A reprint from the PC410 Security Newsletter:

I’m asked “is this safe?” over and over again. Usually, it’s a link in an email. And congratulations to those of you who stopped long enough to recognize a suspicious link, or asked before clicking your way to the web site of some Nigerian Prince with millions in oil money to give you, but who also wants to encrypt your hard drive for ransom and steal your bitcoins while capturing your email passwords so that he can send out a few million more Nigerian Prince letters from your email account.

OK, it’s usually not that obvious. Here are the security errors I see most often.

Passwords in plain sight.

No, don’t write your passwords on the monitor, or a Post-it note, or a label on the bottom of your keyboard. And don’t leave a file called ‘Passwords’ on the desktop, either. It’s really not the Windows login password that’s at risk here: anyone with physical access to your computer can read all the data without the password, by erasing the passwords with a program loaded from a bootable USB stick, or by removing the drive and connecting it to any other computer.

The passwords that should never be visible are banking passwords, email account passwords, QuickBooks passwords, any account that has payment information stored. That includes logins at Amazon and iTunes. Security issues at online merchants have occurred because, well, “someone contacted us, with your password, so we shipped them what they wanted, where they wanted it. And then they reset the password. Wasn’t that you?”

Re-using Passwords

Passwords should be unique. If you have a “usual password” for everything online, stop it. Change it everywhere. When online merchants and service companies have security issues, they invalidate millions of passwords, and make you reset your password, by making it look like you forgot it. You didn’t, they gave it away, so now they’re asking for a new one, because they couldn’t take care of the last one.

So all those sets of millions of hacked passwords from the recent online “We were hacked” events, containing both login names and emails, is ‘out there’, where other hackers will assume that if your password at Amazon was ‘i-want-it-now’, then your password at any of a hundred other sites is likely the same. So they try it, in bulk, and take over some percentage of those accounts. Worse, they take over accounts at multiple web sites from the same victim at once; that’s havoc multiplied into identity theft.

Now, if your password is the same everywhere, when one site says something that means, in real life, “we lost it, give us another,” that means that you have to reset it everywhere you used it. If each site had a unique password to start with, that risk is avoided.

Only One User Account in Windows

So what’s the risk of only one Windows login account? There are two:

1) When there’s just one Windows user, that user is an administrator, with full install rights, and any malware that arrives on the computer can run an install program without any need to enter a password–sometimes, there is no on-screen indication of new software at all. The account used to surf the web and open email should be a ‘limited’ or ‘standard’ account, which can’t install software. In addition, there should be an account with administrator rights, used for installing software and updates, and nothing else; it’s not for web surfing.

2) With only one account on the computer, it’s harder to repair that account if it’s damaged. This is a problem that didn’t happen much until Windows Vista came along, but since then, user profiles, also known as Windows user accounts, can become corrupted, and after login, there’s one of these messages on-screen:

• The User Profile Service service failed the logon. (That error message is courtesy of Microsoft’s Department of Redundancy Department.)
• You have been logged on with a temporary profile.

In both cases, you can’t reach your desktop or your files. If there is a second account to log into, a remote fix is usually possible. If not, especially with the “Service service” message, the repair can’t be done remotely.

Jerry Stern
Chief Technology Officer, PC410.com

A reprint from the PC410 Security Newsletter:

The big “Creators Update” for Windows 10 is no longer optional. It’s showing up now, asking for an update to privacy settings, as shown above, and then offering to install it now, or install it later. Both answers mean “yes.” As usual, there is no “I don’t wanna!” option, but there is an option to remove the update later if you don’t like it, or it breaks the internet, or it’s just not working on your hardware.

Yes, it can break the internet, although not often. So far, I’ve seen it once, but that was on a 12-year-old notebook, and it was amazing that any version of Windows 10 ran at all on such old hardware. The option to remove Creators Update worked well there, and set that notebook back to last Summer’s Anniversary Update level of Windows 10, where it will stay until security patches end, which will generally be 1 year after the following feature update. So that’s 12 months from Spring of this year, probably May 2018.

According to Microsoft, “Each Windows 10 feature update will be serviced with quality updates for 18 months from the date of the feature update release.” That’s 6 months to the next feature update, and 1 year more, and then patches end. If your office is subject to legal restrictions for security, those old versions of Windows will have to be retired at that point in order to remain in compliance. As those end-of-service dates are confirmed by Microsoft, I will update them on the “Windows End of Support Calendar” at my PC410.com site:
http://www.pc410.com/calendar/

The other issue widely reported, but also rare, is that Bluetooth doesn’t work; that will mostly apply to wireless mice on notebooks that use the built-in bluetooth radio instead of a tiny USB adapter. Most application software seems to be OK with Creators Update. I’ve now seen a few minor networking issues, but the fixes have all been minor setting changes.

What to Expect While Installing Creators Update

Before Creators Update arrives on your Windows 10 computer, the message above will pop up. When you choose ‘Review settings’, another screen will appear, below. Setting those privacy settings will allow the upgrade to be completed in one step, in around 90 minutes. Without those settings, Creators Update will still install, but will ask the same questions on restart, and then continue the setup. Answer in advance, and save time. At the end of the process, the infamous series of lengthy “Hi!” messages will appear, and they’re for every user, unfortunately.

My general recommendations for these features are all to choose performance and privacy:

• Location: On for notebooks that travel. On is OK for office computers as well, and web sites will use this to provide local content, like suggesting the nearest branch of a grocery store.
• Speech recognition: Off if there is no microphone, On if you want to use Cortana (similar to Siri, Alexa, or ‘Hey, Google’).
• Diagnostics: Off. It does nothing but phone home, with no results.
• Tailored experiences…: Off. It does nothing but sell more Microsoft products.
• Relevant Ads: Off. It does nothing but track your web visits.

There are a lot of new features, but they’re mostly minor, or related to 3D graphics creation. There is a writeup of the new features in Creators Update here:
http://blogs.windows.com/windowsexperience/2017/04/11/whats-new-in-the-windows-10-creators-update/

Jerry Stern
Chief Technology Officer, PC410.com