|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
A review of Win10’s new security features
A review of Win10's new security features
Given the increasingly sophisticated nature of malware, it’s no surprise that Microsoft built new security capabilities in Windows 10.
The company also enhanced its built-in encryption tool, BitLocker, to make it easier to protect your data.
Moving authentication beyond the password
Here are three new features that make signing in to PCs and sites easier and more secure. Most of these new capabilities, however, require additional hardware or newer security features such as built-in Trusted Platform Module (TPM) chips (more info).
Windows Hello: Have you seen those Win10 TV commercials showing cute babies around the world? The narrative suggests that today’s small children will grow up in a world without passwords — a world where they can sign in to their devices with nothing but a smile.
The death of passwords and the promise of biometric authentication have been heralded for years now. We’re not there yet, but Windows Hello is a step in the right direction.
Windows Hello is the biometric-authentication component in Win10. With the right hardware, you can use facial recognition, fingerprints, or iris scanning as your security credentials. As you’d expect, Hello can’t be fooled with a simple photo of your face. In fact, based on tests described in a TECH2 article, the facial-recognition technology is so accurate it can differentiate between identical twins.
The major catch with Windows Hello is, of course, the added hardware needed to make it work. Microsoft’s description of Hello includes this footnote: “Windows Hello requires specialized hardware, including fingerprint reader, illuminated IR iris sensor, or other biometric sensors.” And you can’t use a simple USB cam for facial recognition — the system currently requires specialized cameras such as the Intel RealSense 3D. According to the Intel RealSense site, selected laptops from ASUS, Dell, Lenovo, and others already have the camera built in.
Iris scanners are rather rare on PCs, but fingerprint readers are fairly easy to find on portables or easy to add to a desktop system.
If you have a device installed that supports Windows Hello, it’s enabled by clicking Start/Settings/Accounts/Sign-in options. (The Hello setup option won’t appear if your system doesn’t have a compatible recognition device.) According to the official Hello FAQ, the biometric data used to identify you is kept only on the local device.
Passport: This option takes password elimination to another level. You start by enrolling a device with Passport using a PIN or Windows Hello; the system then authenticates you via an MS account, Active Directory account, Azure Active Directory account, or a non-Microsoft service that supports FIDO (Fast ID Online; more info) authentication.
After you’ve been verified by Passport, you can connect to protected accounts and services without needing to enter individual passwords.
Microsoft Passport provides stronger security because it uses two-key, two-factor identification in place of passwords. (Device enrollment is one factor; a PIN or Windows Hello is the other.) That helps protect your identity and credentials from phishing, brute-force attacks, and keystroke logging. It also prevents replay attacks, even if a key is intercepted or compromised.
At this point, Password is designed mostly for corporate-IT implementations and newer systems that have onboard TPM security.
Device Guard: Despite security best practices, the unfortunate reality is that malware and exploits still slip through. In part, that’s because most network and device security is a reactive measure.
Before security vendors can create the signatures needed to detect and block new exploits, each threat must be found and reverse-engineered. Systems are most vulnerable in the time between the release of a new exploit into the wild and the release of the signature updates needed to block it. The problem is compounded by smarter exploits employing clever phishing attacks and tricks that hide the malicious code.
Device Guard is designed to flip the current security model by allowing only known-good applications to run. As with Passport, it’ll initially be offered to corporations. It’s a sort of white-listing approach that relies on security signed by the Windows Store, trusted vendors, or the enterprise itself.
Device Guard runs in a separate, virtualized environment from Windows. It’s isolated from the Windows kernel, so it can’t be compromised, even if an attacker has root access to the Windows 10 system. Device Guard has both software and hardware components; the latter will show up in future PCs. For details about this new technology, see the MS TechNet page, “Device Guard deployment guide.”
BitLocker has broader application in Win10
If you want to prevent even dedicated attackers from stealing your information, you need to encrypt it. BitLocker was an enterprise option in Windows 7, but it’s now more widely available in Windows 10. Here’s what you need to know about this encryption tool so that you don’t lock yourself out of your own data.
Win10 authentication controls can prevent someone from signing in to your PC, but data stored on removable media such SD cards or USB flash drives is often easily lost or stolen. And if the PC is lost or stolen, an attacker can simply remove the drive and install it in another PC to access its contents. Skilled hackers can find ways to bypass the Windows lock screen.
With Windows 10, BitLocker is both easy to set up and can be applied to system drives, data drives, and removable media such as flash drives. You access BitLocker by clicking Start and typing BitLocker. By the time you get to the L, Windows should display Manage BitLocker as the top result. Select it.
When the BitLocker Drive Encryption applet pops up, it’ll display the drives it can encrypt. To get the process started, just click Turn on BitLocker next to the drive you want to protect (see Figure 1).
Figure 1. In Win10, BitLocker lets you encrypt system, secondary, and removable drives.
Next, you’ll be prompted to create a password. Then you’ll have to choose how you want to back up your BitLocker recovery key. Note: This is step is extremely important; once your data is encrypted with BitLocker you’ll not be able to access it without valid credentials. If you forget your BitLocker password, the recovery key will give you access the data.
For removable media, you can save the BitLocker recovery key to a Microsoft account, a file on your local system, or a printed hard copy (see Figure 2). When encrypting fixed drives, you can also save the key to a USB drive. Not surprisingly, if you choose to save the key as a file, you’ll be forced to choose a drive other than the one you’re encrypting.
Figure 2. You have several ways to keep your BitLocker recovery key safe — including on a USB drive.
I recommend using multiple methods just to be safe. Saving to a Microsoft account is relatively straightforward, but if you do save the BitLocker recovery key to a file or print it out, make sure you put it in a safe place — and remember where you put it. It’ll be really frustrating to know you saved the recovery key, but you can’t find it when you need it. (Note: You might not be able to use a Microsoft account to save the recovery key for removable drives.)
Next, you must decide whether to encrypt the entire drive or just the space that’s currently in use (the default option; see Figure 3). It’s generally faster to encrypt only the used disk space, and new data will be automatically encrypted as it’s added.
Figure 3. Choose whether to encrypt only used space or the entire drive.
If you have an older drive that’s been used extensively, you might consider encrypting the entire drive. Even if you’re currently using only a small portion of the drive, data that was previously stored and “deleted” might still be retrievable if it’s not in an encrypted portion the drive.
When encrypting the primary system drive, BitLocker offers an optional system check (see Figure 4). It makes sure that BitLocker can read the recovery and encryption keys correctly before it starts encrypting your system and data. I strongly recommend running that check. Once the system check is done, BitLocker will restart the PC before starting encryption.
Figure 4. When encrypting a primary drive, be sure to let BitLocker run its system check procedure.
During the encryption process, you can continue using your PC. Eventually, you’ll get a small popup box notifying you that the encryption process is done. BitLocker makes it easy to change your password, turn on automatic unlocking, or turn off BitLocker altogether.
Keep in mind that if you back up your data to an unencrypted cloud service or an unencrypted external drive, that backup data won’t be protected. BitLocker decrypts the files before transferring them to backup storage. To ensure end-to-end security, choose a cloud provider that uses data encryption — and use BitLocker to encrypt external-storage devices.
BitLocker encryption does have a small effect on performance. Files have to be encrypted as they’re written to the drive and decrypted as they’re accessed. Typically, the lag is imperceptible, and it’s a small price to pay for peace of mind.
The mystery of dueling email-service passwords
Lounge member Vincenzo writes to the Non-Outlook Email forum to describe the puzzling behavior of a friend’s email account.
Vincenzo’s friend uses Cox.net as his ISP and Windows Live Mail as his email service. He states, “The Cox email account is the only email account that is configured in WLM.”
He’s chiefly baffled by the email systems’ reaction to passwords. WLM won’t accept a recently changed Cox password — it wants the user’s old password. Adding to the confusion, he finds “Apparently you can use WLM and have it ‘Connect to Windows Live Services’ or not. This is determined by the setting in Options/Connection/Connecting to Windows Live Services …. If I tell it to ‘Stop signing in,’ then his newer password, as entered in the email setup, allows it to work fine.”
Vincenzo’s friend can get to his messages, one way or another. But the confusing password access gives him pause. If you have some insight into reasons for it, we invite you to contribute your thoughts.
The following links are this week’s most interesting Lounge threads, including several other new questions for which you might have answers:
starred posts: particularly useful
If you’re not already a Lounge member, use the quick registration form to sign up for free. The ability to post comments and take advantage of other Lounge features is available only to registered members.
If you’re already registered, you can jump right into today’s discussions in the Lounge.
Remedies for common printer pains
Print-spooler jams, overpriced ink, and mechanical failures soon after the warranty expires; these are just a few of the printer hassles that have contributed to our love/hate relationship with computer printers — of all brands.
Here are some solutions that will make us feel a bit better about our most — ultimately — expensive peripheral.
I rarely print in color; I typically make hardcopies of documents in draft mode, using only black ink. So I was surprised, recently, when my Canon printer stopped printing and its yellow error light flashed, indicating that one of the three color cartridges needed to be replaced. Where had the color ink gone?
The answer is relatively simple — and applies to nearly all brands of ink jet printers. You know how your printer makes all sorts of mechanical noise each time you power it on or before it processes a print request? It’s running a regular maintenance check and automatic print-head and nozzle cleaning. And each time it does so, it uses a little bit ink from each color cartridge.
According to a June 2013 Consumer Reports article, “Some, even a lot, of that precious ink probably never even makes it onto printed pages. Instead, it’s used to clean print heads and for other maintenance chores, typically when the printer is preparing to print after sitting idle for some time.” Compared by volume, brand name ink costs considerably more than a U.S. $180 bottle of Dom Pérignon Champagne.
Annoyingly, I’m held hostage by the color cartridges. If any one of them runs out, the printer locks up until it’s replaced — even if I select monochrome or grayscale printing. Even more annoying, both ink-jet and laser printers commonly flash low-ink warnings when there’s 10 to 20 percent ink remaining.
Let’s face it: we’re not really buying ink from printer manufacturers, we’re buying printers from ink companies. Ink-jet printers, especially, are sold as loss leaders. The profit is in the ink — and it’s a very profitable business. If not for the increasing availability of third-party ink, we might easily be paying the same for a set of brand-name ink cartridges as we spent on the printer, itself.
I’m sure printer manufacturers have their reasons for the premature low-ink warnings, but obviously there’s more profit when consumers replace ink cartridges before they’re truly empty.
Remedy 1: Four ways to reducing ink costs
Fortunately there are a number of steps we can take to reduce ink-consuming printer routines and get more ink out of cartridges before the false alerts that they are empty.
- Don’t turn off your printer. Inkjet printers use a bare trickle of electricity when left on — but consume extra ink every time they go through their startup cleaning cycle. Canon told Consumer Reports that “if the printer is switched off then it may do a longer clean.” If you turn the printer on frequently, that’s just more wasted ink.
- Set your printer preferences to “Draft” mode as the default. In Windows 7, 8, and 10, select Devices and Printers from the Start menu. Right-click on the default printer and then select Printing preferences. Each brand of printer could have different print-setting choices; if you don’t see Draft mode, other choices might include Ink-saving mode or, as shown in Figure 1, Fast or Custom modes.
Figure 1. Most printer properties settings in Windows let you set monochrome, gray-scale, or other noncolor mode by default.
- Don’t change the existing cartridge unless you absolutely have to — even if you’re switching to a cheaper, third-party cartridge. Each time the printer senses that a new cartridge has been installed, it runs its laborious, ink-eating, start-up routine.
- If you rarely need color printing, consider getting a laser printer. Lasers typically don’t waste ink during the cleaning process. Save the inkjet for when you need to print photos or other color documents.
Be very selective with off-brand ink cartridges: I purchased 15 extremely cheap replacement cartridges for my Canon Pixma printer from a no-name, third-party vendor on Amazon — and discovered that cheap truly can be expensive. The red ink printed a mottled brown, and the black periodically printed unevenly; and because the cartridges didn’t have the onboard chips needed to communicate ink levels, I had no idea when they’d run out.
Vowing not to be so cheap, I searched the Web for better cartridges. Eventually, I found sites whose cartridges have a proven track record but are still significantly cheaper than Canon’s ink. These third-party cartridges also have the smarts to correctly communicate with the printer and computer. Here are three recommended ink providers.
- 4Inkjets: A number of websites such as Cheapism give this ink vendor high marks. 4Inkjets offers remanufactured, compatible, and OEM ink cartridges. I purchased an 11-cartridge set for $44 — just a few dollars more than you’d pay for a four-cartridge Canon set on Amazon. The 4Inkjets product works just like Canon’s, you get comparable printing results, and 4Inkjets promises easy replacement/refunds and no shipping charges.
- 123inkjets.com: Good reviews on various websites led me to this vendor. Its prices are a bit higher than 4Inkjets and there’s a shipping fee for orders under $55. Still, the company’s prices are far less than brand-name ink. Reviews give the site high scores for customer service and two-year warranties, making it a worthy choice.
- Costco: The retailer offers a cartridge-refilling service at most of its photo stations. Members can bring in their brand-name ink cartridges for a refill. The process takes an hour or less and costs about $10 for each cartridge — a savings of about 30 to 40 percent. Costco will fill only original cartridges, not third-party ones.
Remedy 2: Epson’s no cartridge printers
For heavy ink-jet users, Epson has produced a family of color printers that eliminate the need for ink cartridges. The printers are somewhat more expensive, but they use Epson’s Ecotank (more info) technology. These printers have ink tanks that can hold the equivalent of 20 cartridge sets.
Epson boasts that the tanks hold enough ink for two years of black and white and color printing. You then refill the tanks (see Figure 2) from inexpensive ink bottles that cost about $13 each (or $52 for a set of four). The Ecotank series of printers also come with a two-year warranty. (Some ink-jet vendors argue that replacing the cartridges is better because you’re effectively replacing the print head.)
Figure 2. Epson's Ecotank series of printers are more costly, but use a less-expensive ink-tank/refill-bottle system. – Source: Epson
Epson’s theory is that those to do a lot of color printing will be willing to pay more upfront if they’ll save significantly more in ink over the long run. Prices for this family of printers range from about $370 for the Expression ET-2500 to $1,200 for the business-centric WorkForce Pro WF-R4640, which uses large ink packs.
Although Epson would not provide a unit for review, the concept of ink tanks is quite appealing. For example, it eliminates printing stoppage when even a single cartridge fails or empties. And when you do have to refill a tank, there’s less mess — and, of course, you don’t have to refill nearly as often.
Remedy 3: Clear a stuck print-job queue
We’ve all had those instances when we kick off a print job — and nothing happens! Typically this occurs when an earlier print job gets stuck in the print spooler, either because there was no paper in the printer or some other printer issue interfered.
Typically, you remove the problematic document by clicking Start, then Devices and Printers. You then click the printer’s icon, select See what’s printing, highlight the print job at the top of the list, right-click it, and select Cancel from the drop down menu.
But what if that doesn’t get things moving again? If you’re sure the printer is communicating with the computer properly, you might try bulk-deleting the jobs from the print spooler. Type services and click View local services to open the Windows Services tool. Scroll down to Print Spooler, right-click it, and select Stop from the drop-down menu. This will clear all documents and you should be good to go for new print jobs.
Figure 3. Clearing a stuck print spooler via Windows Services
Remedy 4: When all else fails, sue them!
The problems with ink-jet technology have resulted in numerous legal actions — going both ways. For example:
Things fail as soon as warranties end: A significant number of Canon-printer owners had print-head failures soon after the one-year warranty expired. There seemed to be a pattern, which prompted a class-action lawsuit. Though Canon denied any wrongdoing, they agreed to pay $930,000. Each class member will receive $50 in cash or $75 for a Canon store voucher. Canon also agreed to extend the warranty period by nine months for those who have print-head issues.
To see the particular models involved, and to get listed as a lawsuit class member, go to the settlement information site before Nov. 24.
You can’t use someone else’s ink in my cartridges! Printer and ink manufacturer Lexmark International filed a patent-infringement lawsuit against one of its customers, Impression Products, who refilled a limited-use, Lexmark toner cartridge via a lower-priced third party. Lexmark claimed that its patents limit specific cartridges to single use by third parties. Only Lexmark is allowed to refill the specified cartridges — anyone else who refills the cartridges is a patent infringer. (Apparently, Lexmark sells an identical but higher-priced cartridge that third parties could legally refill.)
The case is climbing slowly through the courts. It started with numerous parties, but now involves only Impression Products, who, so far, has successfully argued its side. Now in the Court of Appeals for the Federal Circuit, the lower courts felt that if Lexmark can force its printer customers to use only new Lexmark or Lexmark-refilled cartridges then consumers lose the right to enjoy competition and are unduly forced to pay the significantly higher prices for ink.
That’s what we’ve been saying all along. Print that!
Taking the Microsoft HoloLens for a test drive
Microsoft has taken its new holographic technology on a developer road show.
Shooting space marauders was fun, but the demo showed that HoloLens still has a long road ahead before it’s ready for retail.
HoloLens doesn’t come close to the Starship Enterprise’s imaginary holodeck; it’s more a toe in the water for virtual-reality computing and gaming. The system consists of a relatively light headset running an onboard Windows 10 computer. It’s completely standalone — there’s no wired or wireless tether to a PC required.
It’s both similar to and very different from Google Glass, now apparently in hibernation. Google’s device essentially shrunk a laptop computer into a tiny, heads-up display immediately in front of your right eye. It was designed to go anywhere and was hailed as ground-breaking technology. But its built-in camera and microphone soon raised howls of concern about the privacy of others. It was actually banned in some businesses and countries.
HoloLens isn’t simply a standard computer in a new wearable form factor. Its raison d’être is to merge physical and virtual environments, using a device that’s both highly portable and relatively affordable for consumers.
Figure 1. Microsoft's HoloLens virtual-reality headset
Based on a developers’ demo day I attended, the HoloLens hardware seems nearly baked. It’s now up to software engineers to create the knock-your-socks-off applications.
The three tenets of the HoloLens system
The concept of combining physical and digital environments can be a bit difficult to grasp. Some of the promo photos on the HoloLens site can help. (In this case, a picture really is worth a thousand words.) To keep it simple, Microsoft breaks down the technology into three parts: gaze, gestures, and voice commands.
With the HoloLens headset in place, you “gaze” through its mostly transparent lens at your physical surroundings. The lens also displays digital objects that can be tied to physical things. You could, for example, virtually furnish an empty room you’re actually standing in — then use commands to change wall colors, move furniture around, and so forth.
You use “gestures” to manipulate your virtual environment. To select, mark up, reshape, or move virtual objects, you use a finger tap that’s directly analogous to tapping a touchscreen. But to tap HoloLens’s holographic screen, you hold your hand up in front of the lens and use your index finger to tap. (At the demo, we had to practice this gesture before we were trusted with the headset.)
Voice commands are obviously important for this type of wearable device. Multiple microphones in the headset are supposed to pick up and correctly interpret your spoken commands, while ignoring any extraneous surrounding noises. It’ll be interesting to see how well voice recognition works when confronted with a good Scottish brogue.
The live test drive: Virtual gaming
Computer gaming will, of course, be one of the first popular applications for HoloLens. At the developer event, we were each outfitted with a device and played a round of Project X-ray, a demonstration space-alien shooter game. (Any game that gets you off the couch can’t be all bad.)
In this case, you start the game by spinning 360 degrees so that HoloLens can map the room. You then blast away at bad guys crawling through the room’s walls while also ducking and weaving to avoid getting shot yourself. I don’t do much gaming because I don’t find sitting at a keyboard entertaining. But in the holographic environment, the enemy can come from any direction, so I had to jump around to avoid them.
The 3D computer graphics and sound were impressive. And yet, some parts of the demo were lame. Shooting the enemy with the standard HoloLens tap-gesture isn’t going to cut it for most gamers. I assume software and accessory developers will soon be creating more interesting alternatives.
I also don’t have a solid impression of what merging physical and virtual worlds feels like. You’re so focused on the game that real objects simply disappear.
Still, it’s early days for HoloLens. As one software engineer put it, the demo was like virtual-reality Pong.
Microsoft’s reps stated that the Developers Edition of HoloLens will come out in Q1 of next year, priced at $3000. When we’ll see a retail version, and at what price, they wouldn’t say.
(Note: This story was originally published on our sister site, SuperSite for Windows.)
Irish interpreters of baseball study the game
 |
If you’re uneasy about your command of the rules of America’s favorite pastime (baseball, remember? not football), you might take comfort in the likelihood that you know way more about the game than the Irish lads in this video. They genially accept an invitation to watch a match between the San Francisco Giants and Kansas City Royals and find much to admire in the details of the spectacle. Although they hatch entertaining theories about what’s going on in front of them, most of the game’s lingo and action and fan behavior bewilders them — but for this one penetrating insight (achieved after the first half of the first inning): baseball is not swiftly paced. Click below or go to the original YouTube video. |
| Post your thoughts about this story in the WS Columns forum. |
Publisher: AskWoody LLC (woody@askwoody.com); editor: Tracey Capen (editor@askwoody.com).
Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. AskWoody, Windows Secrets Newsletter, WindowsSecrets.com, WinFind, Windows Gizmos, Security Baseline, Perimeter Scan, Wacky Web Week, the Windows Secrets Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of AskWoody LLC. All other marks are the trademarks or service marks of their respective owners.
Your email subscription:
- Subscription help: customersupport@askwoody.com
Copyright © 2025 AskWoody LLC, All rights reserved.
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Mozilla shutting Deep Fake Detector
by 1 hour, 14 minutes ago
-
Windows-Maintenance-Tool (.bat)
by 1 hour, 17 minutes ago
-
Windows 11 Insider Preview build 26200.5641 released to DEV
by 3 hours, 46 minutes ago
-
Windows 11 Insider Preview build 26120.4250 (24H2) released to BETA
by 3 hours, 48 minutes ago
-
Install Office 365 Outlook classic on new Win11 machine
by 3 hours, 45 minutes ago
-
win 10 to win 11 with cpu/mb replacement
by 1 hour, 39 minutes ago
-
re-install Windows Security
by 7 hours, 2 minutes ago
-
WWDC 2025 Recap: All of Apple’s NEW Features in 10 Minutes!
by 10 hours, 43 minutes ago
-
macOS Tahoe 26
by 4 hours, 57 minutes ago
-
Migrating from win10 to win11, instructions coming?
by 47 minutes ago
-
Device Eligibility for Apple 2026 Operating Systems due this Fall
by 11 hours, 30 minutes ago
-
Recommended watching : Mountainhead movie
by 52 minutes ago
-
End of support for Windows 10
by 9 hours, 38 minutes ago
-
What goes on inside an LLM
by 53 minutes ago
-
The risk of remote access
by 10 minutes ago
-
The cruelest month for many Office users
by 2 hours, 26 minutes ago
-
Tracking protection and trade-offs in Edge
by 28 minutes ago
-
Supreme Court grants DOGE access to confidential Social Security records
by 1 day, 9 hours ago
-
EaseUS Partition Master free 19.6
by 9 hours, 44 minutes ago
-
Microsoft : Edge is better than Chrome
by 1 day, 22 hours ago
-
The EU launched DNS4EU
by 2 days, 11 hours ago
-
Cell Phone vs. Traditional Touchtone Phone over POTS
by 2 days, 1 hour ago
-
Lost access to all my networked drives (shares) listed in My Computer
by 2 days, 16 hours ago
-
Set default size for pasted photo to word
by 2 days, 22 hours ago
-
Dedoimedo tries 24H2…
by 2 days, 10 hours ago
-
Windows 11 Insider Preview build 27871 released to Canary
by 3 days, 21 hours ago
-
Windows 11 ad from Campaign Manager in Windows 10
by 1 day, 14 hours ago
-
Small desktops
by 1 hour, 58 minutes ago
-
Totally disable Bitlocker
by 2 days, 15 hours ago
-
Phishers extract Millions from HMRC accounts..
by 3 days, 19 hours ago
Remembering Woody
