Top
Best
New

Posted by tech234a 3/29/2025

Upcoming Windows 11 builds cannot install without internet and Microsoft Account(infosec.exchange)
268 points | 282 comments
samiv 3/29/2025|
I'm also 100% convinced Microsoft will introduce mandatory code signing at some point and make it so that you can only ever install software from Windows Store.

They are envious of the Google and Apple walled gardens/cashcows and are now determined to turn Windows into one.

Windows is no longer a product for users, the users of Windows are the product for Microsoft to be shoved into the Azure sales funnel.

signal11 3/29/2025||
This misses how Microsoft makes money from Windows. Taking a cut of apps isn’t that useful because most people don’t install many apps. Of course it’s still welcome revenue, especially for games, but Steam has too much goodwill there, and Epic won’t still idly by (and Adobe etc in other domains).

Instead Microsoft is trying to upsell cloud storage, backup and ad-free email (along with Office apps) with Microsoft 365. And on the biz side they’re getting into the biz of offering managed patched online Windows VDIs, kind of like Citrix.

Also Microsoft Store-only Windows is a deal killer for Windows in businesses. A lot of specialised LOB (line of business) apps run on Windows and the Store is a non-starter for those. And in home contexts there’s a bunch of legacy apps that people keep Windows for, dropping support for them will mean switching to ChromeOS or macOS just got easier.

So yeah — I fully agree they’ll absolutely shove you in into the Azure or M365 sales funnel, and individual users no longer feel like a priority. But non-store apps aren’t quite dead yet.

free_bip 3/29/2025||
The app-store-only restriction would likely be for home edition. If you want custom apps, you'll need pro or business licenses.
agilob 3/29/2025|||
That's the main reason why Valve is investing in Linux and Steam Deck.
eru 3/29/2025|||
Apropos, running Steam on my Archlinux Desktop with Windows compatibility turned on works really, really well. Much better than what I remembered from the bad old days of trying to get stuff running in Wine.
consp 3/29/2025|||
Wine and it's alternatives have greatly profited from valve going this route and as a result all software runs better. It's a gradual improvement over time and we are past the early stages. I'm still running a gaming PC on windows but that is going to end quite soon if Microsoft keeps doing these things.
erikerikson 3/29/2025||
Stream actually paid for contributions to Wine if I understand correctly.

I too planning to use a gaming centric distro for my next gaming PC build. The horseshit they've been pushing at me on 10 has been atrocious. The lie that 10 would be the last. Injecting pages into Chrome. Windows acts more and more like literal malware.

nialv7 3/29/2025|||
Yes, steam contracts CodeWeavers which is the main company that supports the development of wine.
eru 3/30/2025|||
> I too planning to use a gaming centric distro for my next gaming PC build.

I don't find that the distribution makes that much of a difference?

I just use Arch Linux, and install all the programs (gaming centric or otherwise) that I need when I need them. I guess I'm lucky, because the Steam Deck's distribution is based on Arch Linux, but I used it before it was cool.

I suspect the main differences between the distributions is what you get by default, and that can be a huge factor in terms of convenience?

erikerikson 3/30/2025||
Yeah and good on you for using Arch but gaming distros are designed to support dummies, meaning people like me that don't really want to build the OS from the ground up get to coast. We just want to use it.

I know a fair bit about OS internals but especially when I'm gaming I want to play rather than read and follow technical docs.

Sorry, not sorry.

nobodyandproud 3/29/2025||||
Linux Mint with Lutris and Wine.

I completely removed Windows from all of my personal notebooks and workstations.

astrobase_go 3/29/2025||
I game using Steam on Pop_OS![1] with a home-built AMD machine and, while I know there are some background processes (Proton) that run to establish and maintain a compatibility layer, it's nearly seamless to me as a user. The most I really see is a progress bar that appears before some games where Vulcan shaders have to be pre-rendered. In my experience everything needed for Windows-native games to run on Linux is handled automatically, without any configuration, runtime flags, or anything else.

Early on I consulted ProtonDB to see if my games would run, but honestly now I don't even look at it any more. While YMMV depending on the games you play, I haven't encountered really any major bugs and zero crashes. The most I found was some strange shadow texture rendering artifacting in Baldur's Gate 3, but it was contained to a particular part of a particular map.

A decade ago it was kind of rough, but now? I am never going back to Windows for gaming. Playing games on Linux is light-years better than what it used to be. If you're curious but haven't tried it because you had bad experiences in the past, I'd encourage anyone to give it another go.

1: https://system76.com/pop/

tmikaeld 3/29/2025||||
I second that, everything "just works" as you'd expect it to.

If StreamOS can get widespread and they start to introduce desktop apps to the store, I think they can take some market share.

lcnPylGDnU4H9OF 3/29/2025|||
> everything "just works"

Just a note to readers who are interested in this: some games in your Steam library may still not work with Proton, but the ones that do work should have rather few issues. (I play exclusively on a Steam Deck so “should” is in reference to the variance in hardware among bespoke machines.)

herbst 3/29/2025|||
Imo just works is an understatement. Many games work better than ever.
throwaway48476 3/29/2025|||
On low power hardware many games run better because they not strangled by windows bloat.
eru 3/29/2025||
How bloated is Windows actually?
throwaway48476 3/29/2025||
Idles at 50% CPU usage running background tasks on a dual core. For steam deck, enough to be noticeable in FPS.
eru 3/30/2025|||
Is that 50% CPU usage across all cores? That's impressive (as in impressively bad).

I haven't used Windows in a few years, but I was actually fairly happy with Windows 10 as a casual user.

throwaway48476 3/30/2025||
One core, broadwell generation.

Devs don't test on low spec machines and MS fired the team that maintained the testing PC zoo a decade ago.

indemnity 3/30/2025|||
I have a 9950X3D and doing nothing Windows still lights up a core 5-20% every few seconds doing god knows what.

Linux on the same hardware does not.

MonkeyClub 3/29/2025|||
I still have a Windows computer for a single reason: PUBG on Steam.

If that worked on Linux, I would not longer need Windows at all...

ThatMedicIsASpy 3/29/2025||
PUBG - the game that must have tried every different AC at some point. Plus layering multiple at the same time.

I am glad they've added bots years ago which made me stop playing so I do not miss it.

throwaway48476 3/29/2025|||
Valve started with win8, almost 15 years ago now.
danielktdoranie 3/29/2025|||
The Steam Deck has done well, and releasing SteamOS for free so people can install it on their own PCs is great, but I think they should make a “Steam PC” they could sell. The majority of gamers aren’t technical and buy pre-built PCs. A Steam PC with Steam OS pre-installed would make it easy for these people to game on Linux and pump up the Linux gaming share of the gaming market.
woleium 3/29/2025||
the steam pc is the newly announced xbox, no?
donnachangstein 3/29/2025|||
> I'm also 100% convinced Microsoft will introduce mandatory code signing at some point and make it so that you can only ever install software from Windows Store

2017 called. It wants Windows S Mode back.

Needless to say it still isn't very popular. But this has been around for <checks notes> 8 years now

samiv 3/29/2025|||
Yep, the technology is already there.

Just a question of time before they flip the switch for good and force it down everyone's throat and call it "enhanced security and user experience".

ranger_danger 3/29/2025|||
There are so many legacy apps being used in the corporate world, I don't see this realistically ever happening.
3np 3/30/2025||
So just make that feature exclusive for enterprise versions and reduce the ease for private individuals to obtain one.
throwaway48476 3/29/2025|||
Windows S failed hard so they have a new strategy. Every new CPU ships with M$'s Pluton root of trust. For 'security' everything will have to be signed. They consider the user to be the threat actor. Eventually they will charge a percsnt fee for using their signing service.
erikerikson 3/29/2025|||
Have you met my mother in law? She really is.
donnachangstein 3/29/2025|||
This sounds like the UEFI Secure Boot FUD from > 10 years ago. That also didn't turn out like they predicted.
throwaway48476 3/29/2025||
The desire for control never went away.
octacat 3/31/2025||
The moment they roll it as mandatory - people would stop updating.
swat535 3/29/2025||||
Where is the EU when you need it?

It’s only a matter of time before Microsoft forces everyone with local accounts to switch to a Microsoft Account just to access their own machines. I wouldn’t be surprised if, in the future, local accounts are completely disabled, except maybe on specialized enterprise versions of the OS.

I'm exhausted by the anti-consumer behavior of American companies, constantly restricting user choice and access, undermining privacy, and hiking up prices, all in the name of "profit".

samiv 3/29/2025||
Profit?

You mean "enhanced security and user experience"? /s

KeplerBoy 3/29/2025||||
I actually would consider S Mode if it supported steam and it's games. For serious computing I boot into Linux anyways.
ndsipa_pomu 3/29/2025||
For serious gaming, I use my Linux powered Steam Deck
pxoe 3/29/2025|||
It's been near a decade of them trying and failing (or over a decade, if one'd look at windows 8 and its apps as part of some plan), that at some point this 'what if they lock everything down!!' thing just sounds like a FUD, which is kinda ironic. And the 'they're locking down installs!!' thing too, every time they make a change it gets to the front page here, and yet it still remains circumventable (just use Rufus). Years have gone by and the actual "locking down" of it still hasn't arrived.
throwaway48476 3/29/2025|||
They tried with windows S. No one bought it and if they did by mistake they returned it.

>Windows is no longer a product for users, the users of Windows are the product for Microsoft to be shoved into the Azure sales funnel.

So true. I won't be running win11 outside of a VM and anything but win11 IoT. You know where to find it...

0xmarcin 3/29/2025|||
I highly doubt it, Windows is known for its stellar backward compatibility. Code signing means a lot of older software, that is still in use, would not be able to install or run. This is not going to happen (at least in the enterprise).
samiv 3/29/2025|||
I have mad respect for Microsoft engineers for the compatibility work that they've done over the past decades. It is indeed superb that you can take even today an old Win32 executable and run it and it'll just work.

But I expect the new leadership will not put much value on this. I imagine it'd play out that first to "to enhance the security and improve the UX" they'll start a shoving a bunch of nagging dialogs in the users face "this app is not safe" etc.

Then they'll add a flag to enable "unsafe mode" where the user can run unverified / unsigned code.

Then finally they'll just nuke the flag.

After all requiring that the ecosystem with the most "important" apps such as their own office suite, slack, adobe etc. grind out new versions with digital signing is not out of alignment with these companies incentives and development cycles either.

In fact I would not find it surprising if these companies would actually be approached by Microsoft to participate in any such scheme and get offered some kind of "discount" or reward (whether it's app store discount or whatever else) and these companies would only see it strengthening their own moats against any possible competition.

And I'm talking about the consumer use case, not the corporate.

anthk 3/29/2025||
You don't know how many ad-hoc legacy apps based on Java/C# are out there. Zillions. If you want to give GNU/Linux a huge chunk of share (Java and C# code from early 00's/2010 will run everywhere), MS would face a huge disaster and billions of loses.
throwaway48476 3/29/2025||||
Users value backwards compatability. Users aren't the customers anymore and don't drive KPIs.
hulitu 3/29/2025||||
> Windows is known for its stellar backward compatibility.

was

fph 3/29/2025|||
They can just sandbox old applications, like they did with DOS ones.
bitwize 3/29/2025|||
This is likely why the TPM2 requirement is a thing for Windows 11: Microsoft wants to migrate all Windows users onto a hardware base with nigh-uncrackable security/DRM protection, such that everything from power on to application is signed, approved code. For "security".

And people will buy it. Because "general purpose computing" is a niche feature for nerds. (Astronaut 2: Always has been.) And it presents enough problems and extra work that most consumers woyld gladly give it up. Most consumers just want something thet can do Facebook/Excel/Spotify/Netflix/games with.

grishka 3/29/2025|||
Mandatory code signing is meaningless without secure boot though, which can't be made mandatory on x86 systems.
throwaway48476 3/29/2025|||
MS's pluton is in every new CPU.
grishka 3/29/2025||
And? Just, uh, boot without secure boot and patch things until they work again without enforcing code signing? The only way this sort of thing could be possibly partially enforced is by remote attestation for apps that depend on a server to function. So do what iOS jailbreaks did, except you don't need a vulnerability to start because secure boot will always be optional.
throwaway48476 3/29/2025||
Secure boot will not always remain optional for windows.
grishka 3/29/2025||
And how could that possibly be enforced?
throwaway48476 3/30/2025||
Same way it works for anti cheat.
grishka 3/30/2025||
The whole point of anti-cheat is to provide some sort of proof to a game server that your client is unmodified. What would be the server in this case?
bitwize 3/29/2025||||
Who decided that secure boot can't be made mandatory on x86 systems?

Microsoft.

They can reverse their decision at any time. Inasmuch as you are able to boot Linux on your PC, it's only because Microsoft deigns to allow it.

charcircuit 3/29/2025||
>only because Microsoft deigns to allow it

Other operating systems could still collaborate with manufacturers to have their key be trusted.

bitwize 3/29/2025||
But manufacturers won't cooperate. One OEM (Asus?) once cited a price of like $16M to trust one key. The price for Microsoft is nothing because Microsoft can say "trust our keys or lose Windows certification".
jychang 3/29/2025||||
Good thing they’re trying to move off x86, then
theandrewbailey 3/29/2025|||
I was under the impression that Secure Boot was a lot of the reason behind Windows 11's TPM 2.0 requirement.
grishka 3/29/2025||
That requirement isn't technical though. It's purely a marketing one. You can still install Windows 11 on a TPM-less machine and, for all intents and purposes, it'll work just fine.
cedws 3/29/2025|||
That would never work, they would have to have some kind of override. Microsoft doesn’t have that kind of leverage over Windows users because they don’t have tight vertical integration. If Windows 12 enforced that, users would just stay on Windows 11 and MS’ leverage would decrease even further.
PeterStuer 3/29/2025|||
Windows 12 Enterprise would have the option, Windows 13 Enterpise would remove the option but allow for a signed "legacy" sandbox. Windows 14 Enterprise would have no option.

They can play the long game.

jajko 3/29/2025||
Sure, if we talk about decade or more, companies can and will adapt. They can run several apps in VM, or just migrate to Unix. I've worked at bank who was through and through completely Linux including all front desk people, in 2010. If rigid banks can do it, everybody can.
sshine 3/29/2025||||
I can’t believe people didn’t stay on Windows 7. It seems to have slid into some always-online ad-filled cloud hellhole since. Office365 is worse than Office 2000. This is the OEM strategy still at play. You gotta hand it to Bill Gates for capturing PCs for decades. People truly don’t care how poor their operating system behaves, because your only other option is to buy a Mac.
jasode 3/29/2025|||
>I can’t believe people didn’t stay on Windows 7.

Normal mainstream users can't stay on very old operating systems like Windows 7 because they'll eventually be forced to install newer software that's not compatible with it. Outside actors other than Microsoft force os upgrades.

- buy a new printer and it only has drivers for newer os like Windows 10/11 and later

- need for installing newer software like latest versions of Google Chrome, Mozilla Firefox, Adobe suite, TurboTax 2024, etc. They don't install on Win7. For Windows 7, the last version of Chrome was January 2023. Last version of Firefox was August 2024.

So setting aside commercial apps like Adobe, TurboTax, etc. -- why can't a user just stay with old version of Mozilla Firefox that's compatible with Win7 and turn off updates?!? Because bank websites like JP Morgan will block the user with an error "You need to upgrade your web browser" because the SSL/TLS encryption algorithms in old Firefox versions are obsolete.

Deliberately trying to freeze your computer on Windows 7 or Windows XP means relegating it into a "museum piece" that becomes less and less useful for practical real-world tasks. That's ok for an isolated machine that runs old video games but no good for online banking.

abanana 3/29/2025|||
Some of us do! I get fewer problems at home on W7 than at work on W10/11.

- Printers: the W7 cohort probably overlaps with users of classic HP Laserjets (I know it's not just me!).

- Chrome: Supermium adds W7 support back into the latest(ish) version.

- SSL/TLS: does such an issue exist on W7? It's exactly what pushed my mother (at the age of about 65, and hating having to learn anything new) to upgrade to 11 from XP a year or so ago. I do all my Internet banking on W7, via several different banks as I often move around chasing the best interest rates, and never had a problem with any of them. (Vivaldi, Supermium, Firefox 115ESR.)

- Some software such as Adobe XD: yeah, unfortunately it's not supported. Depends how much it's needed I suppose. I may be forced to "upgrade" sometime this year but I'd really rather not.

anthk 3/29/2025|||
Windows XP and 7 have Legacy Update and unnoficial Supermium builds among Serpent browser and friends, and OFC with updated system TLS/SSL certs.

http://legacyupdate.net

Also, on more libre software, the community can release LibreOffice and VLC builds like crazy. Ditto with Sumatra PDF, Gimp, Krita...

lightedman 3/29/2025||||
"I can’t believe people didn’t stay on Windows 7."

Microsoft forced Win10 down people's throats. I had all of my machines Windows Update processes turned off and somehow it STILL got onto my systems. I suspect Skype was the mechanism through which Microsoft did this, as they owned Skype then and I still used it.

3np 3/29/2025||||
Some do, I guess.

https://github.com/i486girl/win7-sp2

https://news.ycombinator.com/item?id=43445103

gloosx 3/30/2025||||
Staying on some windows 10 lite-repack for about 8 years now. Automatically activated. Word, Excel, PowerPoint, Paint. Windows-7-like start menu. No UWP apps, cortana, onenote, onedrive, even no freaking microsoft Edge. No app store. Not a single moving pixel, ad or notification , or another jumpscaring layout when system starts. Everything installs/works perfectly, perfect system.

I have no idea why people even consider updating, must be some really weird case.

There is zero new value in the latest Windows versions, just plain nothing new, there is really no reason to switch.

d_tr 3/29/2025|||
Too much fuss with community hacks to maybe get stuff working and end up having wasted time in any case. There is too much garbage to deal with in modern computing already. And some features are just not available with or without hacks.

If I want to use a decent OS, I can do most of my development on Fedora or Arch or some other Linux distro at my workplace.

For proprietary stuff that won't work there, honestly, Windows 11 is not that bad as far as Windows go. I do not get ads, I use a local account without problems and I can do development actually decently with PowerShell, vcpkg, VS Code which Microsoft offers for free and which work on all platforms.

TL;DR: There are hills with a much better view to die on.

schroeding 3/29/2025|||
Until they need new hardware, for which there will (and can) be no drivers anymore, as Microsoft stops crosssigning them in the Hardware Dev Center after a while for old Windows versions.

Microsoft does have the leverage in this case, as long as folks want to continue using Windows.

octacat 3/31/2025|||
Would not fly. Developers would not go into the store. Because everyone knows, that 30% tax would be next (basically it is the current situation on the Mac, apple could pull the switch on gatekeeper any time). And, because a lot of modern apps are just electron wrappers, people would just move to the web versions for everything. Which means killing their own platform.
xattt 3/29/2025|||
Isn’t that the point of Pluton?

(1) https://learn.microsoft.com/en-us/windows/security/hardware-...

lozenge 3/29/2025||
And the user-facing feature Smart App Control- https://learn.microsoft.com/en-us/windows/security/applicati...
octacat 3/31/2025|||
Similar why gatekeeper exists on Mac. This would mean that old software would stop to work, though. Which is a bit anti-microsoft politics. Without running all the old unsigned software Win is not Win anymore.
throwaway290 3/29/2025|||
Should be mentioned this is way worse than Apple

Having to use an account to get apps from app store (Apple) vs. having to use an account to install and use the OS in the first place (Microsoft) = not even a a competition

djaychela 3/29/2025|||
Until you need to download something from the app store (happened to me the other day on a mac I wiped and then needed to bring on holiday so now I need to go through the process again afterwards)
freehorse 3/29/2025|||
Can you install anything from the windows store without a Microsoft account, or from google play without a google one? I assume this is already the state of affairs since ever, but except iOS all the rest allow you to install stuff outside their stores.
rkharsan64 3/29/2025|||
You can install things from Windows/Microsoft Store without an account.
tonyedgecombe 3/29/2025|||
I’m sure it has forced me to login. I suppose I could have fallen for some dark pattern in the UI though.

God I hate what this industry has become.

freehorse 3/29/2025||
I am also pretty sure that I thought I had to log in years ago I had windows. Probably also fell victim of the UI.
throwaway290 3/29/2025|||
The point is you are not going to be allowed to even install windows without an account to make use of the great privilege of using a walled garden app store.

And no one on this forum really needs app store when homebrew exists

nosioptar 3/29/2025||||
Yes, you can install shit off the play store without a google account. I use the Aurora Store to do so.

(Aurora store might log in to a google account behind the scenes, but I don't have to have a google account to use it.)

Nab443 3/29/2025|||
Just a matter of time. Look at where their interest are. Apple will probably be second on this, but if it happens it will be for both and the argument of security will be cried out loud at whoever complains.
freehorse 3/29/2025||
It is not all a bad outcome, then anybody who wants to do any serious work on a computer will be forced to use linux.
throwaway290 3/29/2025|||
Irrelevant. You can still use the OS and run any code you want.
djaychela 3/30/2025||
I didn't have time to code a Vpn client before going on holiday...so I needed to get wire guard from the macos store.
throwaway290 3/30/2025||
it doesn't matter if you don't need account to access windows app store if you can't even use the os without an account. your point just doesn't make any sense to me
herbst 3/29/2025|||
You cannot even develop or use anything that needs a compiler without siging up and logging in to apple to install dev tools.

So nah, same.

Aaron2222 3/29/2025|||
The "Command Line Tools for Xcode" don't require an Apple ID to install (and provides a C/C++/Objective-C/Swift toolchain (LLVM/Clang) and things like Make and Git). Not to mention other compilers not provided by Apple that you can just download and install. And yes, while you do need an Apple ID to download Xcode from Apple, you don't need to be signed into macOS with it (you can download it from the Apple Developer site).
throwaway290 3/29/2025|||
Nah. In one case no one prevents you from torrenting third party Xcode at your own risk. You can run any code you want on your device. But in the other case you can't even use the OS. Cope however you want but QED.

It's not perfect, it sucks, but it's better

facile3232 3/29/2025||
> They are envious of the Google and Apple walled gardens/cashcows and are now determined to turn Windows into one.

Which is perplexing, because this is essentially the opposite strategy than what gave windows value to begin with.

tonyedgecombe 3/29/2025|||
It would be amusing for Microsoft to end up in a situation where developers don’t want to target Windows anymore, just like Apple in the 90’s.

Perhaps they think it doesn’t matter once everything is in the cloud.

debugnik 3/29/2025|||
We're most of the way there with the switch to web apps and their native wrappers, even Microsoft isn't using their own UI toolkits anymore.

The only segments left targeting Windows as a platform are games, replacements/extensions to the OS tools, and a bunch of legacy .NET LOB apps. And since the Steam Deck and clones, Wine/Proton are (very) slowly becoming the actual target for games rather than Windows.

extraduder_ire 3/29/2025|||
I think that long before that developers will still be targeting the windows APIs, even if they're not intending their software for windows.
heresie-dabord 3/29/2025|||
> Which is perplexing, because this is essentially the opposite strategy than what gave windows value to begin with.

Consider how much has changed since the first 25 years of MSFT. Both in business and in life in general.

soraminazuki 3/29/2025||
It's such an absurd lie. If Microsoft's idea of security is to force its users to authenticate online for a local account, they should never be allowed in the software industry at all. They're needlessly and dramatically increasing the attack surface of one of the most security critical software running on user devices.
userbinator 3/29/2025||
It's an argument for increased security in the same way that they consider uploading the contents of your hard drive to their servers to scan for "malware" (and other undesirable-to-them content) is. Corporate authoritarianism.
miohtama 3/29/2025|||
The trick is that most of the users need this service. Before Windows Defender was built in you had to buy an anti virus software from sneak oil Windows security industry, and likely get somehow scammed in process.

The same companies sell anti virus for Android today.

Also most users is not all.

badsectoracula 3/29/2025|||
But this made Windows Defender an actually good and useful feature for the users.

Requiring an online account to use Windows isn't really the same thing.

GoblinSlayer 3/29/2025||
Except that on Home edition it detects everything as a virus, so all programs have an explanation that if Defender detects it as a virus, then just ignore it.
badsectoracula 3/31/2025||
I haven't been using Windows as my main OS for a few years now but at least when i used it with Windows 10 it didn't detect "everything as a virus". In fact i can't even remember a single time i had issues with Windows Defender.

Unless you refer to Windows SmartScreen? That is a different thing - really about how popular some program is (though Microsoft did put it under Windows Defender at some point so it can be confusing) - and isn't about the antivirus (which is what i was referring to).

hulitu 3/29/2025|||
> Before Windows Defender was built in you had to buy an anti virus software from sneak oil Windows security industry, and likely get somehow scammed in process.

And now you get the same from Microsoft. Clearly an inprovement.

soraminazuki 3/29/2025|||
I guess Microsoft has to secure their "own" property, the devices the hostile so-called users bought and paid for!
charcircuit 3/29/2025|||
Microsoft's idea of security is moving people away from local accounts protected by passwords and to Microsoft accounts protected Windows Hello.

The Windows Hello PIN is protected by the TPM. This means you can't brute force it like a password could be.

soraminazuki 3/29/2025|||
That has nothing whatsoever to do with the topic, which is forcing online authentication. You can't possibly argue that needlessly forcing online authentication makes user safe.
charcircuit 3/29/2025||
The topic isn't about forcing online authentication. It's about improving security from having users use a Microsoft account. The security improvement of using a Microsoft account comes from Windows Hello.
soraminazuki 3/29/2025|||
It is. You can check by reading the title.

Your's is a reiteration of Microsoft's preferred talking point that has no basis in reality. Tying local authentication to the cloud tremendously increases the attack surface for those who don't need it. TPMs do nothing to change this fact. The only connection between a TPM and a Microsoft account is that Microsoft chose to tie those two together for their own benefit.

beeflet 3/30/2025|||
They couldn't just implement whatever biometric thing that is without making it tied to an account?
GoblinSlayer 3/29/2025|||
To brute force a password, attacker needs full access to the system, guessing the password won't give them more access.
charcircuit 3/29/2025||
No, they don't. They can clone your hard disk and use a different computer. A TPM based pin makes that approach impossible and you must have access to the system itself.
grishka 3/29/2025|||
It's the entire industry's idea of security for the last 10 years or so that the company who made the thing is unquestionably more trustworthy than the users themselves.
CrossVR 3/29/2025|||
And for what? Make number go up? If it's just another data collection scheme the at least I could understand why.
bboygravity 3/29/2025||
Because the NSA pays them to.

Why did they do to Skype what they did (first turn it from p2p to centralized and spyable and then just ignore it and let it die)?

Same reason.

sterlind 3/29/2025|||
(Opinions are my own, I have no inside knowledge.)

I vaguely remember hearing that P2P Skype was the bane of sysadmins' existence. Skype would elect clients on high-bandwidth networks as supernodes. This tended to be business customers - the very organizations MS wanted to attract. Skype's prodigious hole-punching ability made it difficult to throttle, so it got banned from a lot of enterprises. MS essentially hosted the supernodes on Azure, which centralized it.

As for encryption, on the other hand, Wikipedia says MS specifically added the ability to eavesdrop for law enforcement agencies, though apparently Skype had already added a backdoor for the NSA before MS bought them: https://news.softpedia.com/news/Skype-Provided-Backdoor-Acce...

somenameforme 3/29/2025|||
This [1] is one of my favorite leaks from Snowden revelations, and I regularly bring it up anytime people try to downplay what PRISM is. That's a user manual for NSA agents on how to spy on Skype users (including video and text) in real time. It's informative and also amusing at times. For instance in the FAQ one issue a confused spook might run into is why they're being spammed with the same messages repeatedly. It turns out that when a user logs on to a new device, the recent messages Microsoft sends to the user are also directly forwarded to the NSA, which can result (from their perspective) in messages being repeated.

[1] - https://www.aclu.org/sites/default/files/field_document/Guid...

jofla_net 3/29/2025|||
I remember the old supernodes p2p app, was good times.

I used to leave an extra old laptop on with it running, maybe 15 years ago, on a public address.

During the arab spring, tons of traffic could be seen connecting clients in north africa. It truly did route around things.

ashoeafoot 3/29/2025|||
i wonder if some Estonian could justvrerelease the p2p originals . After all as america deteriorates its own influence , at some point the lawyers of the big 4 will be seen as barely disguised tendril of a hostile power in Europe . Who cares about your sales contracts if the president goes for Greenland . We might see a SkyEarthFireWater-Open source re-release one day. Just another tradewar anecdote .
bboygravity 3/29/2025|||
America deteriorates its own influence? wut?

The big 4 will be seen as a hostile power within Europe? The big 4 ARE (mostly) European. What are you talking about?

Sales contracts? What do you mean in what context?

I agree that it would be cool if the original p2p Skype somehow resurfaces, but I can't make any sense of the rest of your post or what it has to do with the subject at hand?

ashoeafoot 3/29/2025||
FANG is definitely not European .
isaacremuant 3/29/2025|||
Join us back in the real world with no Trump derangement syndrome and you'll find out that European governments want an airtight control on companies so they can surveil them and people absolutely.

They want narrative control and squashing rising political opposition.

anothernewdude 3/29/2025||
If windows is security critical for you, I think you've already shat the bed.
soraminazuki 3/29/2025|||
The problem is that many other people and organizations run Windows and it's absolutely security critical for them. And because we don't live in a vacuum, it's security critical for all of us.
consp 3/29/2025|||
Some windows versions have cc certification. Doesn't say much but it ticks the box some people want and call it a day.
brokegrammer 3/29/2025||
A while ago, I needed to get into safe mode to rescue a laptop that wouldn't boot.

Since it uses Windows 11, I originally logged in using my Microsoft Account and a Windows Hello pin.

Safe mode doesn't load wifi drivers and the laptop didn't have an ethernet port, so I couldn't log in to my Microsoft Account to get into Windows safe mode. Didn't have a dongle with ethernet port at that time, so I had to backup the drive and reinstall Windows instead.

That's why I use Linux these days.

Szpadel 3/29/2025||
wait, you need internet connection to even login? this means root cannot use computer when you do not have internet connection for any reason?
vishnugupta 3/29/2025|||
I’m not in Windows ecosystem for more than 25 years now. But I had to buy couple of windows laptops for sales team at my business. I tried very hard but windows wouldn’t allow me to set it up without first creating Microsoft Account online. I’m in Apple ecosystem, not that they are significantly different but they atleast allow me to use the system albeit in limited capacity.

I’m seriously considering going back to Linux for my next work setup.

yonatan8070 3/29/2025|||
There was a trick to bypass the online account requirement. You press Shift+F10, which launches a command prompt, then use `oobe\bypassnro`. This reboots the system and adds a button to set up offline.
asa977 3/29/2025||||
We’ve been running our company (6ish people) solely on Fedora and it’s been a breeze, but then we’re a bunch of nerds, so not necessarily a surprise. The real test how much the Linux desktop has matured happened when I set up a fedora laptop for my parents to get around hp desperately coaxing them into some kind of subscription and an endless stream of ads/complaints from Microsoft to buy into a cloud service. After setting up the laptop and explaining the very basics of Plasma, I’ve had to deal with it again. Because with printers, it just works (tm)
specproc 3/29/2025||
Yeah, for anyone with a modicum of technical capacity, the year of linux on the desktop was about five years ago.
Aaron2222 3/29/2025|||
> I’m in Apple ecosystem, not that they are significantly different but they atleast allow me to use the system albeit in limited capacity.

Define "limited capacity". Other than Apple Services like iCloud, FaceTime, iMessage, Apple Music/TV, etc, it should just be the App Store that's unavailable without an Apple ID (which _is_ crippling on iOS, but not so much on macOS).

daveoc64 3/29/2025||||
>wait, you need internet connection to even login?

No, you can log in without being connected to the internet (that obviously happens a lot on a daily basis, where people are using a laptop with no connectivity until after they sign in).

benhurmarcel 3/29/2025||||
That’s not the case. I have a Windows 11 computer around, set up with a Microsoft account and Windows Hello, and I can log in just fine without internet connection.
brokegrammer 3/29/2025|||
> you need internet connection to even login

That's right. It sounds like a bug but this is Microsoft we're talking about here. They're probably brainstorming for ways to lock you from your own computer.

You can solve this problem by creating an offline account with Admin privileges after setting up Windows with your online account, but most users won't do that.

lolsowrong 3/29/2025||
This doesn’t seem true. Doesn’t LSASS cache credentials for 30 days?
brokegrammer 3/29/2025||
No idea. Maybe it cleared the cache when I asked to enter safe mode. Either way, relying on a cache to get root access doesn't seem right.
GoblinSlayer 3/29/2025||
Reinstalled windows recently, now it has the window resize bug, which apparently has something to do with display sleep mode. Reportedly linux struggles with sleep modes too, but to think I should try linux for better hardware support, duh. And new windows is very fiddly, constantly tries to install new metro apps, adds them to lock screen, installs new services, runs a shit ton of services that constantly write a lot of data on the disk. Enshittification is in full overdrive now.
consp 3/29/2025||
Linux struggles with sleep mode sometimes due to Microsoft and Intel pushing S3 into S2idle and motherboard/bios manufacturers doing the absolute minimum to support either.
microtonal 3/29/2025||
I had the same impression, but support for new sleep modes seems to improve quickly. A few years ago I had a Gen 1 ThinkPad T14 AMD, which still had S3 sleep. A significant portion of the resumes it would come up with some devices not working (e.g. trackpad, fingerprint reader, etc.). I recently got the 5th Gen T14 AMD and the only issue I have is that the fingerprint auth takes a few seconds to come up, but other than that I haven't had any resume issues yet.
mythz 3/29/2025||
All these user hostile behavior finally tipped me over the edge last year after I started to get Windows 10 EOL popups. No way I was going to "upgrade" to a ad/spyware/subscription ridden MS marketing platform and be constantly nagged at to try out more of their services.

Moved to a Fedora Desktop, liberating to move back to an conflict-free OS whose primary focus is to serve its users, imagine that.

jwrallie 3/29/2025||
I've been running the Xfce spin of Fedora for the last year, and it is the most stable OS I have since forever.

For the few programs that really need Windows, I use Qemu/KVM with Virt-Manager and Samba for sharing files.

I wish to keep using this setup, I just hope buying hardware with good Linux support in the future does not become too difficult. I fear moving away from x86 will make things harder.

throwaway48476 3/29/2025||
Judging by the price of Qualcomm laptops x86 isn't going away any time soon.
atemerev 3/29/2025|||
Windows is a launcher for games, there is no other use for this system (correction: it still runs some specialized professional software that is too expensive to port). And now, even most of the games work on Linux too.
Ylpertnodi 3/29/2025|||
I have lots of windows (mainly music) software that I need, let alone outright purchased, and isn't available on Linux.
herbst 3/29/2025|||
I got into music production again recently. To my surprise most recommended new software is either Linux native or properly ported. See reaper for example.

Many years ago music on Linux was hard, and years behind. Software was limited and the audio driver situation was a mess. But now you get professional software directly in the package manager and choose between several very reliable sound systems and even use the far majority of VST Plugins.

atemerev 3/29/2025|||
It is usually available on Macs. Of course, there is still some specialized software for Windows, e.g. many CADs. But all these things are now marginal. If you are a software engineer and use Windows for your work, you are now a minority.
rekoil 3/29/2025|||
I was looking to move to Linux for my gaming PC, just about pulled the plug when Respawn decided that all cheaters in Apex Legends were supposedly using Linux and decided to block Linux users from playing...
EasyMark 3/31/2025||
I've been using Xubuntu for years now,and run Windows 10 in a VM for the few things I need on there that I dont' have a linux replacement for (or cared to hack together). I'm about 99% linux and macos now, and don't miss windows at all.
JoshTriplett 3/29/2025||
According to the linked discussion, the underlying setting that the script set still exists, so this simply makes it less convenient.

It should absolutely be taken as a warning sign, though. Seriously, if at this point you're installing Windows and relying on the existence of that setting, you should be seeking alternatives.

technion 3/29/2025|
I've been saying the writing was on the wall for a long time. Any time someone says how easy it is to simply avoid MS account registration I've argued that it's not going to last much longer.

Even Microsoft's current Storage Spaces Direct won't let you start a locally hosted Hyper-V VM without an Azure connection.

HeatrayEnjoyer 3/29/2025||
What if there's an outage or somewhere you don't have reliable internet?
mhuffman 3/29/2025|||
>Fuck people that live in very rural areas!

-Microsoft, apparently

Springtime 3/29/2025||
Reminds me back at the Xbox One launch where notoriously an employee arrogantly said that always online DRM is fine and defended it when pressed by saying why would anyone want to live in an area with unreliable internet. He left Microsoft after the backlash.
Hojojo 3/29/2025||
Was it Don Mattrick, the head of Xbox at the time who left Microsoft two months after unveiling the Xbox One?

https://www.digitalspy.com/videogames/e3/a489371/microsoft-e...

> Microsoft executive Don Mattrick told GameTrailers in an interview that was filmed just before E3 that he understood why some people are frustrated at their policies.

> "Fortunately, we have a product for people who aren't able to get some form of connectivity," he said. "It's called Xbox 360.

> "If you have zero access to the internet, that is an offline device."

Springtime 3/29/2025||
It was Adam Orth (aka 'Sweet Billy') but clearly others shared similar views.

Sony capitalized on the larger always online controversy with a low budget ad poking fun at the concept[1], which was great marketing.

[1] https://www.youtube.com/watch?v=kWSIFh8ICaA

Teever 3/29/2025||||
Then this isn't the operating system for you.
throwaway48476 3/29/2025||||
Recently Sony PSN was down for days because of a DDoS. Centralizing failure points is always a bad idea.
technion 3/29/2025|||
If you're running Microsoft Storage Spaces Direct/AzHCI and there's no internet for an extended period you can't start on premise servers.
briHass 3/29/2025||
Managing Windows devices at work using the online-first paradigm makes it clear what MS is trying to achieve here, but it's poorly communicated, as usual. In the M365/Entra world, the big benefit is having cloud Active Directory (Entra/AzureAD) and automated deployment (Intune/Autopilot) all integrated. For home users, you get bits and pieces of this, but it feels unnecessarily limited.

What MS wants (from a charitable interpretation), is the ability to encourage/enforce full disk encryption (Bitlocker), TPM-based MFA and TPM-backed passkeys (Windows Hello), as well as tight integration with their product suite (Office/OneDrive) and browser (Edge). Syncing settings, apps and other things between devices (or on setup) is also a win, though it's pretty basic right now.

Though silly to a technical crowd like HN, FDE for regular users requires a way to not lose all their data if they forget their password or some other issue happens with secure boot or the device. Non-technical users aren't going to understand the importance of backing up their Bitlocker recovery key, and without it, they're hosed. During online setup, MS stores this key online to the MS account, so it is recoverable.

MS isn't going to limit the integration and security they can provide by adhering to a local-only OS concept. It's not what most users actually want, and their competition (Apple, Android) does the same thing, so users are used to it. I just wish they had a light (inexpensive) version of the Entra/Intune package for home users that want to be able to manage multiple devices and get the real advantages of the online link.

notepad0x90 3/29/2025||
There are a lot of "workstation" type enterprise deployments where by policy, internet access is forbidden. Microsoft knows this, at least for professional and enterprise editions of Windows, I find it hard to believe an internet connection would be required, like ever.

I would also say the same about require either a live.com or M365/EntraId account for local login on AD joined systems' installations. Unless of course they require you to setup a base-image with an internet connection and then convert accounts to local-only post-install, which sounds like a typical Microsoft approach.

yonatan8070 3/29/2025||
Accorsing to the first comment under the OP the script just runs:

    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f
So presumably the removal of the script won't impact bypass methods used by the likes of Rufus and Ventoy.

Either way, I've been happily on Fedora for a while now, with very minimal "fuck I can't do that here"

defrost 3/29/2025||
Earlier on HN: Windows 11 is closing a loophole that let you skip making a Microsoft account (theverge.com)

139 points | 5 hours ago | 125 comments https://news.ycombinator.com/item?id=43511073

bsdetector 3/29/2025|
In October when Windows 10 support ends it'll finally be the year of desktop linux.
nullify88 3/29/2025||
Well, those that are on the Windows 10 IoT LTSC builds will enjoy updates until 2032.

https://learn.microsoft.com/en-us/lifecycle/products/windows...

zakki 3/29/2025||
Do you know where to buy it?
shepherdjerred 3/29/2025|||
https://massgrave.dev/windows_ltsc_links
mkl 3/29/2025||||
It's hard to find information about it, but this post has quite a bit (some may be out of date): https://www.reddit.com/r/sysadmin/comments/bbof9s/windows_10...
nullify88 3/29/2025||||
As far as I know you need to sail across the high seas.
ugjka 3/29/2025|||
mas
orthoxerox 3/29/2025||
sgrave
throwaway48476 3/29/2025||
dot dev
grishka 3/29/2025|||
I'd like to remind you that there are still millions of people around the world using Windows 7 daily. The fact that some software is no longer supported by its developer doesn't mean it stops working somehow, or becomes radioactive.
MYEUHD 3/29/2025|||
It becomes easier to exploit, as it no longer gets security updates; and vulnerabilities are publicly disclosed.
grishka 3/29/2025||
You can't really exploit something when its attack surface is nearly nonexistent, which is the case for most people who use an outdated OS on their personal device, for example.
baby_souffle 3/29/2025||
What is it about unmaintained software on a personal device that somehow makes the attack service non-existent?
grishka 3/29/2025||
Even if there's an exploitable vulnerability, the exploit has to be delivered to the target system somehow. You don't have much of an opportunity to do that with a device that doesn't have a public IP address. Most likely the user themselves will have to do something that would compromise their system, like visiting a website that would serve them an exploit for their particular combination of browser and OS.
hilbert42 3/29/2025|||
"I'd like to remind you that there are still millions of people around the world using Windows 7 daily"

Correct, and I am one of them!

acuntcalleddan 3/29/2025||
[flagged]
More comments...