🚀 go-pugleaf

Aron S. Spencer <aspencer@nando.net> wrote:

>In article <400emb$bnj@data.interserv.net> William Rini,
>billman@centcon.com writes:
$$I just read an article in Inter@ctive Week that tested the
$$registration wizard in Win95.  The hooked up the system to intercept
$$the message and read what was being sent.  Guess What?  It was the
$$same info that the registration asked if it was ok to send.

$$You would think that if a couple of reporters working for a magazine
$$could figure out how to test the registration wizard, someone at
$$Motorola might be able to figure it out.  

>   The people defending the Registration Wizard appear to have no concept
>of corporate security. Functionally, Microsoft has built a back door in
>to their operating system. The wizard may only send what you say is OK,
>but it has the capability of doing much more. Whether Microsoft does it,
>or some enterprising hacker, the RW can profile the systems run by a
>corporation, and send the information out. It is only a short stretch
>from there to actually send out files, etc. This is not acceptable. It
>couldn't be too difficult for a 'corporate espionage' type to produce a
>virus or worm which would replace Microsoft's phone number with their
>own, and use the RW to... 
>   Well, you get the idea. From a corporate security viewpoint, Win95
>_can not_ be used.

Obviously, you have no concept of network security.
Every credible report of what Registration Wizard does indicates that
it is a client, not a server. The user has to press the button to send
out the information, Microsoft or some cracker can't send a message
to Windows 95 and request the information from your computer.

Eric Gisin, ericg@unixg.ubc.ca