> Also 95/98/Me were woefully insecure.

To be (somewhat) fair, those Operating Systems were intended to run on standalone consumer machines that weren't permanently attached to a network. The most likely means of getting infected with a virus/malware back in the Win95 days was via the floppy drive.

Though always-on internet connections was clearly the direction things were moving toward the end of the 90s - there was no excuse for going back to the trough with WinME rather than pushing everyone to NT.

Winsock was included with 95 so they had networking available by default. And network has been in Windows since 3.1 so I wouldn't say it was a lack of forethought. They just did not practice basic security and left it to the rest of the world to protect themselves.

> Also 95/98/Me were woefully insecure.

Who could forget the login bypass "hack": https://i.imgur.com/rG0p0b2.gif

Something similar works with the Windows 7 recovery partition; it pretends you have to login to one of the administrator accounts to get control, but one of the dialog has a link to a privacy policy that opens in Notepad and from its file open dialog you can start command prompts, explorer etc.

You can do a trick on Windows 10 too (if the disk isn't encrypted and secure boot enabled).

Boot a Linux usb live boot of choice, mount the Windows C: parition. Rename the Command Prompt exe to be the accessibility or sticky keys exe (something roughly along those lines). Save and reboot into Windows. Hit the on screen keyboard button on the login screen and an administrator level command prompt opens allowing you to reset the local admin password to be able to log in or do anything else that you would like to do.

if you can boot a linux usb, you can change the password directly with chntpw. the command prompt trick allows you to do one-up -> work from the system account or create a new administrator-level account and delete it afterwards allowing the user's password to remain the same.

and on most PCs you don't need secure boot to block booting from USBs, a BIOS password is usually enough...

Saw a security presenter do this last year live at MS Ignite on their latest Win10 release. The collective pie on every MS Windows developer in the room could fill a boat.

Would have been amazing if their QA team had this as something to test for