While trying (and failing) to convice a certain older person who wanted me to "fix" their ~20 years old PC that they should not be connecting to the Internet with whatever version of Windows they have installed (they couldn't tell me) and they should rather buy a new PC I resorted to arguments of this sort:
The development cycle of software goes more or less like that: (a) A company releases software; (b) Usually in a short time security holes are found, some of them are published; (c) Exploits ("lockpicks") may be made and released to the public that allow your middle-school kid next door to break into your computer with little effort; (d) Some people try to automate such attacks, trying to target many computers connected to the Interned in a bulk; (e) After some (hopefully) short time the company releases a security patch that closes this hole, but (f) before users apply this patch they are open to all sorts of attacks (g) which is why it is recommended to apply updates as soon as possible and to only connect to the internet with up-to-date software, but (h) Windows XP stopped receiving such fixes in 2014(!)
I was pretty much repeating what I had been told.
Still, the person in question is still running their grossly out-of-date Windows version to perform the tasks they need to perform, which mainly boils down to receiving and sending important e-mails and using office software to read/edit/create attachments. When told about security their response was "Am I working in a three-letter agency?" and also "Who am I, a millionaire? Why would I be of any interest to anyone?"
I am wondering... Maybe they're correct? Security is not a binary thing, after all. It can only be sufficient or insufficient for a given threat model for a given situation.
In this situation, despite that their PC is theoretically open to all sorts of exploits:
- I suppose routers / modems nowadays employ NATs / firewalls which while not perfect are enough to stop most of the en-masse portscanning? So their security should rise by the fact that they, by necessity, use the hardware from their ISPs?
- Also, the use of such old Windows systems is in such a decline nowadays do people even bother looking for vulnerabilities in those en masse? So are they going to get infected only by the fact that they connect to the internet?
- Gmail website and expected e-mails from trusted people are not going to contain malware as well...
- If they were targetted then of course the above considerations would not apply but as they say, are they going to be specifically targetted?
I am wondering if counterintuitively, their setup is not actually secure enough for their peculiar purposes?