lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: dfs at roaringpenguin.com (David F. Skoll)
Subject: Counseling not to use Windows (was Re: Anonymous
 surfing my ass\!)

On Mon, 15 Jul 2002, Roland Postle wrote:

> I should mention that I'm only referring to Windows NT here, Windows 9x /is/
> one monumental design flaw and not even worth talking about.

> It's hardly a 'fundamental design flaw' if it can be configured differently.

Well, OK.  But let's say you tighten up security on NT.  Then you
discover that all kinds of third-party (and Microsoft, for that
matter) software doesn't work any more.

> Many default unix installations will leave all a user's newly created files
> with world read access.

That's true.  World-read access is slightly less of a problem than
world-execute access.  And some Linux distros (e.g. Mandrake) offer
"security levels" which (among other things) let you change the default
umask to 077.

> And I bet the vast majority of novice computer users
> (the ones most at risk) would find it easier to change their file
> permissions on a Windows machine than a unix machine.

Well, the vast majority of novice computer users aren't using UNIX
(unless you count Mac OS X).

> The fact that 99% of Windows users are clueless is no reflection on Windows'
> actual security.

But Microsoft touts "ease of use" which lulls people into believing that
you don't need as much skill to use or secure Windows as UNIX.  And that's
irresponsible.

--
David.


Powered by blists - more mailing lists