3 ms·

I don’t need it, but I can understand why this gets traction. Enterprises can essentially give out a tightly controlled windows client to anybody that needs it,

I don’t need it, but I can understand why this gets traction. Enterprises can essentially give out a tightly controlled windows client to anybody that needs it, even if they are running a Mac. Severely restrict Windows without taking away liberties of the computer that the employee has. An employee can simply login to their Windows workspace and continue work regardless of their their thin client(s). Update windows without annoying your employee… Prevent employees from installing that random chat program that is almost definitely a spyware right alongside their work programs.. Oh and prep a golden image Windows workspace and onboard any employee within seconds.. I can see how this product makes its argument to enterprise IT.

candiodari 5y ago
But I don't get it. I've helped out with security at a bank, and one of our big problems was persistent and very advanced efforts by malicious actors to compromise endpoints. I've seen Trojans that would detect keypresses that look like bank accounts, take a screenshot and put it on top, replace the bank account number and then, seriously, detect with ocr on the confirmation page where the replaced account was and replace it there too. And these were made to steal amounts like 2k euro, maximum. I mean I guess that's still 2k euro * 1000 or so victims, but still (they do it this way because of 2FA, the customer must confirm on a second device, the little irritating calculators, the transaction) Everything depends critically on endpoint security. You cannot make this work securely. I mean a simple Trojan could simply fake a logout, then transmit the screen + keypress control to an attacker. And I would add: your enterprise security is not just dependent on a device you don't control, this also represents a "get out of jail free" card for malicious insiders. If they just make sure to have 4-5 viruses installed on their home machine, whatever they did in the company machine is excused ...

candiodari 5y ago

But I don't get it. I've helped out with security at a bank, and one of our big problems was persistent and very advanced efforts by malicious actors to compromise endpoints. I've seen Trojans that would detect keypresses that look like bank accounts, take a screenshot and put it on top, replace the bank account number and then, seriously, detect with ocr on the confirmation page where the replaced account was and replace it there too. And these were made to steal amounts like 2k euro, maximum. I mean I guess that's still 2k euro * 1000 or so victims, but still (they do it this way because of 2FA, the customer must confirm on a second device, the little irritating calculators, the transaction) Everything depends critically on endpoint security. You cannot make this work securely. I mean a simple Trojan could simply fake a logout, then transmit the screen + keypress control to an attacker. And I would add: your enterprise security is not just dependent on a device you don't control, this also represents a "get out of jail free" card for malicious insiders. If they just make sure to have 4-5 viruses installed on their home machine, whatever they did in the company machine is excused ...