Slashdot Mirror


Microsoft Releases Standards For Highly Secure Windows 10 Devices (bleepingcomputer.com)

An anonymous reader writes from a report via BleepingComputer: Yesterday, Microsoft released new standards that consumers should follow in order to have a highly secure Windows 10 device. These standards include the type of hardware that should be included with Windows 10 systems and the minimum firmware features. The hardware standards are broken up into 6 categories, which are minimum specs for processor generation, processor architecture, virtualization, trusted platform modules (TPM), platform boot verification, and RAM. Similarly, firmware features should support at least UEFI 2.4 or later, Secure Boot, Secure MOR 2 or later, and support the Windows UEFI Firmware Capsule Update specification.

173 comments

  1. Secure Windows is a phrase that doesn't feel right by iamacat · · Score: 3, Funny

    Like "President Trump". Or "First Post"

  2. Step 1: Remove Ethernet cable by Anonymous Coward · · Score: 0

    There is no step 2.

  3. Telemetry by Anonymous Coward · · Score: 1, Insightful

    Which of these new standards turns off Telemetry? Without that, Windows 10 can never be secure. Bet everything you do on "your" computer is on a server somewhere. Maybe you are a straight arrow. Best hope the laws don't change against you some day. Believe the 3 letter agencies have their arms elbow deep in some MS pussy.

    1. Re:Telemetry by fox171171 · · Score: 2

      Which of these new standards turns off Telemetry? Without that, Windows 10 can never be secure.

      You appear to not understand. They are talking about secure from the user. Is it simple to replace the OS, or is Windows secure?

    2. Re:Telemetry by jez9999 · · Score: 2

      Exactly. And forced reboots. Personally I think forced reboots is a security hole. It means I can lose my data without warning, something that used to be considered a bug in an operating system.

    3. Re:Telemetry by jez9999 · · Score: 1

      Finally, if you're using Windows for a life- or business-critical task that cannot be shut down, you're not using it appropriately. Windows isn't designed for that.

      A very interesting admission. I doubt Microsoft would make it publicly.

      "Windows: don't use it for business-critical tasks. It's not designed for that."

  4. missing parts by Anonymous Coward · · Score: 1

    These will have all telemetry and Cortana disabled or not installed at all? I'd guess it also requires a site license with yearly renewal and not available for individuals?

    1. Re:missing parts by Z00L00K · · Score: 1

      If those parts don't exist in the secure system then there's a possibility to figure out how to disable them in your personal system.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
  5. Missing... by msauve · · Score: 3, Insightful

    Mysteriously (!?) missing are what IPs/DNS to block to keep MS from collecting info on you.

    --
    "National Security is the chief cause of national insecurity." - Celine's First Law
  6. The obvious question by Anonymous Coward · · Score: 0

    Anything in that standard about how to be secure from Microsoft? Ha ha, just kidding...

  7. Erm... by XSportSeeker · · Score: 0

    Does it strip telemetry off tho?

  8. Re:Secure Windows is a phrase that doesn't feel ri by PolygamousRanchKid+ · · Score: 1

    "Secure" for who . . . ? One of the NSA's jobs is to make sure that any devices used by US government employees are "secure". Gee, if Microsoft wants to sell millions of licenses to the US government . . . guess who gets to show up a Microsoft, to build in the backdoors . . . ?

    Yeah, the Microsoft executives and lawyers could squeal a bit . . . but with those National Security Letters . . . those Microsoft folks prefer the Cayman Islands as opposed to Guantanamo.

    --
    Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
  9. Sure, but... by PhantomHarlock · · Score: 2

    The chances of it coming with a version of windows that doesn't send any data back home to mama is pretty much nil.

    It should be able to download security patches without sending any identifying information, tell you when it wants to do it, and be highly selective about what it does download from windows update servers.

    1. Re:Sure, but... by rtb61 · · Score: 3, Interesting

      The PR=B$ messaging secure for you, the corporate reality, secure from you. M$ securing your PC from you, compulsory software installs even firm ware upgrades, that cannot be refused. Each and every log in to the server that controls your PC capable of altering all configurations to what ever M$ corporate demands and that includes, deleting files off your computer or even bricking you computer. M$ securing your computer from you and they mean it, fuck you, you install Windows, they own your computer and your digital life, learn to pay rent fuckers or else.

      --
      Chaos - everything, everywhere, everywhen
    2. Re:Sure, but... by hughankers · · Score: 4, Funny

      The chances of it coming with a version of windows that doesn't send any data back home to mama is pretty much nil.

      It should be able to download security patches without sending any identifying information, tell you when it wants to do it, and be highly selective about what it does download from windows update servers.

      But if my system isn't sending back any data, how will Microsoft know when to phone me and tell me when they've found viruses on my computer?

      It's so helpful when that nice foreign sounding gentleman calls me to help me get everything fixed up..... which reminds me.. I hope he rings again soon, after the last time, I don't seem to be able to log into my email or Bitcoin wallet :/

    3. Re:Sure, but... by jez9999 · · Score: 1

      You didn't wire him enough money.

  10. Highly Secure Windows 10 Devices by Anonymous Coward · · Score: 1

    I'll take oxymorons for 500, Alex.

  11. Did anyone RTFA? by subanark · · Score: 2, Insightful

    Every post I see so far is the generic: see Windows in the title, bash Windows in comments. I mean I'm not sure anyone even read the summary, as all the comments could be made about any article about Windows. And this article doesn't have a lot to do about Windows, its mostly about secure hardware.

    Yes, yes I know most of you hate Windows, if not Microsoft as a whole, but is it necessary to remind people of this every article?

    1. Re:Did anyone RTFA? by Anonymous Coward · · Score: 0

      Every post I see so far is the generic: see Windows in the title, bash Windows in comments. I mean I'm not sure anyone even read the summary, as all the comments could be made about any article about Windows. And this article doesn't have a lot to do about Windows, its mostly about secure hardware.

      Yes, yes I know most of you hate Windows, if not Microsoft as a whole, but is it necessary to remind people of this every article?

      You choose to blame the people writing the responses.

      I choose to blame the "editors" for posting a flamebait article. Once that act was committed, what you observe became inevitable. Therefore the cause of the problem (and thus, the blame) lies squarely on the heads of the Slashdot "editors".

    2. Re:Did anyone RTFA? by chipschap · · Score: 2

      Yes, yes I know most of you hate Windows, if not Microsoft as a whole, but is it necessary to remind people of this every article?

      I think that independent of hating/not hating MS/Windows, there is some real irony here that is worth recognizing. When MS publishes a detailed and quite serious specification about how to secure your computer, but ensures that, unless you take special steps, some of them highly technical (like blocking phone-home IP addresses at your router), they themselves have unfettered access to your computer.

    3. Re:Did anyone RTFA? by Trax3001BBS · · Score: 1

      Every post I see so far is the generic: see Windows in the title, bash Windows in comments. I mean I'm not sure anyone even read the summary, as all the comments could be made about any article about Windows. And this article doesn't have a lot to do about Windows, its mostly about secure hardware.

      Yes, yes I know most of you hate Windows, if not Microsoft as a whole, but is it necessary to remind people of this every article?

      Yes. The list given is to keep Windows from being hacked, the TPM chip rams it home.
      I have an empty TPM socket.

      For a secure windows I wait for the governments release of what to disable for secure areas, Last I've seen was for XP.

    4. Re: Did anyone RTFA? by maeltor3138 · · Score: 4, Insightful

      I don't see a helluva lot of flamebait in the summary. MS releasing security standards that are legitimate is actual news and deserves legitimate consideration. The ridiculousness of the standard "M$=bad" bullshit responses doesn't help anyone and make things better for computing in general. Simply saying that (not saying you do, using "you" as a generalization) "you use Linux and everyone else should to" simply shows that you have no grounding in pragmatic reality.

    5. Re:Did anyone RTFA? by Anonymous Coward · · Score: 0

      Did anyone RTFA?

      You must be new here. *sees high 6 digit user ID* Ok so you're not wet behind the ears, but you're still a noob to me.
      I've been a daily user for over 17 years. Nobody ever reads the articles here.

      If you want to read articles, follow an actual news source. That way you'll get to read the articles several days sooner.
      If you want discussion from tech nerds, then you're in the right place.

      tl;dr: Stop whining about people not reading TFA. We don't do that here.

    6. Re:Did anyone RTFA? by Trax3001BBS · · Score: 1

      The list given is to keep Windows from being hacked, the TPM chip rams it home.

      Hacked as in using Windows for free.

    7. Re: Did anyone RTFA? by Anonymous Coward · · Score: 1

      I don't see a helluva lot of flamebait in the summary. MS releasing security standards that are legitimate is actual news and deserves legitimate consideration.
      The ridiculousness of the standard "M$=bad" bullshit responses doesn't help anyone and make things better for computing in general. Simply saying that (not saying you do, using "you" as a generalization) "you use Linux and everyone else should to" simply shows that you have no grounding in pragmatic reality.

      It's not a matter of "using Linux". The crux of the matter: Microsoft has a terrible track record with Windows being hands-down the most often 0wned software in history. This doesn't just go away because they decided to release a new set of standards. Just like, if you ("you" generalized, of course) have lied to me the last twenty times we spoke, well maybe you really are telling the truth this time, but don't be surprised if your track record comes up. Same concept. It's a reasonable concept. In fact to ignore this would be foolish.

    8. Re:Did anyone RTFA? by nyet · · Score: 1

      Since when has "secure hardware" meant anything except "make sure nobody can install anything but windows"?

    9. Re:Did anyone RTFA? by jezwel · · Score: 1
      The article content is fine, the irony is the title of it - "Highly Secure Windows 10 Devices".

      As we all (should) know, security is only as good as the weakest link - and having a telemetry ridden Windows 10 OS on a device means the security of the hardware itself is essentially irrelevant.

    10. Re:Did anyone RTFA? by WaffleMonster · · Score: 5, Interesting

      Every post I see so far is the generic: see Windows in the title, bash Windows in comments.

      Fair enough.

      The processor architecture requirement is to have a 64-bit processor so that Windows can take advantage of VBS, or Virtualization-based security, which uses the Windows hypervisor.

      The idea of using hypervisors rather than operating systems for isolation is both sad and absolutely necessary. What should happen is the operating system should provide these services in a tractably verifiably secure manner. Since that seems to be practically impossible at the moment the hypervisor is the only game in town.

      Highly secured Windows 10 devices should support Intel VT-d, AMD-Vi, or ARM64 SMMUs in order to take advantage of Input-Output Memory Management Unit (IOMMU) device virtualization

      Not a chance in hell so long as Intel AMT exists. While I agree MMUs are necessary for security they are currently a massive enabler of insecurity.

      Another recommended component is a Trusted Platform Module, or TPM â" a hardware module that is either integrated into a computer chipset or can be purchased as a separate module for supported motherboards that handles the secure generation of cryptographic keys, their storage, a secure random number generator, and hardware authentication.

      I don't like TPM because if it breaks everything it protects is gone and I neither need nor want my systems to be secured against physical access in a way that can't stand alone. (e.g. passphrase)

      In addition, Microsoft recommends platform boot verification, which is a feature that prevents the computer from loading a firmware that was not designed by the system manufacturer. This prevents attackers from uploading a malicious or compromised firmware to the computer.

      I have always hated the idea of using complex cryptography guarded by keys that are bound to be compromised with global repercussions. It's a massive house of cards that seems more and more likely to fail as the profit motive for it's compromise increases.

      There is a much easier way to protect operating systems from persistent threats.

      1. Forbid all hardware from physically possessing any means of self-contained persistent field upgradability. All necessary firmware updates must be loaded during or after boot and they must not survive a reboot.

      2. Provide an option for protected storage area the operating system boots from and is then hardware fused to read only prior to becoming available to the end user until next reboot when the process repeats.

      This has the following advantages over secure boot.

      1. Easier to implement.

      2. Future proof, no worries about protecting crypto from unforeseeable threats.

      3. Offers maximal flexibility since the OS gets to decide when to blow the fuse it can trade safety for convenience per OS preferences and whims of the end user as allowed by OS.

      4. This is more secure because it does not depend on thousands of companies guarding secrets (encryption keys) that have a history of being stolen and prove difficult to practically recall. Also secure boot requires that all signed drivers that can be loaded remain secure against compromise... The attack surface is simply too big to practically address.

      5. System can not be misused to deny owners of computing hardware access to load their own systems. Users always retain full control over what operating systems get loaded into the protected area.

    11. Re: Did anyone RTFA? by tsa · · Score: 1

      Those responses do make me feel twenty years younger though. Slashdot was filled with threads like this back then.

      --

      -- Cheers!

    12. Re: Did anyone RTFA? by nukenerd · · Score: 1

      MS releasing security standards that are legitimate is actual news and deserves legitimate consideration.
      The ridiculousness of the standard "M$=bad" bullshit responses doesn't help anyone

      It is because we are weary of Microsoft's continuous record of lies and dirty tricks. I cannot be bothered to read the detail of MS's scheme, I only know that it is 99.99% likely to be yet another way of shafting users. MS is like some long-term, well-known, neighbourhood con-man who comes knocking on the door for hundredth time, with some new scheme like buying a bridge, and pleading to be given credit because he is a "reformed man". That is the bullshit; we were not born yesterday.

    13. Re:Did anyone RTFA? by AmiMoJo · · Score: 1

      I don't like TPM because if it breaks everything it protects is gone and I neither need nor want my systems to be secured against physical access in a way that can't stand alone. (e.g. passphrase)

      You are doing it wrong then. The way Windows uses the TPM allows for recovery, for example.

      The TPM stores the encryption key and is able to verify that the OS is unmolested before accepting a key (typically a hash) to release the encryption key. To protect against TPM loss Windows will prompt you to make a backup of the encryption key somewhere. It might be kept by the IT department, or you might print it out and lock it away.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    14. Re:Did anyone RTFA? by Anonymous Coward · · Score: 0

      The most insecure area of Windows I have found is Visual Basic. Since Windows 2k, whenever I find access to a library that relies on VB, only a little manipulation is needed to find a hole. Thanks to the VB movement in Redmond, nearly everything opens fairly easily lately.

      In other words, building the founding blocks of an operating system around VB is like securing your yard with a short chain link fence and forgetting to install the gates in the openings.

    15. Re:Did anyone RTFA? by Anonymous Coward · · Score: 0

      Highly secured Windows 10 devices should support Intel VT-d, AMD-Vi, or ARM64 SMMUs in order to take advantage of Input-Output Memory Management Unit (IOMMU) device virtualization

      Not a chance in hell so long as Intel AMT exists. While I agree MMUs are necessary for security they are currently a massive enabler of insecurity.

      Could you elaborate this point? IOMMU can keep the IO devices from accessing memory that doesn't belong to them and reduce or remove the DMA attack surface, so how does the AMT fit into this picture?

    16. Re:Did anyone RTFA? by Anonymous Coward · · Score: 0

      Fair is fair, Microsoft is ramming crap down our throats at every turn, you expect us not to bash them?

    17. Re:Did anyone RTFA? by Anonymous Coward · · Score: 0

      DISA has released a Secure Host Baseline for Windows 10 that is intended for enclaves. Good luck getting all of the details, though.

      Note that you need Enterprise edition if you want to disable telemetry without relying on random internet hacks.

    18. Re:Did anyone RTFA? by EndlessNameless · · Score: 1

      Not a chance in hell so long as Intel AMT exists.

      It's never going away. Disable it if you're so inclined, as it is not necessary for the other items.

      I don't like TPM because if it breaks everything it protects is gone and I neither need nor want my systems to be secured against physical access in a way that can't stand alone. (e.g. passphrase)

      TPM-protected disks will have a recovery key generated by default. For home users, this key is saved to a text file and is intended to be stored offline. For enterprise users, the recovery key is pushed into either Active Directory or the MBAM database.

      You can add and remove key protectors with Bitlocker after enabling it, so you have a choice of: password, Smart Card, recovery keys, or a recovery certificate. You can have multiple protectors on each disk, of same or varying types.

      There is a much easier way to protect operating systems from persistent threats.

      You are essentially proposing a fancy read-only system partition, which has been thought of before but is virtually never done. There are reasons for that:

      1. Your read-only system will still have exploitable vulnerabilities. It can be hard or maybe even impossible for malware to achieve persistence in such an environment, but it also exceedingly difficult to patch. We have malware today that is not persistent and simply relies on reinfection after reboots, so this is a known/proven failure mode. The need to patch will never go away.

      2. If executable files are allowed outside of the read-only storage, traditional viruses/worms/trojans can still propagate and persist relatively easily. They may be slightly less capable than they are today, but all of the significant threats will continue to exist.

      Really, issue #1 kills it for both the standard home user and the enterprise. Your firmware or OS will have exploitable bugs---even Linux and BSD are not exceptions, and BSD in particular is written with a focus on security. The system will need to be patched, and you have made it exceedingly difficult to do that.

      While this may be ideal for your particular use case, there is not a sizable market for this type of design. I cannot see a market for it developing in the near future either.

      --

      ---
      According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
    19. Re: Did anyone RTFA? by Anonymous Coward · · Score: 0

      Are you implying it ever stopped??

      What filter are you using?

  12. I think I found your problem: by Anonymous Coward · · Score: 0

    > highly secure

    > Windows 10

  13. "Highly", "secure", "windows" by linear+a · · Score: 1, Interesting

    "Highly", "secure", "windows". I've heard those words before but never in the same sentence.

    1. Re:"Highly", "secure", "windows" by Anonymous Coward · · Score: 0

      This is a list of what not to use, right?

    2. Re:"Highly", "secure", "windows" by Trailer+Trash · · Score: 1

      "Highly", "secure", "windows". I've heard those words before but never in the same sentence.

      Just think "Democratic People's Republic of Korea".

    3. Re:"Highly", "secure", "windows" by Anonymous Coward · · Score: 0

      "Highly", "secure", "windows". I've heard those words before but never in the same sentence.

      You are highly unlikely to be able to secure windows.

      There we go.

    4. Re:"Highly", "secure", "windows" by fahrbot-bot · · Score: 1

      "Highly", "secure", "windows". I've heard those words before but never in the same sentence.

      I have, when discussing windows on the 80th floor that don't open -- these are highly secure windows.

      --
      It must have been something you assimilated. . . .
    5. Re:"Highly", "secure", "windows" by Anonymous Coward · · Score: 0

      ah but you missed a word "NOT"

    6. Re:"Highly", "secure", "windows" by Anonymous Coward · · Score: 0

      No user (except those that have access to the source code) is able to secure windows.
      Prove me otherwise.

    7. Re:"Highly", "secure", "windows" by Anonymous Coward · · Score: 0

      Just don't test them or you may win a Darwin award.

  14. Maybe they mean "secure" as in "job security" ;) by Anonymous Coward · · Score: 0

    Yeah, SMM CPU, TPM chip, UEFI, Windows 10, line to Microsoft... doesn't sound like the security we usually think of at all.

    BTW, is there a open-source FPGA that can be scaled up a lot? Because I can not check a full CPU for security, but I can check an FPGA with only a few unique elements. Repetitiveness is the key to it being actually checkable, without relying on third parties. Without it, there's no point in even having an open-source CPU design. (IMHO of course. If you know a better way, I must hear it.)

  15. Re:oblig. by Xenographic · · Score: 1

    I was going to suggest removing the plug, but this would be more useful.

  16. Microsoft Secure Backdoor 2 by Anonymous Coward · · Score: 0

    Nuff said!

  17. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    They're obsessed with him and need psychiatric help.

    Not joking either; it's been almost a year since he was elected and two years since he announced his campaign. This cannot be explained by anything other than raw hatred and anger; and people will defend that hate and obsession to their graves for every reason you can imagine.

  18. Re: oblig. by Anonymous Coward · · Score: 0

    As proven by GNU/Windows, the so-called Bash on Windows that people can download straight from Microsoft, Linux is the least useful part of GNU/Linux.

  19. How to secure any version of Windows by CanadianMacFan · · Score: 0, Troll

    Unplug the power cable from the device.

    If the system has a battery let it run out of power.

    Voila! Your Windows system is now secure.

    If you want something with more security while being able to actually use the computer then I would suggest installing an operating system with a Linux or BSD base.

    1. Re: How to secure any version of Windows by Anonymous Coward · · Score: 0

      Actually, leaving a windows system without power for a few weeks makes it more vulnerable, not more secure.

    2. Re: How to secure any version of Windows by awe_cz · · Score: 1

      Not if you never boot it again.

  20. BusyBox/Linux by tepples · · Score: 4, Informative

    GNU tools are required to have a usable system

    How so? These reddit users find BusyBox/Linux usable. It's what you get when you replace glibc with uClibc, Newlib, or Bionic, and then drop Bash and Coreutils (GPL) in favor of BusyBox (also GPL, but not part of GNU).

    the need for the GNU Compiler Collection to compile the kernel

    Clang has been compiling Linux for seven years.

    1. Re: BusyBox/Linux by Anonymous Coward · · Score: 0

      When will visual studio work?

    2. Re: BusyBox/Linux by Anonymous Coward · · Score: 0

      You know Visual Studio's just an IDE like Eclipse, right? You can plug any old compilers and linkers into it. Like:

      • tcc.
      • Or the Linux Studio addin.
      • Or VisualKernel, which has been around since about 2012 and allows you to compile the Linux kernel with Visual Studio.

      Except that you really need a Linux instance around somewhere for debugging.

    3. Re:BusyBox/Linux by Anonymous Coward · · Score: 0

      Clang has been compiling Linux for seven years

      Wow, that must be some kind of record. :/ I think I can compile the kernel I'm using in seven minutes?

  21. To properly *secure* Windows 10, one has to ... by Anonymous Coward · · Score: 1

    Look, no matter how you hate the thing, the only way to properly secure Windows 10 is to include systemd in it

    1. Re:To properly *secure* Windows 10, one has to ... by Hognoxious · · Score: 1

      Hey, if it can't start it can't be hacked.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    2. Re:To properly *secure* Windows 10, one has to ... by Anonymous Coward · · Score: 0

      Hey, if it can't start it can't be hacked.

      Not true any more, at least if your system has Intel management engine. Or AMD equivalent.

    3. Re:To properly *secure* Windows 10, one has to ... by Hognoxious · · Score: 1

      Zoiks! Soon even switching it off won't be enough.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
  22. Only Appropriate Response: by tomxor · · Score: 1

    HaahAHAHahhahahaha hAHAHahahaHhaHAhahahaaaaa haaa haaaa.... haaaaaaaaaa.haahahahahaa. Good one Microsoft.

  23. Secure Windows? as in C3, maybe? by davecb · · Score: 2

    The old "orange book" standards defind four letter grades, just like in school. A was excellent, B was good, C was a comfortable pass and D was a bare pass. Windows struggled to make C with networking turned off.

    The standards have been replaced with easier ones, and this bundle of hardware might make D...

    --
    davecb@spamcop.net
    1. Re:Secure Windows? as in C3, maybe? by Gr8Apes · · Score: 1

      Despite your insightful post, I just came here to post:

      ROFLMAO

      BTW, as an aside, I did setup a supposed Orange Book C test system. With Windows NT 4.0. It was largely unusable. Windows NT 4.0 reached C2 certification in Dec, 2000. Note that Win 2K had already been released as had the first betas of XP. AFAIK those were never certified.

      --
      The cesspool just got a check and balance.
    2. Re:Secure Windows? as in C3, maybe? by Anonymous Coward · · Score: 0

      Orange Book was defined as not having a network.
      Red Book was with a network. Window NT did achieve Red Book C2 level in the late 90's.

      https://msdn.microsoft.com/en-us/library/ms953175.aspx

      Quote from the page (1998)
      "The C2 guidelines are applicable to standalone systems, and are specified in the document Trusted Computer System Evaluation Criteria (TCSEC). Fortunately, to make life simpler, this is often referred to as the Orange Book, thanks to the color of its cover. Other specifications that expand on the Orange Book include the Red Book for networking, and the Blue Book for subsystems.

      Obtaining C2 certification is a long and complex task, and Microsoft are pushing hard for complete certification. Windows NT has passed the Orange Book certification process (for a standalone PC, not connected to a network) and is on the DOD's official list of evaluated products. At the time of writing, Windows NT 4.0 is undergoing Red and Blue book evaluations."

    3. Re:Secure Windows? as in C3, maybe? by Anonymous Coward · · Score: 0

      A was a mathematical proved OS
      B was an A without the proof.
      C had proper user identification and authentication that worked
      D only had to run... but no security.

      NT3.5 passed the C2 tests in 2000... but only if you removed the network and any removable storage.

      Nothing else was certified as they wouldn't pass.

      2000 was the LAST year Orange Book evaluations were completed.

      After that, it was Common Criteria... Unfortunately, being a 3 level matrix evaluation, you could get an EAL4, and still have no security - You also have to check which model was used for evaluation... Guess what, the security model might even be "none", and still get an EAL4.

      https://www.us-cert.gov/bsi/articles/best-practices/requirements-engineering/the-common-criteria

  24. Re:Secure Windows is a phrase that doesn't feel ri by BigBlockMopar · · Score: 1, Insightful

    Like "President Trump". Or "First Post"

    I think you got First Post. :)

    Secure Windows is a contradiction in terms, like "Hurricane-Proof House of Cards".

    You will never, never, never see a self-driving car with a Windows operating system doing the driving. Because Windows is crap.

    If you use Microsoft garbage, you're either stuck by spec or an idiot. If you spec Microsoft garbage, you're not worth the electricity it took your monitor to display this reality of your uselessness to you.

    There is no excuse for your computer to be less reliable than the outlet it gets its power from.

    That standard of reliability is from the 1960s. When was Microsoft founded again?

    --
    Fire and Meat. Yummy.
  25. I own the most secure device ever... by Anonymous Coward · · Score: 0

    It's so perfectly secure you can't even see it. Heck I can't see it, where is it?!

  26. Re:Secure Windows is a phrase that means... by harvey+the+nerd · · Score: 4, Funny

    In most of the world, highly secure windows mean 1/2" to 3/4" steel bars...

  27. Re:Secure Windows is a phrase that doesn't feel ri by Billly+Gates · · Score: 1

    Seems to run Azure just fine.

  28. Standard #1 by NotSoHeavyD3 · · Score: 1

    Under no circumstance QA anything in secure Windows 10.

    --
    Did you know 80 to 90% of the moderators on slashdot wouldn't recognize a troll even if one dragged them under a bridge.
  29. If Windows is proprietary it can't be secured. by jbn-o · · Score: 4, Informative

    Only free software (software the user is free to run, inspect, share, and modify) can be assessed for security, fixed or improved, shared (even commercially), and run at any time for any reason. Without software freedom you're not being treated ethically and you deserve full control over your computers.

    Nonfree software is never trustworthy, no matter how long you've run it, how much you're used to its interface, or how much you feel like you can trust it. You have no idea what nonfree software is doing when it runs, you have no permission to alter it, share it, or inspect it no matter how technical and willing you are to do these things. You might not even have permission to run it anytime you want for any reason.

    So there is no way to secure Windows 10 so long as Windows 10 is nonfree software. The same applies to any other nonfree software too. No amount of public relations changes how computers and software work.

    1. Re:If Windows is proprietary it can't be secured. by Anonymous Coward · · Score: 1

      Only free software (software the user is free to run, inspect, share, and modify) can be assessed for security, fixed or improved, shared (even commercially), and run at any time for any reason. Without software freedom you're not being treated ethically and you deserve full control over your computers.

      I mostly agree, but I take issue with a few specific details here, and I find those details important.

      To assess security, the user does not need to be able to run, inspect, share, and modify, at least not in the free software foundation sense.

      Someone can give me a commercial service with a client application I can inspect and run, but not distribute modifications of, or use modified versions of it. Such an application can have its security assessed accurately. An example of such a service is Tarsnap.

      Freedom to fix issues and create derivative works, freedom to find issues, and freedom to inspect the source are related, but not the same.

      Letting me modify Windows would not help me assess its security. Letting my see the source would (well theoretically. I've seen it and it didn't help much). I might decide its insecure and go install something else, but fixing and assessing are different.

      What is important in security and assessing security is transparency and quality. Windows is shitty and opaque, so it double fails at security. The fact that we can't modify and redistribute it means I have no intention of contributing to it (via their telemetry or feedback tools, or otherwise), but that is not a security problem.

      Software I'm allowed to inspect and choose if I run or not leaves me in control of my computer. Because of Microsoft's monopoly position and general lack of compatibility with alternatives (some software works poorly without Windows), you might not have a real choice regarding running Windows. Thats where the lack of control comes from. Inspectable and interchangeable parts with compatible interfaces (ex: sys call tables, file formats, etc) is where you get your control and freedom as a user. Allowing any user to create derivative works of all the software (GPL style) is a fantastic way to force developers to give users freedom, but it is not the only way.

      As a software engineer I also value my ability to interconnect my software at the source level, and share that with my friends. I see that as an extension of mixing and matching my applications, so I like my BSD licenses, but for languages where its actually well defined I'll take LGPL (Sadly some horribly non-free platforms make shipping LGPL code basically impossible. I'm looking at you Apple!). Note if all the code I used was GPL it would also work just as well, but then we would not have freedom of licencing: I'be be stuck with one choice. I'd rather let someone GPL my code than force them to.

      Anyway, if you give me the option to run some app, even if I can't modify it, I strictly have more freedom than if you don't let me run it. The notion that non FSF approved licensed software is harming freedom bothers me. Embrace extend extinguish harms freedom, as do monopolies. Extra software does not. Choice is good.

      If it were't for the monopoly, having Windows around would improve user choice. It will never happen, but you could brutally hack Microsoft and Windows into pieces and force standard interfaces on it all and then having Microsoft exist would be good for the world (or at least not harmful. I imagine at least some parts of what they make offer decent competition/comparison at least). Its sad that governments designed to serve the people fail to do so in these cases.

    2. Re:If Windows is proprietary it can't be secured. by coofercat · · Score: 1

      I understand what you're saying, but I only partly agree. I realise the term 'secure' means 'secure from hackers, the government and the system vendor' to most of us, and Microsoft is doing some redefinition here because they're really only saying it's secure from the user and common-or-garden hackers.

      However, if you are the US government, then Microsoft does quite a nice job for you here - it's not going to work for classified material particularly, but for the thousands of minions that work in government, it's the perfect OS.

      There are some idiot companies who think they're the same as the government and so should do the same as them and will also adopt this solution. The difference is that there are more than one of said idiot companies, and losing competitive edge because of data leaks isn't something you can usually accept. However, a good number of those same idiots are already non-competitive, already pretty incompetent and yet are in perfectly solvent businesses, so a little more incompetence probably won't change things much.

      Then there are the 'mid range' folks - they're probably going to be a bit suckered by this, because they heard Windows is secure, but they won't do any of the steps to secure it and so will be living with the swiss-cheese that is Windows.

      Finally, the 1% (or whatever the number is) like you and I who know that it's okay for a bit of nondescript web surfing, but even for social media and upwards it's best not to be on an OS that sends who-knows-what back to Microsoft (and whomever else).

      So in conclusion, much like the old NT4 Orange Book thing from years back, this will play out as positive PR for microsoft for their intended audience, and a good 'over spill' outside it too. Just like the Orange Book thing though, the rest of us just look in in amazement.

    3. Re:If Windows is proprietary it can't be secured. by luis_a_espinal · · Score: 3, Insightful

      Only free software (software the user is free to run, inspect, share, and modify) can be assessed for security, fixed or improved, shared (even commercially), and run at any time for any reason. Without software freedom you're not being treated ethically and you deserve full control over your computers.

      Nonfree software is never trustworthy, no matter how long you've run it, how much you're used to its interface, or how much you feel like you can trust it. You have no idea what nonfree software is doing when it runs, you have no permission to alter it, share it, or inspect it no matter how technical and willing you are to do these things. You might not even have permission to run it anytime you want for any reason.

      So there is no way to secure Windows 10 so long as Windows 10 is nonfree software. The same applies to any other nonfree software too. No amount of public relations changes how computers and software work.

      There are so many counter examples to this claim, but why bother. A cult is a cult. All Hail the True Scotsman.

    4. Re:If Windows is proprietary it can't be secured. by Anonymous Coward · · Score: 0

      While I don't disagree, all of your points are irrelevant when the underlying hardware has backdoors built in. All secure software can get you is a false sense of security.

    5. Re:If Windows is proprietary it can't be secured. by Anonymous Coward · · Score: 0

      We've been down this path before, and in the real world, having "free" software, as you position it, doesn't translate into anything that's any less vulnerable as the "non-free" variety.

      Yes, it *can* be assessed for security etc, but in the end, it's been shown not to buy you much. Just ask Equifax. Heck, do you not even remember Heartbleed?

      So quit propagating these myths. This is not where the root problem lies.

    6. Re:If Windows is proprietary it can't be secured. by thegarbz · · Score: 1

      Nonfree software is never trustworthy

      Ooooh so close. You made it through the entire paragraph before collapsing with your logical fallacy right in the following sentence.

      You don't seem to understand the word "trust". You don't "trust" free (by that I assume you mean open source) software. By its nature if you trusted it you won't be wanting to see the source.

      Ultimately what you're saying is that nothing is for you trust worthy, especially not the free software you are so happy to be able to audit.

  30. Yeaaa by Anonymous Coward · · Score: 0

    "Highly Secure Windows 10 Devices"

    Oh please.

  31. Re:Secure Windows is a phrase that doesn't feel ri by BigBlockMopar · · Score: 1

    Seems to run Azure just fine.

    Running Azure is the first sign that your computer is sick. Using Azure is the first sign that the sysop is sick. And not in the "good" way hipsters currently misuse the word.

    --
    Fire and Meat. Yummy.
  32. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    There has never been a documented case where a "back door" was found in any of MS software. And yes the US has the NSA and they are necessary government agency whose mandate is to provide intelligence and counter intelligent services to protect the state. The US is the biggest target in the world when it comes to fending off attacks from the worlds other counter intelligence services. Both friend and foe spend the vast amount of their resources spying on the US. The government, politicians, industry, and military are just some of the juicy targets. And I can say with a 100% certainty that the NSA is not spying on you because they tend to focus their resources on things that actually matter and your life doesn't make the cut.

  33. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    Seems to run Azure just fine.

    Running Azure is the first sign that your computer is sick. Using Azure is the first sign that the sysop is sick. And not in the "good" way hipsters currently misuse the word.

    Did I mention my contract says I get paid extra for workarounds and coming in after hours right?

  34. LOL MS by nyet · · Score: 1

    How does any of that help you if you are running easily exploited bad code from MS?

  35. Highly Secure Windows 10 Devices by Anonymous Coward · · Score: 0

    Do they come with a Linux distribution pre-installed then? *ducks*

  36. Re:Step 1 : by Tablizer · · Score: 1

    Do not give to Donald Trump.

    Nor Hillary. Let's be bipartisan: Hillary would put it on her personal closet server and T would give it to Putin. Putin would then announce he already got a copy from H's server and hand it back to T.

  37. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 4, Insightful

    This is not about security: this is about locking down the system to a vendor. It's right there in TFS:

    ...trusted platform modules (TPM), platform boot verification... UEFI 2.4 or later, Secure Boot, Secure MOR 2 or later, and support the Windows UEFI Firmware Capsule Update specification.

    Words like "trusted", "secure" etc in computer salesdroid-speak are like "people's" and "democratic" when they get shoe-horned into a country's name - they're a warning sign, a veneer to hide a darker truth.

  38. Protecting devices from their "owners" by WaffleMonster · · Score: 1

    The idea of security standards when Windows is loaded to the hilt with malware is hilarious. Like leaving the vault door open 24x7x365 and bragging about the security features of your high tech safe.

  39. Re:Sponsored by NSA by Z00L00K · · Score: 4, Interesting

    Which raises the question "Secure for Whom?".

    If you want a secure system, look at OpenVMS.

    --
    If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
  40. Re:Secure Windows is a phrase that doesn't feel ri by ArmoredDragon · · Score: 1

    I'd be more concerned about boot signing being locked down, first and foremost. I personally like the Google Nexus/Pixel approach where you're given a big warning that you're bootloader is unlocked. This allows tinkerers to play around, while at the same time making people who don't need/want for it unlocked (for tighter security) aware of it.

    Even better, it allows security researchers to do a low level audit for NSA backdoors (give it the ol' blue pill.)

  41. Re: oblig. by Anonymous Coward · · Score: 0

    it's fucktards like you that are keeping LINUX from actually doing anything other than the nitpicking and bickering and infighting between and inside of projects. if the LINUX community actually, ya know, got together and worked together, it could be a beautiful thing.

  42. Re:Sponsored by NSA by Anonymous Coward · · Score: 1

    Secure from user, who might try to prevent telemetry and other spyware from working. And secure from competing spyware vendors, as MS wants to ensure monopoly for selling and monetizing the user's data.

  43. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    This assertion from an anonymous coward, backed up with so much hard evidence, makes me feel secure.

  44. Except of course... by Chas · · Score: 1

    Anything that could interfere with telemetry...

    --


    Chas - The one, the only.
    THANK GOD!!!
  45. Re:Secure Windows is a phrase that means... by Anonymous Coward · · Score: 0
    I use a desktop background showing prison bars. The bars look quite when you look at them on my 36" monitor!

    That is probably the most secure version of Windows you are likely to get!

  46. The "security" they mean by Opportunist · · Score: 1

    I somehow doubt that they mean that the system can keep your data secure. It seems more that their definition means that whatever content you might sell to the "owner" (I'll use the term loosely here) of the device is safe from him actually owning it.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  47. Security is easy by petes_PoV · · Score: 1
    If a computer is connected to anything you don't control (including people) then it isn't secure.

    An internet connection should be an automatic fail in any security audit.

    --
    politicians are like babies' nappies: they should both be changed regularly and for the same reasons
  48. Re:Maybe they mean "secure" as in "job security" ; by TheRaven64 · · Score: 1

    Yeah, SMM CPU, TPM chip, UEFI, Windows 10, line to Microsoft... doesn't sound like the security we usually think of at all

    SMM is a bit odd, but something like a TMP is pretty important as it allows you to protect secret keys from a compromised OS. A TPM provides some write-only storage for keys and an API that allows you to use them for encryption / decryption / signing / verification, but doesn't allow you to extract the keys. UEFI at least allows the OS to replace the running firmware, which can reduce the attack surface by removing most of the vendor-provided functionality.

    BTW, is there a open-source FPGA

    Nope. There are no open source FPGAs and no vaguely high-end FPGAs that have a documented bitstream format, so you can't even verify the output from the proprietary synthesis tools. Oh, and any vaguely high-end FPGA has lots of fixed-function logic blocks that will make any attempt to verify them difficult.

    --
    I am TheRaven on Soylent News
  49. Re:Secure Windows is a phrase that doesn't feel ri by admin7087 · · Score: 1

    Backdoors in operating systems and application software are no longer needed, thanks to the Intel Management Engine and AMD's PSP.

  50. Re:Secure Windows is a phrase that doesn't feel ri by TheRaven64 · · Score: 4, Interesting

    Words like "trusted", "secure" etc in computer salesdroid-speak are like "people's" and "democratic" when they get shoe-horned into a country's name - they're a warning sign, a veneer to hide a darker truth.

    Trusted, as a technical term, means exactly what you'd expect from its use as a non-technical term: it is a thing which is expected to be correct and which can compromise (at least part of) the system if not. It is not the same as trustworthy. For example, the trusted computing base is the set of all things (microcode, bootloader, firmware, kernel, privileged daemons) that must be correct for the system to be secure. A system that uses a formally verified microkernel to provide isolation has a component that is both trusted and trustworthy.

    Secure in this context also means what you'd expect. A system supporting secure boot can only boot an OS (or, at least, a second-stage bootloader) that is signed by a trusted party. There's nothing stopping such a system from allowing you to provide your own public keys, and many do, but if malware corrupts your on-disk kernel image then the system will refuse to boot unless you've also installed the malware vendor's key.

    There's always a tension between user freedom and security, which goes right back to Stallman complaining about users on shared systems not being given the root password: was it better to allow users of the system to fix issues even at the expense of making all of their files wide open to every other user of the system? In the MIT AI lab, it was probably fine for everyone to have the root password, but it's not fine for everyone on the Internet to have my root password.

    --
    I am TheRaven on Soylent News
  51. Re: oblig. by TheRaven64 · · Score: 1

    Actually, installing just Linux would make your system pretty secure. Of course, without any userland, it might not be so useful, but that's not part of the stated requirements...

    --
    I am TheRaven on Soylent News
  52. Re: oblig. by Anonymous Coward · · Score: 0

    Fun fact: It's called GNU/Linux. Linux is just the kernel, the GNU project provides most of the operating system functionality. You can learn something new everyday! Stay safe my little GNU/Linux-loving friend!

  53. Yes you can secure windows by n329619 · · Score: 1

    Step 1: Delete System32
    Step 2: Reboot
    Step 3: ????
    Step 4: 100% Secured Windows!

  54. Best secure Windows is no Windows by Anonymous Coward · · Score: 0

    So the best secure Windows which I am assuming is Windows 10S is a broken and locked down POS Windows. Which means your better off just moving past Windows and using a really secure OS that doesn't have to be made handicapped to be secure. Anyone who uses Windows is doing so because of its openness to running software. I would bet that 10S won't be any better at security then traditional Windows in the long run. Run Linux if you want security, its obscure, only around 2% use it on the desktop so hardly anyone targets that. Or buy a Mac and still keep some software freedom.

  55. UEFI... by Anonymous Coward · · Score: 0

    Nahh, For anything secure I run on a pre UEFI PC without a HD and an use a bootable linux CD. Tails or Fedora depending on what I am doing....Thats is a lot more secure lol.

  56. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    Funny, you should look in the mirror. Someone makes a passing two-word jokey Trump reference and suddenly you're triggered like a little snowflake into a lengthy rant. Your mental state needs looking at. And your blood pressure probably.

  57. Just remember what "highly secure" actually means by Anonymous Coward · · Score: 0

    it means secure _from other users_, not secure from Microsoft or the U.S. government which they answer to.

  58. An excerpt by Anonymous Coward · · Score: 0

    Don't worry about installing them; we'll use the same backdoor that we used to force-install Windows 10 er I mean upgrade to Windows 10

  59. Re:Maybe they mean "secure" as in "job security" ; by Anonymous Coward · · Score: 0

    but something like a TMP is pretty important as it allows you to protect secret keys from a compromised OS. A TPM provides some write-only storage for keys and an API that allows you to use them for encryption / decryption / signing / verification, but doesn't allow you to extract the keys.

    The keys are useless if you don't use them for encryption / decryption / signing / verification, so allowing that but preventing extraction is pretty much useless.

    Except of course for the case of buying a new PC. Preventing extraction would prevent you from moving your keys to a new PC.

  60. Re: oblig. by Anonymous Coward · · Score: 0

    Back in the days, we had a firewall that booted Linux from a read-only floppy drive.

    There was no init or systemd, just a script that would set up the firewall (ipfwadm, I think) and the last step in that script was a call to shutdown. You try to attack THAT setup :-)

    Pretty useful, IMO.

    As for the usual question: To update the firewall rules, you would take out the floppy disk, move it to a different machine, remove the write protect and make the changes. Write protect the disk and put it back in the firewall, then hit the reset switch. The firewall only needed the disk while booting, so removing it to make changes wasn't a problem, and a Linux kernel with no services will boot in a couple of seconds, so downtime wasn't a big problem.

  61. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    It doesn't protect crap when the system is crap.

    There have been instances of using Windows as a boot loader for Linux.

    Not very "trustworthy" was it.

  62. Re:Secure Windows is a phrase that means... by Gonoff · · Score: 0

    In most of the world, highly secure windows mean 1/2" to 3/4" steel bars...

    In "most of the world", people wouldn't know or care about anything measured in inches or even fractions of them.

    Why not use 0.00746269-0.1119403 Smoot bars? That is as equally logical and no less a user friendly unit.

    --
    I'll see your Constitution and raise you a Queen.
  63. TPM by Gonoff · · Score: 1

    I do not want a "trusted platform mobile" in anything that puports to be secure. It is widely known as a back door for US spooks. This immediately makes the whole system hyper insecure.

    --
    I'll see your Constitution and raise you a Queen.
  64. Re:Secure Windows is a phrase that doesn't feel ri by AmiMoJo · · Score: 1

    There is no excuse for your computer to be less reliable than the outlet it gets its power from.

    There is: Applications.

    If your staff need to run QuickBooks or Visual Studio or the quality of LibreOffice's .docx output isn't good enough for them, just telling them "sorry, Windows is crap" probably won't fly. So there are a lot of people who are interested in securing Windows as much as possible.

    The big issue that no-one seems to have mentioned yet is updates. Telemetry is one thing, but for IT people the forced, random updates that can't be adequately controlled are a massive security problem and support headache.

    --
    const int one = 65536; (Silvermoon, Texture.cs)
    SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  65. Re:Secure Windows is a phrase that means... by Dog-Cow · · Score: 1

    In most of the world, you'd be slapped in the head with a 1/2" steel bar until it was a pulpy mess. You're lucky to live where you are, but no one else is.

  66. Best way of securing a Windows 10 device by joncombe · · Score: 1

    The best way of securing a Windows 10 device is not to switch it on.

  67. Re:Secure Windows is a phrase that doesn't feel ri by Big+Hairy+Ian · · Score: 1

    Do these standards say anything about turning off all the telemetry?

    --

    Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.

  68. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    Funny, you should look in the mirror. Someone makes a passing two-word jokey Trump reference and suddenly you're triggered like a little snowflake into a lengthy rant. Your mental state needs looking at. And your blood pressure probably.

    It's hilarious that the left tries to co-opt the usage of "snowflake" and "triggered" as a pejorative at the right. "Triggered" is a self-described condition of the extreme left along with such other bullshit terms as micro-aggressions. "Snowflake" is much more descriptive of those who indulge in cry-ins, crayon coloring and bubble blowing therapies, and stuffed animal hugging for the benefit of soothing their disbelief that someone could be elected that they didn't vote for.

    Pointing out the humorous nature of those who are still ranting over their lost election does not constitute snowflake status.

  69. ha ha by Anonymous Coward · · Score: 0

    lolwut...

  70. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    Yes, yes, me too... from one anonymous coward to two others, there are no backdoors *waves hand like some kind of JEDI*

  71. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    There has never been a documented case where a "back door" was found in any of MS software.

    "Back doors" haven't been needed thanks to the sieve-like structure of Windows. Lots of holes anyways .. just keep a collection of zero-days (preferably keep them secure them them 'bad guys')

  72. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    Advocatus diaboli here:

    Don't attribute to malice what can be attributed to stupidity. I've read a ton of conjecture and whining about the NSA. And yes, they have a fingerprint in operating systems... but they have done FAR more good than even the most far-out conspiracy theorist can say. Things like SELinux, MAC/DAC items, macOS going from absolutely shitty password storage to a salted, hashed, iterated algorithm, to reasonable standards on how to secure your routers, operating systems, and network.

    Overall, those guys have been an asset to security in my book.

  73. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    what and when you get paid has no relevance to the initial assertion.

  74. Re: oblig. by Anonymous Coward · · Score: 0

    GNU tools are required to have a usable system How so? These reddit users find BusyBox/Linux usable. It's what you get when you replace glibc with uClibc, Newlib, or Bionic, and then drop Bash and Coreutils (GPL) in favor of BusyBox (also GPL, but not part of GNU). the need for the GNU Compiler Collection to compile the kernel Clang has been compiling Linux for seven years.

  75. This is a joke right? by Anonymous Coward · · Score: 0

    Secure your windows but Microsoft forcibly steals your data via telemetry that you can't turn off. Spyware at it's best.

  76. Re:Secure Windows is a phrase that doesn't feel ri by ctilsie242 · · Score: 1

    Agreed here. The Google "fastboot oem unlock" approach has worked extremely well for years. With that, I'd like to see an easy way to "sanitize" a machine, where I can do a "fastboot oem lock", install a signed OS, and have all factory security items intact.

    Secure UEFI has its benefits. It stops attacks like NotPetya cold, for example.

  77. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    The Navy runs their ships on windows and they only occasionally crash for no reason.

  78. Re:Step 1 : by will_die · · Score: 1

    Well based on the email you could give it to Hillary and provide hours of training but she would not be able to understand how it works.

  79. Re:Maybe they mean "secure" as in "job security" ; by ctilsie242 · · Score: 1

    Maybe we need something similar to a SIM card (in both form and function) that can be moved between PCs? It would function as a low level HSM allowing for encryption/decryption/signing/verification in a place physically off the main computer, and in a container that is both resistant to physical attacks, and narrows down the attacks that can be done from remote.

  80. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    I have an old Remington typewriter I showcase for these occasions. It was good enough for your grandma, and you're whining about LO? So far nobody has taken up the offer to switch.

    Lazy ass bitches, LO is way more advanced than the tools we made do with in the past and usually if you can't make it do what you want, it's because you're trying to make it do something it's not supposed to do. Use the right tool for the job and stop complaining. If you don't know what the right tool is and insist on trying to use something unsuitable, you are incompetent and should probably work with something else.

  81. Highly secure = Slightly Insecure by Anonymous Coward · · Score: 0

    that's how I am reading it.

    which means the obvious. there will be backdoors that will inevitably get leaked, and we'll all be screwed again.

  82. Re:Secure Windows is a phrase that doesn't feel ri by Impy+the+Impiuos+Imp · · Score: 1

    "Secure" in the sense that only Microsoft or the US Government (or China or Russia) can see what you're doing.

    It's sad. In 1789, the Founding Fathers went to great lengths to make sure the government could not do these things without a warrant. Yet here we are.

    And even if they get a warrant, China and Russia won't, and their citizens will get the joy of living the 1984 dream of not just imagining, but having a boot stamping on their face...forever. All so our prosecutors can get a few more (and we mean very, very few as a percentage) notches in their belt for mundane criminality.

    --
    (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
  83. Re:Secure Windows is a phrase that doesn't feel ri by iamacat · · Score: 1

    Snowflakes are not a left or right phenomena. If you voted for Hillary because she promised you healthcare or for Trump because he promised you jobs, you are not a snowflake. You are just a victim of a two party system and, although you are unlikely to get what you want, you went with a candidate who was at least talking about it. If you personally wearing a black or white hood and carrying a bicycle lock to a street protest, you are an idiot and a criminal, but you at least have some personal courage of terrorist variety. True snowflakes are those who urge antifa to brawl because if Ben Shapiro speaks on college campus we will have Fourth Reich. Or those who urge white supremacists to march because if local government decides to take down one monument, we will have white genocide. Millenials in parents basement who don't have much in stake personally but get their panties in the bunch. The sad thing that those in the basement will be likely survivers if moron in charge starts a nuclear war. That at least I think would have been slightly less likely with Hillary...

  84. Re:Step 1 : by Tablizer · · Score: 1

    She never got the proper training for some reason. State Dept. messed up.

  85. Re:Maybe they mean "secure" as in "job security" ; by TheRaven64 · · Score: 1

    The keys are useless if you don't use them for encryption / decryption / signing / verification, so allowing that but preventing extraction is pretty much useless.

    Not true. Offline attacks are almost always worse than online attacks. If I can compromise your OS and use your keys, then the damage I can do is bounded by the amount of time between the compromise and the fix and by the amount of bandwidth that you have. If I can exfiltrate your keys, then even if you fix the vulnerability and remove my exploit code 10 seconds after the compromise then I can keep using your keys until you update any other system that accepts these credentials (and once I start noticing you doing that, then I know I've been discovered, so I may as well change your keys for all of the services that I now have access to). Still think that they're equivalent?

    --
    I am TheRaven on Soylent News
  86. Re:Secure Windows is a phrase that doesn't feel ri by gtall · · Score: 1

    " One of the NSA's jobs is to make sure that any devices used by US government employees are "secure"."

    No, it isn't. NSA is strictly comms interception and analysis with a bit of certification for DoD devices. But they are getting out of the latter fast as the COTS world is moving a lot faster than can NSA.

  87. Re:Secure Windows is a phrase that doesn't feel ri by gtall · · Score: 1

    Some pacemakers run Linux. I wonder if Stallman had one of these, he'd be happy to advertise the root password.

  88. Re:Secure Windows is a phrase that doesn't feel ri by BronsCon · · Score: 1

    Well, you've got at least 2 out of the 3.

    --
    APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  89. TL;DR by Anonymous Coward · · Score: 0

    Install Linux.

  90. Contradiction in terms by Rick+Schumann · · Score: 1

    'Windows' and 'secure' don't belong in the same sentence, regardless of what version it is -- especially when you're discussing Windows 10, which spies on you and removes your ability to truly be in control of your own hardware.

  91. What A Joke by Anonymous Coward · · Score: 0

    They actually recommend using modern chips for a "secure" machine even though it's been public knowledge that any chip made in the last decade has backdoors built in and the same goes for most NICs after about 1999.

  92. APK is going to be pissed by Anonymous Coward · · Score: 0

    APK is going to be pissed that it doesn't include his hosts file engine.

  93. CI compiles again and again by tepples · · Score: 1

    I didn't say Clang compiled Linux only once in those seven years. Continuous integration tools such as Tinderbox and Buildbot start compilation over once the last job finishes or when changes are submitted, whichever comes later.

  94. Re: Secure Windows is a phrase that doesn't feel r by Anonymous Coward · · Score: 0

    Thanks Obama!!

  95. Re:Secure Windows is a phrase that doesn't feel ri by stooo · · Score: 1

    Yeah.
    Windows.
    Secure.
    Windows.
    Nope.
    There are only two ways to do that:
    1. Air Gap. No That doesn't work. Try vacuum gap.
    2. Hammer. If It ain't broken, you didn't hit hard enough. If it's broken into small enough pieces, then it's secure.

    --
    aaaaaaa
  96. Re:Secure Windows is a phrase that doesn't feel ri by stooo · · Score: 1

    If it has no network and no physical access, you can divulge the root password as much as you like.
    Hint : pacemakers running Linux have no network and no physical access

    --
    aaaaaaa
  97. Re:Secure Windows is a phrase that doesn't feel ri by stooo · · Score: 1

    That's not true.They crash for a reason.
    either this reason is Windows, or it isn't.

    --
    aaaaaaa
  98. Re:oblig. by stooo · · Score: 1

    Yep. Linux.

    --
    aaaaaaa
  99. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    According to their website, defending vital networks and protecting US secrets is in their mandate.

  100. They Shouldnâ(TM)t Bother by zeiche · · Score: 1

    I am not confident that Microsoft is capable of creating secure software. I am not even sure they could release a secure, bug-free version of âoeHello, world!â

  101. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    I really hate the expression snowflake. It is basically just a way to end a conversation. I'm also not sure that snowflakes are extremists like you mentioned. I voted for Hillary because she was honestly a much much better candidate. I'm able to ignore the decades of the right largely making up shit to hate on her for. She was qualified and the president has people to manage the email server. Also, I'm smart enough to know when things are tilted. You knew everything about Hillary and nearly nothing about Trump, yet people were comparing the bad stuff they heard between the two, and that was utterly insane, particularly when some of it was made up. I voted for Bernie in the primary, because, he was a good man, and more importantly he has not presented himself to be different, well, ever. He is consistent in his opinions and policies. On a final note, everyone does know that Antifa stands for Anti-Fascist right? It just seems at times the right makes Antifa out to be far worse than they are and misses the whole point of why they organize. Still, I suppose if you can label any of your enemies basically a terrorist organization, then it must be easier to accomplish your goals.

    People say that the terrorists use windows...

  102. Re:Secure Windows is a phrase that doesn't feel ri by ArmoredDragon · · Score: 1

    Being able to add your own signing keys would be good, but there should be a separate message to the effect that the custom user code has been validated, but to exercise caution if you didn't load said code. Otherwise it would be pretty trivial to blue-pill the user.

  103. Re:Secure Windows is a phrase that doesn't feel ri by iamacat · · Score: 1

    So what was Hillary's plan to get people suffering from loss of manufacturing/mining jobs new jobs to support themselves? Trump promised protectionism and immigration curbs. Bernie promised free education to aquire new skills. I am not saying these are realistic plans, but at least they talked about the issue. What use is Hillary's maternity leave if you don't have a job to take a maternity leave from?

  104. Re:Step 1 : by Anonymous Coward · · Score: 0

    Ha. I like how you assume that the Department actually has control over the Secretary's actions. If the Secretary says, "I don't want to do that training," there is no one who can force them.

    We have no way of knowing if it was offered and she declined, or if it was never even offered.

  105. Re:Secure Windows is a phrase that doesn't feel ri by Anonymous Coward · · Score: 0

    I almost hate picking a link at google at random, but this appears legit. retraining It also agrees with what I remembered. Basically she wanted to retrain people into current skills. It wasn't as ambitious as Bernie's plan, but it probably had a higher chance of getting through.

    The thing about manufacturing jobs, such as the Foxconn deal, well they might bring some back, but I'm betting on the robots for the work for the most part.

  106. Re:Secure Windows is a phrase that means... by Gonoff · · Score: 1

    This could happen in Myanmar I suppose. Do they produce many steel bars? I'm sure that there is a third country that has not got rif of this hand-me-down from the dark ages. I bet they don't make many either.

    The US population is perhaps under 4.5% of the planet. That means that 95.5% of us don't use that numerically illiterate system of measurement. If this offends you, this is not my intention but neither is it my problem. 1 mile, 1,760 yards, 5,280 feet, 63,360 inches. (You seem to avoid, fathoms, poles, rods, perches, chains, barleycorns and so on.)

    --
    I'll see your Constitution and raise you a Queen.
  107. nnn by bico540 · · Score: 0

    a href="http://www.al-awa2el.com/%D9%85%D9%83%D8%A7%D9%81%D8%AD%D8%A9-%D8%AD%D8%B4%D8%B1%D8%A7%D8%AA-%D8%A8%D8%A7%D9%84%D8%AE%D8%B1%D8%AC/219-%D8%B4%D8%B1%D9%83%D8%A9-%D9%85%D9%83%D8%A7%D9%81%D8%AD%D8%A9-%D8%AD%D8%B4%D8%B1%D8%A7%D8%AA-%D8%A8%D8%A7%D9%84%D8%AE%D8%B1%D8%AC"> , , , a href="https://www.al-awa2el.com/%D9%85%D9%83%D8%A7%D9%81%D8%AD%D8%A9-%D8%AB%D8%B9%D8%A7%D8%A8%D9%8A%D9%86-%D8%A8%D8%A7%D9%84%D8%B1%D9%8A%D8%A7%D8%B6/270-%D8%B4%D8%B1%D9%83%D9%87-%D9%85%D9%83

  108. Re: Secure Windows is a phrase that doesn't feel r by Anonymous Coward · · Score: 0

    Absurd anyone running windows 10 and even 7 with telemetry updates has no security or privacy what was classified as spyware or malware and was the payload of viruses is part of the OS now. Keyloggers, file scanners installed software information with useage data, really people are ok with this????????

  109. Re:Step 1 : by Tablizer · · Score: 1

    If she is allowed to refuse it, the system is screwed up. Focus on fixing the system rather than just punishing one individual.