Re:DPAPI security flaw in Windows 10
by 9935c101ab17a66 on Tuesday June 18, 2019 @03:26AM
(#20210424)
You only have to make it as far as the fourth section to see that this doesn't apply only to accounts with auto login enabled.
I also don't think it's fair to say there isn't a description of mitigation. They outline exactly how this could be mitigated: microsoft should disable lock screen applications.
this quote from the article really distills what this is so bad:
> Unlike the first implementation, the new vulnerability is not a developer mistake, but a forced compromise of security and usability, so to speak.
If microsoft didn't have a secure way of implementing lockscreen applications, they shouldn't have implemented it at all.
Edit: to clarify, the solution isn't even that drastic — simply don't enable lock screen notifications until the user is logged in. It's pretty funny that this vulnerability is partially a side effect of microsoft attempting to mitigate the intrusiveness of their aggressive auto update policies.
I also don't think it's fair to say there isn't a description of mitigation. They outline exactly how this could be mitigated: microsoft should disable lock screen applications.
this quote from the article really distills what this is so bad:
> Unlike the first implementation, the new vulnerability is not a developer mistake, but a forced compromise of security and usability, so to speak.
If microsoft didn't have a secure way of implementing lockscreen applications, they shouldn't have implemented it at all.
Edit: to clarify, the solution isn't even that drastic — simply don't enable lock screen notifications until the user is logged in. It's pretty funny that this vulnerability is partially a side effect of microsoft attempting to mitigate the intrusiveness of their aggressive auto update policies.