bugtraq - Re: New Paper: More than 600 million users surf at high risk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 2 Jul 2008 17:44:53 +0200
From: Rainer Duffner <rainer@...ra-secure.de>
To: nick@...us-l.demon.co.uk
Cc: bugtraq@...urityfocus.com
Subject: Re: New Paper: More than 600 million users surf at high risk

Am 02.07.2008 um 02:27 schrieb Nick FitzGerald:

> Paul Schmehl to Larry Seltzer:
>
>> My completely non-scientific, unsupported-by-empirical-evidence  
>> answer is
>> no.  It's because people who use Firefox tend to be more aware of  
>> security
>> threats and the need to keep software up to date.  It could also  
>> be (at
>> least in part) because Firefox has a built-in, enabled-by-default,  
>> update
>> available warning system.
>
> I would agree with both those reasons and add that FF updates are not
> hampered by the disabling of the inbuilt (and often seriously  
> mistrusted)
> OS auto-update mechanisms.
>
> I also _suspect_ that a lot of pirated copies of Windows probably have
> system updates disabled.
>
>
>

Also, back when I was working in a big company, we had Windows2000  
laptops that the admins seemed very conservative in patching (at  
least, if the output of hfnetcheck could be believed).

I imagine it's the same in a lot of other companies, if only for lack  
of time for integration-testing: there may be dozens of IE5.5-only  
intranet-applications that don't work with IE7 (or even 6) and that  
may even break after specific security patches have been applied.
Some of these applications may be "legacy stuff" where the maintainer  
(probably an intern or a defunct company) is no longer around.

cheers,
Rainer
-- 
Rainer Duffner
CISSP, LPI, MCSE
rainer@...ra-secure.de