Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Offers New Data-Security Scheme

Posted by timothy on from the now-press-this-button dept.

bingly_beep writes "The BBC is reporting Microsoft's new user security measure, whereby users sensitive information is stored on their PC rather then online, as in their previous offerings, such as Passport. This sounds like a good idea, but any such system would surely require that the user definitely erases the HD on any machine they sell. Perhaps Microsoft should include an option, like 'Prepare this computer for resale,' which utterly destroys all data."

6 of 309 comments (clear)

  1. Aw hell... by werewolf1031 · · Score: 5, Insightful
    Perhaps Microsoft should include an option, like 'Prepare this computer for resale,' which utterly destroys all data."

    Yeah, like THAT won't be hacked all to fvck by virus-writers. Great suggestion!

    1. Re:Aw hell... by rbarreira · · Score: 4, Insightful

      Virus writers don't need that to destroy the data of a windows pc...

      --

      The AACS key is NOT 0xF606EEFD628B1CA427BEA93A9CA9773F
    2. Re:Aw hell... by werewolf1031 · · Score: 5, Insightful
      and not anything a virus/trojan couldn't do on it's own

      Not quite. Think about it: In this particular scenario, we're keeping all our personal/important/sensitive data in one place, and more dangerously, a place that's standardized, ie. easy to find. At least with users scattering their personal stuff all over the hard drive, it's easier to "mask" from a virus/trojan looking for that data.

      But with this new setup, the data's all in one spot. In the SAME spot, regardless of the machine or the user. (Cuz you just know that MS is gonna create a standard folder for this.)

      So, by doing this, it'd actually make the malicious program writer's job easier.

  2. Either solution is flawed by Jailbrekr · · Score: 5, Insightful

    So you either store the information locally, and run the risk of a local exploit thanks to the latest and greatest security hole, or you store the information online, and run the risk of the central site being compromised. The first will be more common but limit the data theft to only a single person, whereas the second will be much less frequent but will limit the data theft to the entire customer base.

    In the grand scheme of things, they are both as flawed, just in differing ways.

    --
    Feed the need: Digitaladdiction.net
  3. Insecure Cookies by The+Amazing+Fish+Boy · · Score: 5, Insightful

    Read the article. Sounds like they've made cookies, but more than one site can read them. My guess is you'd have to authorize the site to read them, but this is bad news.

    If a site can trick you into hitting "OK," they could get your info.

    Of course the site probably has to be registered with MS in some way. Maybe this is a way for Microsoft to offer a "secure browsing experience" that is also convenient. IE7 will likely view MS-approved sites as "higher security" than SSL approved sites.

  4. The most practical way to permanently erase a HDD by karlandtanya · · Score: 4, Insightful
    is with thermite.

    You can use a 5/7/9 pass DOD overwrite. Or a 39-step Gutmann overwrite. Or the ultrasuperduperTFH method of... You get the idea. It takes a looonng time.

    HDDs are cheap, especially one you've used so long you're going to sell the computer.

    Take it apart & melt the disks. If you have a lot of them, just use a fish cooker.

    --
    "Reality is that which, when you stop believing in it, it doesn't go away." - Philip K. Dick