Hot answers tagged

118

(updated, at the bottom - "The 1950 car") Forget talking about security. Don't take the "SECURITY" road. Because if you talk about "security" alone, then chances are good that they are right, and you are wrong, and they'll be clear-sighted enough to realize it. There is no computer that is completely secure, and there is no computer that is completely ...


100

Nope. After Microsoft discontinue security updates for a version of Windows there is not a safe way to run that version of Windows. Some people will promote Virtual Patching where you have a external firewall scan all your traffic looking for patterns of traffic that look malicious. I would not trust that, and it requires a seperate non-vulnerable ...


82

Most people (this isn't simply "old timers") think computers get broken into by a hacker sitting in a dark room personally trying to attack them by typing really fast. That's why you get responses like "What am I the CIA/Millionaire?". They simply don't see the value in anyone bothering to try to go after them. And if this were the correct model, they'd ...


37

No, anti-malware is not a replacement for security updates. Neil Matz summarized the Fortinet's Q2 Global Threat Landscape report for 2017, noticing: WannaCry and NotPetya targeted a vulnerability that had been patched by Microsoft a few months earlier. But it’s not just these high-profile attacks that target recent vulnerabilities that are the ...


22

One possible response could be: "Because I can't support helping you fix it anymore. If you want help from me, in the future, you'll need to upgrade." Yes, this is effectively holding your expertise hostage, but if you give them sufficient notice that you'll stop offering support at a reasonable point in the future, and explain that you can't afford the ...


12

There is no realistic substitute for software patches. There are additional security measures one can take, but all of them have their limitations. Antiviruses will not do a thing against attacks that do not write to disk. If an attacker hijacks a legitimate process in memory, it's open-season on your data. These kinds of attacks are becoming more and more ...


11

The answer may very well be that you're wrong. Yes, this is counter-intuitive, but it may be true. Whether or not using an XP machine is a problem depends a lot on your setup (mostly router, since even plugging in the cable is troublesome otherwise), on what you are doing, on who you are (yes, certainly, there are people who are more valuable targets than ...


9

If their old XP machine is working perfectly fine for them then there is a good chance they simply use the computer for light web usage and email. If so you might have some luck moving them over to a lightweight linux distro themed to look like XP. This way its secure/up to date and costs no money since they can use the computer they have. They seem to ...


6

Windows 7 was released 10 years ago. Wanting to use win 7 now is the same as wanting to use win xp in 2013 (the year windows 8.1 was released), or wanting to use windows 95 in 2004. There were such guys in that era too, and we made fun of them at the time1. Technology is changing, you should learn to adapt if you want to succeed in this field. If you want to ...


6

The problem is less likely the security of the Ubuntu system as shipped by the distributor. It is very rare that there are critical issues which allow an remote attacker to hack the system. And while there are sometimes critical issues which allow privilege escalation by a local user they are rare too. But you can actually limit the impact further by only ...


5

Explain to them what they will lose: Online banking: money!!! Email: the account, reputation Storage: old photos, documents Scammers don't care how many letters you have, they try everyone and if your door is open they get in and wreak havoc.


5

This isn't an I.T. problem and you shouldn't treat it as one. Some of them are still poor People who are retired - particularly if they don't have a lot of income/savings - are very reluctant to spend money on stuff they don't think is a necessity. As an analogy consider someone with an old, rusty oven. Sure it may not be as efficient, hygienic...insert-...


5

Your thinking is correct when considering this from a technical information security perspective. Your post states It's just that I cannot see how can fully patched OS be less important here?. It's not. The question you linked is about communication, not the technical best practices for securing an endpoint. The upvoted answer to that post is trying to ...


4

As others have said, it is not recommended to try to use an antivirus as a replacement for system updates. An antivirus is just one component of your system security, which also includes a secure network (incl. updated router), updated firmware and applications (especially your browser), 'street smarts' of what not to click on, and of course, an updated ...


4

They won't be able to use the Internet much longer This isn't an idle threat or something overblown. Open up whatever browser they prefer (IE8, Chrome 49, or Firefox 52). Have them try to do... anything. Now, stop them and note the SSL notification. Windows XP SP3 has a barely functional SHA2 certificate implementation With the release of Service Pack 3 ...


3

I suggest that you explain it to them in terms of basic maintenace (like for cars or any other machine). I suggest that you change priority though. Automated, verified reliable local offline backups should be the overwhelming highest priority. (like oil in engine and non-bald tires). Explain that they can recover from nearly any breakdown with this. And ...


3

Would the potential for a ransomware attack get their attention? Perhaps a not-so-far-fetched scenario is this: Someone else is using their wifi (e.g. another family member) who unwittingly installed a rogue program on their device. The rogue program scans all other devices on the network for known vulnerabilities. Because both devices are behind the router,...


3

The relevant patches that must be download and applied are described in the following MSRC Portal page. Matching the OS version number to your system, clicking the article number brings you to a page showing the build number your system should show after you patch. For example, for Windows 10 Version 1809 for x64-based systems, this link shows the ...


2

This is where the concept of Defence in Depth comes into it's own. Yes, patch regularly and properly, but account for the fact that in any non-trivial system you will have vulnerable components. Your first line of defence, as XSS is sometimes exploited via phishing, training your end-users about how to spot and avoid phishing attacks. If the user had ...


2

Considering PHP v5.3 and v5.6 are end of life for a while, no more patches, (security) fixes or updates will become available even if security issues are discovered. Your hosting provider is quite late in removing these PHP versions considering v5.6 is end of life since December 31st, 2018. So, can we say it is "fairly safe" to run an outdated PHP ...


2

From a security POV, you're exposing yourself to every security vulnerability that has been patched since you last applied updates. There's far too huge a number to really be aware of every single security flaw, but you can get a decent idea by looking at the List of Android Security Vulnerabilities and using the buttons at the top to include only higher ...


2

Here is a list of some common ways that computers become infected with malicious software, and whether anti-virus, system patches, or neither of those are effective in protecting against this. As with many questions like this one, a lot depends on the use case. 1) Downloading executable software from the Internet and running it as administrator. This is ...


2

If they are into their cars, it might be an idea to compare it to an old car. Yes it works, but it's got no crash resistance, or theft resistance. Similarly old computers work, but they have no protection against miscreants who might try to break into it.


2

I've dragged a number of family members off obsolete platforms. The "platform" and "security" problems are tightly intertwined, and it's also tangled up with the "support issue" generally. So I'm going to talk about selecting a platform that mostly resolves the security issues and we get the rest as a bonus. You won't sway them with a complex argument, ...


1

Some of them are still poor Poorer than ever, most likely. Don't forget to point out that you get much more for your money now than when they bought their computer. If they have updated their car in the last 20 years, make comparisons to that (air bags, less gas etc). In fact, chances are that you can get a decent-enough computer now for a lot less money ...


1

Sorry to add yet another answer, but I don't think anyone has addressed this angle yet. First, some caveats: the other answers are correct that people acquire their understanding of technology through painful trial and error and have very specific workflows memorized and anything that disrupts those is problematic. We should be compassionate towards the ...


1

My personal vote is that those are pretty much equivalent. Presumably in both cases only the ubuntu mirror host is allowed to reach out, and only to the official mirror site. Whether the B mirror is allowed to reach out directly, or has to proxy off the cache in A seems like splitting hairs. Either way it's getting the same cryptographically signed data from ...


1

Sadly you will probably not have much of a choice because Windows 7 will not even support the newest generations of CPUs. Or any kind of reasonably new hardware, for that matter. In 2020 you won't get drivers for anything. It already doesn't support recent CPUs now (though you can "fix" the problem with a hack, since the does-not-support thing is just ...


Only top voted, non community-wiki answers of a minimum length are eligible