Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft, Once Infested with Security Flaws, Does an About-Face

nytimes.com

Post reply on HN
Print view View original

81–90 of 185 posts

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#81

Post by protomyth »

blinkingled wrote: post #56
tptacek wrote: post #36

Earlier quoted context omitted.

There are a lot of great people at Apple and the security model of iOS is an achievement --- in a lot of practical ways better than that of Android. But I do not know a lot of people who would argue the Apple has a better security program than Google does. Google's team is better funded and better staffed, and has a much broader charter than Apple's.

> in a lot of practical ways better than that of Android. Umm no - the update situation is better on iOS but fundamentally iOS has bigger problems - https://twit.tv/shows/security-now/episodes/532?autostart=fa... . That problem is unfixable easily due to the way ObjC works. Android gets code access control for free with Java. There have always been Jailbreaks for most iOS versions and it's not like they haven't had o…

"That problem is unfixable easily due to the way ObjC works"

Can you explain that?

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#82

Post by GauntletWizard »

tptacek wrote: post #66
mtgx wrote: post #46

Earlier quoted context omitted.

Yes, I think that was the first event that pushed Google to focus much more on security. The second one was of course in the summer of Snowden, when Google found out NSA had full access to its network. Since then it has taken quite a few measures to improve security and now it treats its own network as the "untrusted Internet". https://www.usenix.org/conference/lisa13/enterprise-architec... Unfortunately, other than…

Cite a source that demonstrates that NSA had full access to Google's network, please.

[1] shows a full packet capture of a google-internal RPC transaction. As a xoogler familiar with the product in question, I can tell you that that packet had no business being on an external link; That was only sent datacenter to datacenter. I was in a conference war-room shortly after this dropped, and the universal reaction was "Fuck."

[1] http://apps.washingtonpost.com/g/page/world/what-yahoo-and-g...

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#83

Post by TeMPOraL »

Rafert wrote: post #63
toyg wrote: post #52

Earlier quoted context omitted.

And judging by the pageviews on my blogpost on how to disable it, users didn't really like it very much...

Which was caused in part by badly behaving programs (writing user data to the Program Files directory) that triggered the UAC prompt, if I'm not mistaken.

They improved the system in the next release, and since Win7 UAC generally works perfectly even with the "badly behaving" software. Sensitive directories are now mirrored elsewhere in the filesystem, so that when your program wants to read from, say, Program Files directly, what it really reads is C:/Users/[username]/AppData/Local/VirtualStore/...

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#84

Post by quanticle »

hackuser wrote: post #55
joshyeager wrote: post #51

Earlier quoted context omitted.

Vista was a major security redesign, not just bug fixes. UAC was one of the biggest security improvements in the OS, because it meant that users were no longer running as admin by default.

> UAC was one of the biggest security improvements I assumed it was just an interface stapled onto the old system, and something underneath that allowed changing permissions without logging off. It might have had a big effect, but it doesn't sound like a significant change in the system. But maybe my assumptions are wrong ...

The entire concept of UAC and programs not running by default was introduced in Vista. It was such a big change that it pretty much ruined the reputation of the OS, single-handedly. I remember that one of the major complaints about Vista was the number and intrusiveness of UAC prompts, which occurred because programs were doing things like keeping settings in C:\Program Files, rather than the user's application data folder.

Windows 7 has the same permissions model as Vista, but has a much better reputation, because by the time 7 was released, applications had been updated to not require as much in the way of permissions. From the users perspective, this meant that 7 "worked properly", even though little had changed in terms of the security model between Vista and 7.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#85

Post by kyrra »

tptacek wrote: post #66
mtgx wrote: post #46

Earlier quoted context omitted.

Yes, I think that was the first event that pushed Google to focus much more on security. The second one was of course in the summer of Snowden, when Google found out NSA had full access to its network. Since then it has taken quite a few measures to improve security and now it treats its own network as the "untrusted Internet". https://www.usenix.org/conference/lisa13/enterprise-architec... Unfortunately, other than…

Cite a source that demonstrates that NSA had full access to Google's network, please.

Not the GP, but [0]. The NSA didn't have access to all of Google's data. The NSA had reportedly tapped the inter-datacenter fiber (and that the data on those lines was unencrypted).

[0] http://arstechnica.com/tech-policy/2013/10/new-docs-show-nsa...

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#86

Post by tim333 »

blinkingled wrote: post #78
tim333 wrote: post #75

Earlier quoted context omitted.

Some recent figures: ( http://betanews.com/2015/06/26/android-is-the-biggest-target... ) >"There was significant growth in Android malware, which currently consists of 97 percent of all mobile malware developed. In 2014 alone, there were 1,268 known families of Android malware, which is an increase of 464 from 2013 and 1,030 from 2012", it said. Apple’s iOS, on the other hand, went through last year basically unscrat…

I would not read too much into 'reports' by companies trying to sell you security products. If you want to talk impacts - both iOS and Android have been similarly impacted - big name apps getting into App Store that were compiled by hacked XCode, Ad SDKs using forbidden APIs etc. Likewise most Android malware is due to rooting and side loading apps from questionable sources.

So Android getting about 100x as much malware as iOS is not significant? That's from all reporting I've seen, not just that one. Just because iOS has problems too doesn't make the numbers the same.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#87

Post by paganel »

tptacek wrote: post #66
mtgx wrote: post #46

Earlier quoted context omitted.

Yes, I think that was the first event that pushed Google to focus much more on security. The second one was of course in the summer of Snowden, when Google found out NSA had full access to its network. Since then it has taken quite a few measures to improve security and now it treats its own network as the "untrusted Internet". https://www.usenix.org/conference/lisa13/enterprise-architec... Unfortunately, other than…

Cite a source that demonstrates that NSA had full access to Google's network, please.

Not the OP, but stuff like this showed up all over the Intenet just after news of the Snowden leak (http://www.theverge.com/2013/6/6/4403868/nsa-fbi-mine-data-a...):

> The US National Security Agency and Federal Bureau of Investigation have been harvesting data such as audio, video, photographs, emails, and documents from the internal servers of nine major technology companies, according to a leaked 41-slide security presentation obtained by The Washington Post and The Guardian.

Google is in that list. Granted, this did not demonstrate full access to all of Google's internal communications, but the category of "audio, video, photographs, emails, and documents" is broad and damaging enough that it doesn't really matter if NSA had full access or not.

And yes, I know that Google and all the other major companies vigorously denied any back doors, but as people were saying at the time on this very forum they didn't have any other realistic or legal choices. The President of the United States himself was saying things like: "You can't have 100% security, and also then have 100% privacy and zero inconvenience", which, if you were a smart enough CEO, was a very good hint about what to do and say in the heat of the moment.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#88

Post by vox_mollis »

mtgx wrote: post #2

Too bad it's doing the opposite on the privacy front, trying to collect more data than ever about Windows users, by default.

This is the salient point. What good is platform security when the platform is keylogging and shipping telemetry to a third party not in your control?

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#89

Post by blinkingled »

protomyth wrote: post #81
blinkingled wrote: post #56

Earlier quoted context omitted.

> in a lot of practical ways better than that of Android. Umm no - the update situation is better on iOS but fundamentally iOS has bigger problems - https://twit.tv/shows/security-now/episodes/532?autostart=fa... . That problem is unfixable easily due to the way ObjC works. Android gets code access control for free with Java. There have always been Jailbreaks for most iOS versions and it's not like they haven't had o…

"That problem is unfixable easily due to the way ObjC works" Can you explain that?

You should listen to the podcast for details but the gist of it is that "The Objective-C model of object-oriented programming is based on message passing to object instances. In Objective-C one does not call a method; one sends a message." So let's say you have an app that uses a runtime. The runtime in turn may use private/internal calls that your app is not supposed to use. Well there is no reliable way to prevent it because as long as you can construct a message and know the string/name of the target you can call it and there is no easy way for static analysis to detect such behavior.

Some apps were exploiting this to get a list of running apps and things like that.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#90

Post by mark_l_watson »

tim333 wrote: post #79
tootie wrote: post #60

Earlier quoted context omitted.

I don't know. My father-in-laws Windows PC is routinely bogged down with malware/adware. It's not the same kind of security holes that used to be rampant, but it's still too easy for malicious software to cause trouble.

Though Microsoft have improved their computers still often come laden with crapware much of the time unlike Apple or I think most Chromebooks. You then end up with stuff like Superfish if you're not lucky.

Sorry about repeating myself on this subject: buy laptops from the microsoft store - no crapware installed ("signature" editions).
Post reply on HN