0

(This question bugs me because I am not willing to upgrade for Windows 10)

If we are talking about a device (i.e. a PC) in the following scenario:

  • The device is located behind a router that is up-to-date and all inbound ports are closed
  • There are no other malicious devices in your home network
  • No one else but you has physical access to the device
  • The device has no WiFi or Bluetooth (or simmilar) interface
  • The software you are accessing the internet with i.e. webbrowser, email client, etc. are up-to-date

Are OS security patches for that device really of such importance? If so, please explain why.

Improve this question
4
  • 3
    If you download files from the Internet then also Windows Explorer comes in contact with them and also all programs that have installed extensions in Windows Explorer. Some vulnerabilities just need you to display an image or a preview image in Explorer to execute malicious code.
    – Robert
    Aug 20, 2021 at 19:56
  • 1
    You could always try a Linux distribution, assuming your objection to Windows 10 is the cost.
    – gowenfawr
    Aug 20, 2021 at 20:29
  • 2
    FYI: Software including web browsers will eventually drop support for Windows 7. Apparently Chrome intends to in January, after pushing the date out once already. Eventually you won't be able to keep your software up to date.
    – Alexander O'Mara
    Aug 20, 2021 at 21:29
  • 1
    It's bad juju to run Windows 7, Jonny. Update your OS, Jonny.
    – hft
    Aug 20, 2021 at 22:11

2 Answers 2

Reset to default
2

Simple answer: the browser, like any software, depends on libraries provided by the operating system, a number of which may be unpatched if the OS in question is end of life and does not receive any further security updates.

If your current OS is Windows 7 (or worse - XP but I can't believe that) you should have cause to sorry. If it's Windows 8 you should still receive security updates until 2023. In that case your OS can still be considered "up to date". But expect to receive critical updates only, not new features or improvements since the OS is retired commercially speaking.

See: Lifecycle FAQ - Windows

Improve this answer
1

All your points cover network access and physical access. But that's not the major threat to computers: the major threat is what is run on the computer during normal operation.

  • email attachments
  • programs
  • and a ton of what happens on your browser

Your browser and email client might be up-to-date, but what if they have a vulnerability that doesn't have a patch? (this happens more than we like to realise) Then your OS is wide open.

Security is about defense-in-depth. Technology is a stack of layers and so is security. If you weaken one layer, you are relying all the more on the few layers left to be rock solid. And playing Russian Roulette.

The advice from all experts is to run only up-to-date and supported software. Sure, there are ways that you can "strengthen the stack" when you need to have one weak layer, but home users are not normally set up to do that.

The better option is to run another OS that is up-to-date. Don't want Windows 10? Then look at alternatives.

Improve this answer
1
  • 3
    In addition browsers use libraries that is part of the operating system. What if the graphics stack is vulnerable to a malicious image?
    – vidarlo
    Aug 20, 2021 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .