Microsoft has rubbish security.

https://edition.cnn.com/2024/04/02/tech/us-government-microsoft-hack/index.html

US government review faults Microsoft for ‘cascade’ of errors that
allowed Chinese hackers to breach senior US officials’ emails


Published 10:29 PM EDT, Tue April 2, 2024



Hackers downloaded about 60,000 emails from the State Department alone.

the review board faulted Microsoft (MSFT) for not adequately protecting
a sensitive cryptographic key that allowed the hackers to remotely sign into
their targets’ Outlook accounts by forging credentials.

Surely if security is that important to them, they wouldn't rely on the same off-the-shelf security package that most of the world uses?

freediver wrote on Apr 6^th, 2024 at 10:11am:

Surely if security is that important to them, they wouldn't rely on the same off-the-shelf security package that most of the world uses?

Yeah, seems weird, eh?

I haven't used MS (at home) for well over a decade now.

Can't see me ever going back to it.

I only use Chrome OS - never been happier.

freediver wrote on Apr 6^th, 2024 at 10:11am:

Surely if security is that important to them, they wouldn't rely on the same off-the-shelf security package that most of the world uses?

I seems they do.
Most people use Microsoft Office in Govt. and in private companies.
I use it at home too:

an email client (Outlook)
a word processor (Word),
a spreadsheet program (Excel)
and a presentation program (PowerPoint),
a database management system (Access),
and a desktop publishing app (Publisher)

What databases do you manage Bobby?

freediver wrote on Apr 6^th, 2024 at 3:00pm:

What databases do you manage Bobby?

You beat me to it.

Maybe mustard brands   :-/

freediver wrote on Apr 6^th, 2024 at 3:00pm:

What databases do you manage Bobby?

I don't use all the Office apps.

Bobby. wrote on Apr 6^th, 2024 at 7:06pm:

freediver wrote on Apr 6th, 2024 at 3:00pm: What databases do you manage Bobby? I don't use all the Office apps.

Why do you have them?

greggerypeccary wrote on Apr 6^th, 2024 at 7:43pm:

Bobby. wrote on Apr 6th, 2024 at 7:06pm: freediver wrote on Apr 6th, 2024 at 3:00pm: What databases do you manage Bobby? I don't use all the Office apps. Why do you have them?

Sorry - that's a secret.

Bobby. wrote on Apr 6^th, 2024 at 7:06pm:

freediver wrote on Apr 6th, 2024 at 3:00pm: What databases do you manage Bobby? I don't use all the Office apps.

Do you use Access?

Bobby. wrote on Apr 6^th, 2024 at 7:06pm:

freediver wrote on Apr 6th, 2024 at 3:00pm: What databases do you manage Bobby? I don't use all the Office apps.

It may not even be possible to use them all. But virtually nobody uses them all anyway. Most of the main apps are useful.

Quote:

Microsoft has rubbish security.

MS security is about as good as any. Their biggest problem is that they get attacked more than anyone.

freediver wrote on Apr 6^th, 2024 at 8:37pm:

Bobby. wrote on Apr 6th, 2024 at 7:06pm: freediver wrote on Apr 6th, 2024 at 3:00pm: What databases do you manage Bobby? I don't use all the Office apps. Do you use Access?

I have access but have not used it in years. I don't have project but would use that. My old install of outlook still manages all my accounts. I believe a re install will not allow this. I will discontinue with outlook if or when this happens.

I do use the basic office apps including One Note.

freediver wrote on Apr 6^th, 2024 at 8:37pm:

Bobby. wrote on Apr 6th, 2024 at 7:06pm: freediver wrote on Apr 6th, 2024 at 3:00pm: What databases do you manage Bobby? I don't use all the Office apps. Do you use Access?

No - I've never used it - is it good?

https://en.wikipedia.org/wiki/Microsoft_Access

Bobby. wrote on Apr 6^th, 2024 at 1:31pm:

freediver wrote on Apr 6th, 2024 at 10:11am: Surely if security is that important to them, they wouldn't rely on the same off-the-shelf security package that most of the world uses? I seems they do. Most people use Microsoft Office in Govt. and in private companies. I use it at home too: an email client (Outlook) a word processor (Word), a spreadsheet program (Excel) and a presentation program (PowerPoint), a database management system (Access), and a desktop publishing app (Publisher)

Why did you include Access in your list?

freediver wrote on Apr 7^th, 2024 at 6:13am:

Bobby. wrote on Apr 6th, 2024 at 1:31pm: freediver wrote on Apr 6th, 2024 at 10:11am: Surely if security is that important to them, they wouldn't rely on the same off-the-shelf security package that most of the world uses? I seems they do. Most people use Microsoft Office in Govt. and in private companies. I use it at home too: an email client (Outlook) a word processor (Word), a spreadsheet program (Excel) and a presentation program (PowerPoint), a database management system (Access), and a desktop publishing app (Publisher) Why did you include Access in your list?

I merely used Google to acquire a list of Office apps.
Notice I put Outlook in bold?
That's the main one I use these days.
I have used : Word, Excel and Powerpoint too.
In fact I need to explore some of the other Apps.

I get it now. I thought you were saying you use all those programs at home.

freediver wrote on Apr 7^th, 2024 at 7:50am:

I get it now. I thought you were saying you use all those programs at home.

Yes it was ambiguous.
It doesn't really matter what I've used - but since you want to know -
I have actually used Dynamics 365 - an accounting package too at work.
This thread is mainly about Outlook and how it seems that Chinese hackers
can now read all your emails and most other people's emails.

Microsoft Now Put Ads in Windows 11 Start Menu

Soon you could see ads being forced on you in your windows 11 start menu,
which is absolutely ridiculous.

https://www.youtube.com/watch?v=az3N7Pxw4Uo


I wish I could keep Win10 going forever.
At least it works.
I never saw the reason to get rid of Win7 - that worked too.
Win10 updates will stop in 2025.    :(

Bobby. wrote on May 7^th, 2024 at 1:13pm:

Microsoft Now Put Ads in Windows 11 Start Menu Soon you could see ads being forced on you in your windows 11 start menu, which is absolutely ridiculous. I wish I could keep Win10 going forever. At least it works. I never saw the reason to get rid of Win7 - that worked too. Win10 updates will stop in 2025.    :(

Can you still update Windows 95?   :-/

https://www.youtube.com/watch?v=ocmJE2O4uIU

https://www.youtube.com/watch?v=Wu_gE8gQLIc

You don't know Greggy.

Win95 was the most unreliable software in human history.
It was fixed by WinXP  but it was only a 32 bit platform.

Win7 worked well as a 64 bit platform.
They should have just kept Win7 going forever but
they couldn't make money like that.    ::)

*SIGH* Windows is crap and always has been crap, no matter what version you're talking about.  It's security is rubbish.  It fails completely to utilise ACLs (Access Control Lists).  The other computer systems do, such as Linux and AppleOS.  It is far too much a single user computer system.  Even in it's multi-user systems it fails dismally, which is why virii and other malfunctions work so well in Windoze systems.  Unix, Linux and even AppleOS are superior, far superior.  Tsk, tsk, tsk...  ::) ::)

Brian Ross wrote on May 7^th, 2024 at 11:08pm:

*SIGH* Windows is crap and always has been crap, no matter what version you're talking about.  It's security is rubbish.  It fails completely to utilise ACLs (Access Control Lists).  The other computer systems do, such as Linux and AppleOS.  It is far too much a single user computer system.  Even in it's multi-user systems it fails dismally, which is why virii and other malfunctions work so well in Windoze systems.  Unix, Linux and even AppleOS are superior, far superior.  Tsk, tsk, tsk...  ::) ::)

It's very bad that hackers can now read all your emails.    :(

Bobby. wrote on May 7^th, 2024 at 11:13pm:

Brian Ross wrote on May 7th, 2024 at 11:08pm: *SIGH* Windows is crap and always has been crap, no matter what version you're talking about.  It's security is rubbish.  It fails completely to utilise ACLs (Access Control Lists).  The other computer systems do, such as Linux and AppleOS.  It is far too much a single user computer system.  Even in it's multi-user systems it fails dismally, which is why virii and other malfunctions work so well in Windoze systems.  Unix, Linux and even AppleOS are superior, far superior.  Tsk, tsk, tsk...  ::) ::) It's very bad that hackers can now read all your emails.    :(

Hackers have been able to read your emails for a while. Things I buy online I have to use a store bought credit card. No way I would reveal my credit card details to online purchases.

UnSubRocky wrote on May 7^th, 2024 at 11:44pm:

Bobby. wrote on May 7th, 2024 at 11:13pm: Brian Ross wrote on May 7th, 2024 at 11:08pm: *SIGH* Windows is crap and always has been crap, no matter what version you're talking about.  It's security is rubbish.  It fails completely to utilise ACLs (Access Control Lists).  The other computer systems do, such as Linux and AppleOS.  It is far too much a single user computer system.  Even in it's multi-user systems it fails dismally, which is why virii and other malfunctions work so well in Windoze systems.  Unix, Linux and even AppleOS are superior, far superior.  Tsk, tsk, tsk...  ::) ::) It's very bad that hackers can now read all your emails.    :( Hackers have been able to read your emails for a while. Things I buy online I have to use a store bought credit card. No way I would reveal my credit card details to online purchases.

Sure - I use PayPal -
that way only one place has my details not every Tom, Dick and Harry.

Bobby. wrote on May 7^th, 2024 at 11:13pm:

Brian Ross wrote on May 7th, 2024 at 11:08pm: *SIGH* Windows is crap and always has been crap, no matter what version you're talking about.  It's security is rubbish.  It fails completely to utilise ACLs (Access Control Lists).  The other computer systems do, such as Linux and AppleOS.  It is far too much a single user computer system.  Even in it's multi-user systems it fails dismally, which is why virii and other malfunctions work so well in Windoze systems.  Unix, Linux and even AppleOS are superior, far superior.  Tsk, tsk, tsk...  ::) ::) It's very bad that hackers can now read all your emails.    :(

Email has never been secure, never.  If you have the root login in Unix/Linux you can read any user's email easily.  Only fools think it is secure.  Fools and Government Ministers perhaps.  Tsk, tsk, tsk...   ::) ::)

Brian Ross wrote on May 21^st, 2024 at 11:14pm:

Bobby. wrote on May 7th, 2024 at 11:13pm: Brian Ross wrote on May 7th, 2024 at 11:08pm: *SIGH* Windows is crap and always has been crap, no matter what version you're talking about.  It's security is rubbish.  It fails completely to utilise ACLs (Access Control Lists).  The other computer systems do, such as Linux and AppleOS.  It is far too much a single user computer system.  Even in it's multi-user systems it fails dismally, which is why virii and other malfunctions work so well in Windoze systems.  Unix, Linux and even AppleOS are superior, far superior.  Tsk, tsk, tsk...  ::) ::) It's very bad that hackers can now read all your emails.    :( Email has never been secure, never.  If you have the root login in Unix/Linux you can read any user's email easily.  Only fools think it is secure.  Fools and Government Ministers perhaps.  Tsk, tsk, tsk...   ::) ::)

I always thought email was extremely secure and I'm a technical person.

You have qualifications in the arts not science so how would you know?

Speaking of internet security ... for many years I paid a lot of money for Norton Internet Security.

A few years ago, I dumped it and took a chance on Windows inbuilt security.

I find it works quite well. I've not had any security breaches since using it.

Captain Nemo wrote on May 22^nd, 2024 at 11:01am:

Speaking of internet security ... for many years I paid a lot of money for Norton Internet Security. A few years ago, I dumped it and took a chance on Windows inbuilt security. I find it works quite well. I've not had any security breaches since using it.

I'm sort off in the same boat. My norton ran out months ago and my system seems to work much better because norton isn't always running in the background or trying to hijack my homepage etc,  I haven't had any issues since it ran out. I have a new norton license sitting on the desk in front of me (been sitting there for months) and I've been reluctant to 'install' it. 

The only reason I might install it is it's my work pc, and I have some personal customers information on it. I'm worried that if I don't have something, and the info. gets hacked, I can be seen as not doing anything to secure the information. I'm probably going to have to instal norton, even though I really don't want to.

Captain Nemo wrote on May 22^nd, 2024 at 11:01am:

Speaking of internet security ... for many years I paid a lot of money for Norton Internet Security. A few years ago, I dumped it and took a chance on Windows inbuilt security. I find it works quite well. I've not had any security breaches since using it.

I still use Norton.
I seem to have avoided: malware, spyware, Trojan horses and viruses
so I'll stick with it.
But - as I implied in my opening post - emails are not protected by Norton or anything else.

flip

Captain Nemo wrote on May 22^nd, 2024 at 11:01am:

Speaking of internet security ... for many years I paid a lot of money for Norton Internet Security. A few years ago, I dumped it and took a chance on Windows inbuilt security. I find it works quite well. I've not had any security breaches since using it.

For a long long time Norton packages have been way too bulky and dominate way to much computer resources. They have always been among the worst. However a full antivirus suite is a different product to Microsoft's security.

Microsoft defender seems to work well enough.

Bobby. wrote on May 22^nd, 2024 at 6:19pm:

Captain Nemo wrote on May 22nd, 2024 at 11:01am: Speaking of internet security ... for many years I paid a lot of money for Norton Internet Security. A few years ago, I dumped it and took a chance on Windows inbuilt security. I find it works quite well. I've not had any security breaches since using it. I still use Norton. I seem to have avoided: malware, spyware, Trojan horses and viruses so I'll stick with it. But - as I implied in my opening post - emails are not protected by Norton or anything else.

If you use outlook 365 defender for office 365 is available as a download.

Dnarever wrote on May 22^nd, 2024 at 7:26pm:

Captain Nemo wrote on May 22nd, 2024 at 11:01am: Speaking of internet security ... for many years I paid a lot of money for Norton Internet Security. A few years ago, I dumped it and took a chance on Windows inbuilt security. I find it works quite well. I've not had any security breaches since using it. For a long long time Norton packages have been way too bulky and dominate way to much computer resources. They have always been among the worst. However a full antivirus suite is a different product to Microsoft's security. Microsoft defender seems to work well enough.

I don't have any trouble with Norton using up resources -
but I have an 8 core CPU with 32 Gig of RAM and an SSD.

.

Bobby. wrote on May 22^nd, 2024 at 7:31pm:

Dnarever wrote on May 22nd, 2024 at 7:26pm: Captain Nemo wrote on May 22nd, 2024 at 11:01am: Speaking of internet security ... for many years I paid a lot of money for Norton Internet Security. A few years ago, I dumped it and took a chance on Windows inbuilt security. I find it works quite well. I've not had any security breaches since using it. For a long long time Norton packages have been way too bulky and dominate way to much computer resources. They have always been among the worst. However a full antivirus suite is a different product to Microsoft's security. Microsoft defender seems to work well enough. I don't have any trouble with Norton using up resources - but I have an 8 core CPU with 32 Gig of RAM and an SSD.

Norton is a lot better than it was at one time. There was a period where it didn't matter how much resource you had it would happily use it all. It does however still use enough resources to be noticeable on the majority of computers.

You may want to check what the Norton disk usage is like. Apps that write to an SSD a lot will reduce its life.

Dnarever wrote on May 22^nd, 2024 at 7:47pm:

Bobby. wrote on May 22nd, 2024 at 7:31pm: Dnarever wrote on May 22nd, 2024 at 7:26pm: Captain Nemo wrote on May 22nd, 2024 at 11:01am: Speaking of internet security ... for many years I paid a lot of money for Norton Internet Security. A few years ago, I dumped it and took a chance on Windows inbuilt security. I find it works quite well. I've not had any security breaches since using it. For a long long time Norton packages have been way too bulky and dominate way to much computer resources. They have always been among the worst. However a full antivirus suite is a different product to Microsoft's security. Microsoft defender seems to work well enough. I don't have any trouble with Norton using up resources - but I have an 8 core CPU with 32 Gig of RAM and an SSD. Norton is a lot better than it was at one time. There was a period where it didn't matter how much resource you had it would happily use it all. It does however still use enough resources to be noticeable on the majority of computers.

yes - a few years ago I put Norton on a friend's 32 bit single core 20 year old laptop.
It wasn't powerful enough for Norton.
It went like a snail.

Bobby. wrote on May 22^nd, 2024 at 7:31pm:

Dnarever wrote on May 22nd, 2024 at 7:26pm: Captain Nemo wrote on May 22nd, 2024 at 11:01am: Speaking of internet security ... for many years I paid a lot of money for Norton Internet Security. A few years ago, I dumped it and took a chance on Windows inbuilt security. I find it works quite well. I've not had any security breaches since using it. For a long long time Norton packages have been way too bulky and dominate way to much computer resources. They have always been among the worst. However a full antivirus suite is a different product to Microsoft's security. Microsoft defender seems to work well enough. I don't have any trouble with Norton using up resources - but I have an 8 core CPU with 32 Gig of RAM and an SSD.

You don't need third-party tools anymore.  Windows Defender and a properly configured Windows Firewall, plus some common sense online, are all you need.

As someone in the biz, this incident has been fascinating.

It should have never happened, but clearly their focus hasn't been on security for a long time.

Google and Amazon and shown us how the mega tech companies can actually focus on security, it's not impossible.

Microsoft hasn't prioritised security for a long time, and they keep changing their technology behind Azure that it doesn't get a chance to be battle-hardened and is so complex that I sometimes wonder if even they fully understand it themselves.

It also doesn't help that it's entirely black-boxed, not open-source, so there is no way for us to really know and understand how it works, how secure it is etc.

While the incident should never have happened, how they lied about the response is what angers me the most.

To today, they still don't know exactly how the breach happened.

They know how the key material and the legitimately signed certs, but not how it was gathered or created or how far-reaching the access was.

The technique they used could have given them access to any Exchange online mailbox across their entire network, not just a single tenant.

It's actually quite terrifying.

Brian Ross wrote on May 7^th, 2024 at 11:08pm:

*SIGH* Windows is crap and always has been crap, no matter what version you're talking about.  It's security is rubbish.  It fails completely to utilise ACLs (Access Control Lists).  The other computer systems do, such as Linux and AppleOS.  It is far too much a single user computer system.  Even in it's multi-user systems it fails dismally, which is why virii and other malfunctions work so well in Windoze systems.  Unix, Linux and even AppleOS are superior, far superior.  Tsk, tsk, tsk...  ::) ::)

I'm no windows fanboi but that is just plain wrong.

Bobby. wrote on May 22^nd, 2024 at 9:03am:

Brian Ross wrote on May 21st, 2024 at 11:14pm: Bobby. wrote on May 7th, 2024 at 11:13pm: Brian Ross wrote on May 7th, 2024 at 11:08pm: *SIGH* Windows is crap and always has been crap, no matter what version you're talking about.  It's security is rubbish.  It fails completely to utilise ACLs (Access Control Lists).  The other computer systems do, such as Linux and AppleOS.  It is far too much a single user computer system.  Even in it's multi-user systems it fails dismally, which is why virii and other malfunctions work so well in Windoze systems.  Unix, Linux and even AppleOS are superior, far superior.  Tsk, tsk, tsk...  ::) ::) It's very bad that hackers can now read all your emails.    :( Email has never been secure, never.  If you have the root login in Unix/Linux you can read any user's email easily.  Only fools think it is secure.  Fools and Government Ministers perhaps.  Tsk, tsk, tsk...   ::) ::) I always thought email was extremely secure and I'm a technical person. You have qualifications in the arts not science so how would you know?

Email is sent(man in the middle) and stored in plain text or HTML(server admins). Anyone with access can read them unless you(public key)/all ends points use encryption(pops/imaps/smtps) .

Setanta wrote on Jun 14^th, 2024 at 7:32pm:

Bobby. wrote on May 22nd, 2024 at 9:03am: Brian Ross wrote on May 21st, 2024 at 11:14pm: Bobby. wrote on May 7th, 2024 at 11:13pm: Brian Ross wrote on May 7th, 2024 at 11:08pm: *SIGH* Windows is crap and always has been crap, no matter what version you're talking about.  It's security is rubbish.  It fails completely to utilise ACLs (Access Control Lists).  The other computer systems do, such as Linux and AppleOS.  It is far too much a single user computer system.  Even in it's multi-user systems it fails dismally, which is why virii and other malfunctions work so well in Windoze systems.  Unix, Linux and even AppleOS are superior, far superior.  Tsk, tsk, tsk...  ::) ::) It's very bad that hackers can now read all your emails.    :( Email has never been secure, never.  If you have the root login in Unix/Linux you can read any user's email easily.  Only fools think it is secure.  Fools and Government Ministers perhaps.  Tsk, tsk, tsk...   ::) ::) I always thought email was extremely secure and I'm a technical person. You have qualifications in the arts not science so how would you know? Email is sent(man in the middle) and stored in plain text or HTML(server admins). Anyone with access can read them unless you(public key)/all ends points use encryption(pops/imaps/smtps) .

yes - do you remember Edward Snowden during an interview on TV? -
he said that email was so insecure  that when he was at the NSA -
he could even read the President's email.

https://www.techdirt.com/2013/06/10/nsa-whistleblower-ed-snowden-my-desk-i-could-wiretap-anyone-you-federal-judge-president-us/