice, they will tolerate a lot of abuse. In fact, I'm not sure that there is a limit to the amount as long as the abusers make sure to boil the frog slowly.
- alexmcc81 5y ago
  I don't see it backfiring much to be honest. I see a lot of people keeping Windows 10 as long as possible... until Microsoft pushes an update to their machines with increasingly annoying messages until they accept - a strategy they have already deployed successfully. Defaults always win and laptop vendors will advertise Windows 11 as more secure. What choice do people have? If anything, this may push a few people to Apple. If you are going to give up all your privacy and pay for services, why not choose the company with the best hardware and integrated and polished UIs?
  - HappySweeney 5y ago
    I don't know about the switch to Apple. First, there is the sticker shock, which is no small issue. Also, have you seen Windows users attempt to use a Mac? They enjoy it about as much as Mac users enjoy Windows.
    - alexmcc81 5y ago
      I used to think that too until I saw a family member dump Windows for Mac. iPhones are a hell of a gateway drug.
  - handrous 5y ago
    > I don't see it backfiring much to be honest. I see a lot of people keeping Windows 10 as long as possible... until Microsoft pushes an update to their machines with increasingly annoying messages until they accept - a strategy they have already deployed successfully. At least they can't trick people into accepting upgrades this time.
908B64B197 5y ago
> very dark patterns to force Edge usage vs aggressive opt-out Chrome installers bundled in multiple popular apps like CCLeaner? Or endless pop-outs as soon as someone ends up on an alphabet-owned website? Seriously, settings and files shared among devices (like on iOS) is a pretty great feature for the average consumer. I understand that Pro users that had filesync since DropBox launched in 2007 don't see the added value.
- alexmcc81 5y ago
  I don't see how Google's bad behaviour with Chrome installers excuses Microsoft in any way. Arguably Microsoft is still worse since they intentionally obfuscate system settings so even informed users have difficulty changing their browser settings (which 'sententiously' reset to Edge every so often). I agree that file sharing is a great feature. I use One Drive every day. However Dropbox is not running an advertising network embedded in their OS nor are they placing ads in the default file explorer in an OS to upsell users on services.

jsnell 5y ago

A guaranteed TPM on all major computing platforms is kind of a big deal, since it is our best chance at making bearer tokens secure against theft by malware. Given how long MS supports Windows, this is exactly the right time for this requirement.

66fm472tjy7 5y ago

I expect this will end with a web API for remote attestation. Several standards for remote attestation are in the works[1]. Servers will be able to check that you are running a popular walled-garden operating system that does not allow sideloading before delivering content to you. That way they can know that you are not running an ad blocker, you aren't able store the video stream, etc. Something similar already exists with Widevine certification levels[2]. It won't matter that you have open source hardware and OS that can run any code, you won't be able to access most mainstream content with it. Devices allowing general computation will be useless to most people and thus be relegated to a small enthusiast niche. I am disappointed by how little skepticism there is on this and how all tech media I've seen simply regurgitate the "TPM == 60% less malware, nothing nefarious going on here" claim. [1] https://tools.ietf.org/wg/rats/ https://tools.ietf.org/wg/rats/ [2] https://technicaljayendra.com/widevine/#Widevine_Certification_Levels https://technicaljayendra.com/widevine/#Widevine_Certificati...

EvanAnderson 5y ago
I hate the tech industry so much now. Almost everything I love about computers is being taken away and replaced with pay-per-use subscription-based watered-down facsimiles of the cool stuff that general purpose computers can do.