3 ms·

It's such an absurd lie. If Microsoft's idea of security is to force its users to authenticate online for a local account, they should never be allowed in the s

It's such an absurd lie. If Microsoft's idea of security is to force its users to authenticate online for a local account, they should never be allowed in the software industry at all. They're needlessly and dramatically increasing the attack surface of one of the most security critical software running on user devices.

CrossVR 2y ago
And for what? Make number go up? If it's just another data collection scheme the at least I could understand why.
- bboygravity 2y ago
  Because the NSA pays them to. Why did they do to Skype what they did (first turn it from p2p to centralized and spyable and then just ignore it and let it die)? Same reason.
  - ashoeafoot 2y ago
    i wonder if some Estonian could justvrerelease the p2p originals . After all as america deteriorates its own influence , at some point the lawyers of the big 4 will be seen as barely disguised tendril of a hostile power in Europe . Who cares about your sales contracts if the president goes for Greenland . We might see a SkyEarthFireWater-Open source re-release one day. Just another tradewar anecdote .
    - bboygravity 2y ago
      America deteriorates its own influence? wut? The big 4 will be seen as a hostile power within Europe? The big 4 ARE (mostly) European. What are you talking about? Sales contracts? What do you mean in what context? I agree that it would be cool if the original p2p Skype somehow resurfaces, but I can't make any sense of the rest of your post or what it has to do with the subject at hand?
      - ashoeafoot 2y ago
        FANG is definitely not European .
    - isaacremuant 2y ago
      Join us back in the real world with no Trump derangement syndrome and you'll find out that European governments want an airtight control on companies so they can surveil them and people absolutely. They want narrative control and squashing rising political opposition.
  - sterlind 2y ago
    (Opinions are my own, I have no inside knowledge.) I vaguely remember hearing that P2P Skype was the bane of sysadmins' existence. Skype would elect clients on high-bandwidth networks as supernodes. This tended to be business customers - the very organizations MS wanted to attract. Skype's prodigious hole-punching ability made it difficult to throttle, so it got banned from a lot of enterprises. MS essentially hosted the supernodes on Azure, which centralized it. As for encryption, on the other hand, Wikipedia says MS specifically added the ability to eavesdrop for law enforcement agencies, though apparently Skype had already added a backdoor for the NSA before MS bought them: https://news.softpedia.com/news/Skype-Provided-Backdoor-Access-to-the-NSA-Before-Microsoft-Takeover-NYT-362384.shtml https://news.softpedia.com/news/Skype-Provided-Backdoor-Acce...
    - somenameforme 2y ago
      This [1] is one of my favorite leaks from Snowden revelations, and I regularly bring it up anytime people try to downplay what PRISM is. That's a user manual for NSA agents on how to spy on Skype users (including video and text) in real time. It's informative and also amusing at times. For instance in the FAQ one issue a confused spook might run into is why they're being spammed with the same messages repeatedly. It turns out that when a user logs on to a new device, the recent messages Microsoft sends to the user are also directly forwarded to the NSA, which can result (from their perspective) in messages being repeated. [1] - https://www.aclu.org/sites/default/files/field_document/Guide%20for%20Analysts%20on%20How%20to%20Use%20the%20PRISM%20Skype%20Collection.pdf https://www.aclu.org/sites/default/files/field_document/Guid...
    - jofla_net 2y ago
      I remember the old supernodes p2p app, was good times. I used to leave an extra old laptop on with it running, maybe 15 years ago, on a public address. During the arab spring, tons of traffic could be seen connecting clients in north africa. It truly did route around things.
userbinator 2y ago
It's an argument for increased security in the same way that they consider uploading the contents of your hard drive to their servers to scan for "malware" (and other undesirable-to-them content) is. Corporate authoritarianism.
- miohtama 2y ago
  The trick is that most of the users need this service. Before Windows Defender was built in you had to buy an anti virus software from sneak oil Windows security industry, and likely get somehow scammed in process. The same companies sell anti virus for Android today. Also most users is not all.
  - badsectoracula 2y ago
    But this made Windows Defender an actually good and useful feature for the users. Requiring an online account to use Windows isn't really the same thing.
    - GoblinSlayer 2y ago
      Except that on Home edition it detects everything as a virus, so all programs have an explanation that if Defender detects it as a virus, then just ignore it.
      - badsectoracula 2y ago
        I haven't been using Windows as my main OS for a few years now but at least when i used it with Windows 10 it didn't detect "everything as a virus". In fact i can't even remember a single time i had issues with Windows Defender. Unless you refer to Windows SmartScreen? That is a different thing - really about how popular some program is (though Microsoft did put it under Windows Defender at some point so it can be confusing) - and isn't about the antivirus (which is what i was referring to).
  - hulitu 2y ago
    > Before Windows Defender was built in you had to buy an anti virus software from sneak oil Windows security industry, and likely get somehow scammed in process. And now you get the same from Microsoft. Clearly an inprovement.
charcircuit 2y ago
Microsoft's idea of security is moving people away from local accounts protected by passwords and to Microsoft accounts protected Windows Hello. The Windows Hello PIN is protected by the TPM. This means you can't brute force it like a password could be.
- soraminazuki 2y ago
  That has nothing whatsoever to do with the topic, which is forcing online authentication. You can't possibly argue that needlessly forcing online authentication makes user safe.
  - charcircuit 2y ago
    The topic isn't about forcing online authentication. It's about improving security from having users use a Microsoft account. The security improvement of using a Microsoft account comes from Windows Hello.
    - soraminazuki 2y ago
      It is. You can check by reading the title. Your's is a reiteration of Microsoft's preferred talking point that has no basis in reality. Tying local authentication to the cloud tremendously increases the attack surface for those who don't need it. TPMs do nothing to change this fact. The only connection between a TPM and a Microsoft account is that Microsoft chose to tie those two together for their own benefit.
    - beeflet 2y ago
      They couldn't just implement whatever biometric thing that is without making it tied to an account?
- GoblinSlayer 2y ago
  To brute force a password, attacker needs full access to the system, guessing the password won't give them more access.
anothernewdude 2y ago
If windows is security critical for you, I think you've already shat the bed.
- soraminazuki 2y ago
  The problem is that many other people and organizations run Windows and it's absolutely security critical for them. And because we don't live in a vacuum, it's security critical for all of us.
- consp 2y ago
  Some windows versions have cc certification. Doesn't say much but it ticks the box some people want and call it a day.
grishka 2y ago
It's the entire industry's idea of security for the last 10 years or so that the company who made the thing is unquestionably more trustworthy than the users themselves.

CrossVR 2y ago

And for what? Make number go up? If it's just another data collection scheme the at least I could understand why.

bboygravity 2y ago
Because the NSA pays them to. Why did they do to Skype what they did (first turn it from p2p to centralized and spyable and then just ignore it and let it die)? Same reason.
- ashoeafoot 2y ago
  i wonder if some Estonian could justvrerelease the p2p originals . After all as america deteriorates its own influence , at some point the lawyers of the big 4 will be seen as barely disguised tendril of a hostile power in Europe . Who cares about your sales contracts if the president goes for Greenland . We might see a SkyEarthFireWater-Open source re-release one day. Just another tradewar anecdote .
  - bboygravity 2y ago
    America deteriorates its own influence? wut? The big 4 will be seen as a hostile power within Europe? The big 4 ARE (mostly) European. What are you talking about? Sales contracts? What do you mean in what context? I agree that it would be cool if the original p2p Skype somehow resurfaces, but I can't make any sense of the rest of your post or what it has to do with the subject at hand?
    - ashoeafoot 2y ago
      FANG is definitely not European .
  - isaacremuant 2y ago
    Join us back in the real world with no Trump derangement syndrome and you'll find out that European governments want an airtight control on companies so they can surveil them and people absolutely. They want narrative control and squashing rising political opposition.
- sterlind 2y ago
  (Opinions are my own, I have no inside knowledge.) I vaguely remember hearing that P2P Skype was the bane of sysadmins' existence. Skype would elect clients on high-bandwidth networks as supernodes. This tended to be business customers - the very organizations MS wanted to attract. Skype's prodigious hole-punching ability made it difficult to throttle, so it got banned from a lot of enterprises. MS essentially hosted the supernodes on Azure, which centralized it. As for encryption, on the other hand, Wikipedia says MS specifically added the ability to eavesdrop for law enforcement agencies, though apparently Skype had already added a backdoor for the NSA before MS bought them: https://news.softpedia.com/news/Skype-Provided-Backdoor-Access-to-the-NSA-Before-Microsoft-Takeover-NYT-362384.shtml https://news.softpedia.com/news/Skype-Provided-Backdoor-Acce...
  - somenameforme 2y ago
    This [1] is one of my favorite leaks from Snowden revelations, and I regularly bring it up anytime people try to downplay what PRISM is. That's a user manual for NSA agents on how to spy on Skype users (including video and text) in real time. It's informative and also amusing at times. For instance in the FAQ one issue a confused spook might run into is why they're being spammed with the same messages repeatedly. It turns out that when a user logs on to a new device, the recent messages Microsoft sends to the user are also directly forwarded to the NSA, which can result (from their perspective) in messages being repeated. [1] - https://www.aclu.org/sites/default/files/field_document/Guide%20for%20Analysts%20on%20How%20to%20Use%20the%20PRISM%20Skype%20Collection.pdf https://www.aclu.org/sites/default/files/field_document/Guid...
  - jofla_net 2y ago
    I remember the old supernodes p2p app, was good times. I used to leave an extra old laptop on with it running, maybe 15 years ago, on a public address. During the arab spring, tons of traffic could be seen connecting clients in north africa. It truly did route around things.

userbinator 2y ago

It's an argument for increased security in the same way that they consider uploading the contents of your hard drive to their servers to scan for "malware" (and other undesirable-to-them content) is. Corporate authoritarianism.

miohtama 2y ago
The trick is that most of the users need this service. Before Windows Defender was built in you had to buy an anti virus software from sneak oil Windows security industry, and likely get somehow scammed in process. The same companies sell anti virus for Android today. Also most users is not all.
- badsectoracula 2y ago
  But this made Windows Defender an actually good and useful feature for the users. Requiring an online account to use Windows isn't really the same thing.
  - GoblinSlayer 2y ago
    Except that on Home edition it detects everything as a virus, so all programs have an explanation that if Defender detects it as a virus, then just ignore it.
    - badsectoracula 2y ago
      I haven't been using Windows as my main OS for a few years now but at least when i used it with Windows 10 it didn't detect "everything as a virus". In fact i can't even remember a single time i had issues with Windows Defender. Unless you refer to Windows SmartScreen? That is a different thing - really about how popular some program is (though Microsoft did put it under Windows Defender at some point so it can be confusing) - and isn't about the antivirus (which is what i was referring to).
- hulitu 2y ago
  > Before Windows Defender was built in you had to buy an anti virus software from sneak oil Windows security industry, and likely get somehow scammed in process. And now you get the same from Microsoft. Clearly an inprovement.

charcircuit 2y ago

Microsoft's idea of security is moving people away from local accounts protected by passwords and to Microsoft accounts protected Windows Hello. The Windows Hello PIN is protected by the TPM. This means you can't brute force it like a password could be.

soraminazuki 2y ago
That has nothing whatsoever to do with the topic, which is forcing online authentication. You can't possibly argue that needlessly forcing online authentication makes user safe.
- charcircuit 2y ago
  The topic isn't about forcing online authentication. It's about improving security from having users use a Microsoft account. The security improvement of using a Microsoft account comes from Windows Hello.
  - soraminazuki 2y ago
    It is. You can check by reading the title. Your's is a reiteration of Microsoft's preferred talking point that has no basis in reality. Tying local authentication to the cloud tremendously increases the attack surface for those who don't need it. TPMs do nothing to change this fact. The only connection between a TPM and a Microsoft account is that Microsoft chose to tie those two together for their own benefit.
  - beeflet 2y ago
    They couldn't just implement whatever biometric thing that is without making it tied to an account?
GoblinSlayer 2y ago
To brute force a password, attacker needs full access to the system, guessing the password won't give them more access.

anothernewdude 2y ago

If windows is security critical for you, I think you've already shat the bed.

soraminazuki 2y ago
The problem is that many other people and organizations run Windows and it's absolutely security critical for them. And because we don't live in a vacuum, it's security critical for all of us.
consp 2y ago
Some windows versions have cc certification. Doesn't say much but it ticks the box some people want and call it a day.

grishka 2y ago

It's the entire industry's idea of security for the last 10 years or so that the company who made the thing is unquestionably more trustworthy than the users themselves.