Cracking passwords in Windows 7, Child's play


Recommended Posts

Agreed. Every technology has its own weaknesses but why not use BitLocker which is readily available on your machine? I guess if one is not happy with the available encrypting methods, they can always lock their laptop in a bank vault.

Yeah, but Microsoft left a backdoor in bitlocker too. Easy to bypass and unencrypt data, even if the PC is off.

Overall Linux distributions have a less complex design that is easier to understand. It doesn't have anything to do with security. Windows is simply more complex, convoluted and hard to understand.

:blink:

Err wha? Linux is simple and easy? I'm not sure what distro you have been running, but I think you're quite a bit mistaken. Maybe you are thinking about the *nix derived (via BSD) Mac OS X stuff?

I know Linux has gotten a LOT better over the last 10 years and I now have family I've convinced to run it as their primary OS in many cases, but I would't say it is easier than Windows at all. Of course, comparing the two on ease of use in many areas can be like comparing apples and oranges, but I don't think many people find the command line easy. Us geeks maybe, but not the majority of society.

How can they access your data with your computer turned off?

You didn't get the memo? BitLocker forces the HDD to print all of its contents in braille on the bottom. So easy even a blind man can steal the data! (sarcasim)

Err wha? Linux is simple and easy? I'm not sure what distro you have been running, but I think you're quite a bit mistaken. Maybe you are thinking about the *nix derived (via BSD) Mac OS X stuff?

No, I am not saying that Linux is "simple and easy" to use (although that all depends on what you mean by Linux), I am saying that it has a less complex design where it is easier to understand how things work and fit together. Windows is reasonably user friendly on the surface, but once you start digging a little it is arguably the most complex operating system on the market. I would say that it is both the most difficult to understand and the most difficult to develop for. I didn't think this was a controversial statement.

This is just libelous unless you're being sarcastic or can actually provide concrete evidence.

See: http://cryptome.org/ (This link probably won't be around for long). There's a PDF there with information.

I reset peoples password all the time. They bring them too my office and don't tell me what the windows password is. So I just wip out the boot cd and blank it out. Then tell then when i'm done that they have to go in and reset the password.

See: http://cryptome.org/ (This link probably won't be around for long). There's a PDF there with information.

I read that 107 page power point :wacko: and it doesn't seem easy and those "backdoors" don't seem to help unless you can get the pin from someone. From what I understand you need the pin so you can access the drive to get the password, or use a hardware attack on the TPM to get access. And the only person who knows the pin is the person who's computer it is, or it;s on the usb drive for booting

I'll see if I Can find the other FTK article too :)

Or you can just recognize the fact that Microsoft is a serious company and does not leave backdoors in Windows. Unless you have the key, you cannot decrypt BitLocker. This is on page 1 of any forensic guide.

I am not sure if you quite understand the devastating consequences any backdoors would have for Microsoft.

Hmm... I was under the impression that the discussion of circumventing security is against forum rules.

Nope. Posting articles relating to exact methods that can be used to circumvent it is.

Can Linux be hacked if the hacker had physical access?

Possibly. I wouldnt think its any harder than Windows, so long as you have the right tools and knowledge, however, the questions you should ask is actually this:

Can a machine be hacked locally regardless of the OS installed on it?

The answer would usually be yes. Unless the person is clever enough to place a BIOS and HDD password on the machine along with only having the primary HDD as the only boot device, they will likely not be able to hack it, or at least not easily.

Or you can just recognize the fact that Microsoft is a serious company and does not leave backdoors in Windows. Unless you have the key, you cannot decrypt BitLocker. This is on page 1 of any forensic guide.

I am not sure if you quite understand the devastating consequences any backdoors would have for Microsoft.

Ah, but they do, quite often, either intentionally or un-intentionally... It has hasent had any devistating consiquences on them yet and they usually patch it quickly when they are found. The only consiquence it does have, is that the Linux community of hardcore users, will use it to "further prove Linux security is far better" etc etc.

Seriously hdood, try calming down on the rudeness. It wont win you many friends. A simple, i think you are wrong because of x, y and z, would have been enough, rather than saying, "or you can just recognise". It makes you sound awfully self opinionated and stuck up.

Possibly. I wouldnt think its any harder than Windows, so long as you have the right tools and knowledge

More often than not you don't even need any tools. You can simply boot to a root console and change the password, giving you full access. Does this mean that Linux is insecure? No, it just means like you say that all bets are off when someone has physical access to the machine.

Ah, but they do, quite often, either intentionally

Since I don't think you actually believe this, I will come right out and call it a lie.

or un-intentionally...

A backdoor is something that is intentionally added to allow security measures to be bypassed. There is no such thing as an "unintentional" backdoor. That is called a bug or a design flaw/limitation, and is a separate issue. Now, you could argue that they added backdoors concealed as bugs, but I think there is a separate section of the forum dedicated to conspiracy theories.

It has hasent had any devistating consiquences

It hasn't because they do not exist.

Seriously hdood, try calming down on the rudeness. It wont win you many friends. A simple, i think you are wrong because of x, y and z, would have been enough, rather than saying, "or you can just recognise".

It's an extremely serious accusation (in fact, one of the most serious you can make), and when someone makes a claim of this magnitude, the onus is on them to prove it. No one else even have to explain why they "think" it's wrong. You can't sit there and claim that something that is even sold as a security product to foreign governments has backdoors without having the evidence. If you have this, you should be able to produce it virtually from memory. Saying that "you think you read it somewhere" doesn't cut it.

For all you who think encryption cannot be evaded, check this out:

1024-bit RSA encryption cracked by carefully starving CPU of electricity

University of Michigan claims they can break the encryption simply by tweaking a device's power supply. By fluctuating the voltage to the CPU such that it generated a single hardware error per clock cycle, they found that they could cause the computer to flip single bits of the private key at a time, allowing them to slowly piece together the password.

Source: http://www.engadget.com/2010/03/09/1024-bit-rsa-encryption-cracked-by-carefully-starving-cpu-of-ele/

Hmm... I was under the impression that the discussion of circumventing security is against forum rules.

Giving (or linking to) detailed instructions on how to crack a secure system would be against the rules. I gather that the purpose of this thread is to inform people that the Windows account passwords are not a secure system (never were and still aren't) and that they should not rely on it for security. Several people have posted more secure methods of protecting their data. The purpose of this thread would seem to be how to enhance security rather than how to defeat it and thus it is not against the rules.

More often than not you don't even need any tools. You can simply boot to a root console and change the password, giving you full access. Does this mean that Linux is insecure? No, it just means like you say that all bets are off when someone has physical access to the machine.

Quite. Because its simple to boot to a root and change a password, when you dont already have the root password to begin with :rolleyes:

Since I don't think you actually believe this, I will come right out and call it a lie.

I wouldnt have said it if i hadnt been sure. Dont assume anything and dont tell me what i do and dont think\believe.

A backdoor is something that is intentionally added to allow security measures to be bypassed. There is no such thing as an "unintentional" backdoor. That is called a bug or a design flaw/limitation, and is a separate issue. Now, you could argue that they added backdoors concealed as bugs, but I think there is a separate section of the forum dedicated to conspiracy theories.

I was aiming toward both of what you are saying. Both intentional "bugs" and un-intentional...

I reffer to Windows and\or Office 2007 "phoning home". I believe at first there where undocumented methods of gaining access to someones machine by re-routing the call to a remote server, so that the attacker could launch there attack\gain access to the machine.

It hasn't because they do not exist.

See my above quoted post... it clearely does\has.

It's an extremely serious accusation (in fact, one of the most serious you can make), and when someone makes a claim of this magnitude, the onus is on them to prove it. No one else even have to explain why they "think" it's wrong. You can't sit there and claim that something that is even sold as a security product to foreign governments has backdoors without having the evidence. If you have this, you should be able to produce it virtually from memory. Saying that "you think you read it somewhere" doesn't cut it.

Yes yes and blah blah evidence and blah blah you provide it and blah blah.

Seriously mate. You are so original. You even contradict yourself within a couple of words of your stuck up posts. Lets see shall we:

You say in one post - "It hasnt because it doesnt exist" <-- note the lack of proof in this claim. Also notice how you expect people to take your word as god, as though you know EVERYTHING far more than most of the truely technical people on here, such as Budman.

Now, within your very same post you say this - "when someone makes a claim of this magnitude, the onus is on them to prove it" <-- That is a direct contradiction of your sentence only a few lines above.

Now, im not saying that i have supplied proof on everything i have ever said, as no-one ever could. However, if you are going to bang on at people about providing "proof" when ever you are challenged, then make sure you are going to or even do provide proof when you challenge someone... Or is it a case that you are more superior to everyone else and dont need to prove... ANYTHING!? :rofl: :rolleyes:

Quite. Because its simple to boot to a root and change a password, when you dont already have the root password to begin with :rolleyes:

Yes it is.

I reffer to Windows and\or Office 2007 "phoning home". I believe at first there where undocumented methods of gaining access to someones machine by re-routing the call to a remote server, so that the attacker could launch there attack\gain access to the machine.

That would be a remote vulnerability, not a backdoor.

See my above quoted post... it clearely does\has.

It does not. All you appear to be saying is that Windows has had its share of remote vulnerabilities over the years. While true, these are not backdoors. A backdoor is a piece of code intentionally placed there to allow someone to circumvent security. This is extremely serious, so I'd like you to document it so I can forward the information to the proper authorities in my country so that a criminal investigation can be launched. If any local branches of Microsoft are involved, this might even constitute acts of treason. This is not a joke, I really will do this.

Also notice how you expect people to take your word as god

"My word?" You mean my claim that Windows contains no backdoors? I'd so it's a pretty damn well substantiated claim, considering there is absolutely zero evidence of it, despite the fact that Windows has been widely audited, is the biggest target of attacks, and that its source code is available to tens of thousands of people.

as though you know EVERYTHING far more than most of the truely technical people on here, such as Budman.

I have no idea who Budman is or what I claim to know that he doesn't. Maybe I know more than him about something, maybe I don't. I don't see any posts by him so I am not sure what you are referring to.

Now, within your very same post you say this - "when someone makes a claim of this magnitude, the onus is on them to prove it" <-- That is a direct contradiction of your sentence only a few lines above.

Stop trying to twist this around. Please provide your evidence that Windows contains backdoors. I do not have to disprove this, you have to prove it.

However, if you are going to bang on at people about providing "proof" when ever you are challenged, then make sure you are going to or even do provide proof when you challenge someone...

If there is something specific you want me to document, then say so, otherwise you are simply trying to weasel out of having to provide evidence for your accusation. Even if you think I'm an idiot and a hypocrite, you can show that you're better than me by doing this.

Quite. Because its simple to boot to a root and change a password, when you dont already have the root password to begin with :rolleyes:

What are you trying to say here? That you can not boot to a root console if you don't have the root password? This is not true, its called single usermode - and can be booted into quite easy depending on the OS and if they support it or not.

It could be as simple halting your boot loader (lilo,grub,etc) and then entering this command

linux single

Just do a google for recover root password or single user mode, etc. Its quite easy to, as stated quite often without any tools.

Does not matter what OS -- if you have physical access to the machine, you can pretty much throw out any OS level username or passwords. Be it you can boot something like single user mode, or boot some tool to reset the password.. Or for that matter just boot some other OS and mount the file system and gain access to what files you want.

So unless your hardware has limitation to prevent boot from other sources, or your HDD is encrypted, etc.. If you have physical access to the computer you can pretty much throw out security all together.. Even if the machine will not boot - I could just pull the drive and access it.. Passwords set on the HDD can be bypassed.

example of hdd and bios recovery methods/services

http://www.pwcrack.com/harddisk.shtml

http://www.biospasswordrecovery.com/

http://www.notebookpasswords.com/

etc.. etc.. Now are all of these sites legit?? Not sure have never had need to test them.. But it seems unlikely that none of them work.. There was a thread a while back talking about HDD passwords set and that they could not be removed.. I don't recall the companies posted in that thread -- but just google you will find lots of them that can either just reset the password so you can use the disk, or quite often recover it so that you gain access to the data.

In a nutshell - if you they have physical access to the equipment.. And they want access to the data, its possible -- unless you actually encrypted the data with say bitlocker or truecrypt, etc. and they do not have access to the KEY.. Most users that use EFS don't follow best practice and leave the key on the machine -- if so then that too can be accessed and your data recovered, etc. But without the KEY your pretty much screwed!!

I don't even want to get into the backdoor nonsense -- IMHO its tinfoil hat conspiracy nutjob talk.. If there was such backdoors in bitlocker and truecrypt, etc.. Then that would be HUGE news and would be all over the net and on CNN, etc. Can you find discussions about it - sure they are all over.. Just like you can find info about how the moon landing was faked, and how we blew up the towers, etc.. And that JFK was hit by the CIA, etc..

The overall point being if they have physical access to your data, your data is not secure unless its "encrypted" with a secure method. As to the threads topic -- yeah it is child play to access a windows machine if you have physical access.. It sure is nothing new, and there have been password crackers available ever since there has been passwords ;) And there has been ways to circumvent security from the beginning..

my 2cents ;)

Edited by BudMan

Yes it is.

Stopped reading there.

What are you trying to say here? That you can not boot to a root console if you don't have the root password? This is not true, its called single usermode - and can be booted into quite easy depending on the OS and if they support it or not.

It could be as simple halting your boot loader (lilo,grub,etc) and then entering this command

linux single

Just do a google for recover root password or single user mode, etc. Its quite easy to, as stated quite often without any tools.

Does not matter what OS -- if you have physical access to the machine, you can pretty much throw out any OS level username or passwords. Be it you can boot something like single user mode, or boot some tool to reset the password.. Or for that matter just boot some other OS and mount the file system and gain access to what files you want.

So unless your hardware has limitation to prevent boot from other sources, or your HDD is encrypted, etc.. If you have physical access to the computer you can pretty much throw out security all together.. Even if the machine will not boot - I could just pull the drive and access it.. Passwords set on the HDD can be bypassed.

example of hdd and bios recovery methods/services

http://www.pwcrack.com/harddisk.shtml

http://www.biospasswordrecovery.com/

http://www.notebookpasswords.com/

etc.. etc.. Now are all of these sites legit?? Not sure have never had need to test them.. But it seems unlikely that none of them work.. There was a thread a while back talking about HDD passwords set and that they could not be removed.. I don't recall the companies posted in that thread -- but just google you will find lots of them that can either just reset the password so you can use the disk, or quite often recover it so that you gain access to the data.

In a nutshell - if you they have physical access to the equipment.. And they want access to the data, its possible -- unless you actually encrypted the data with say bitlocker or truecrypt, etc. and they do not have access to the KEY.. Most users that use EFS don't follow best practice and leave the key on the machine -- if so then that too can be accessed and your data recovered, etc. But without the KEY your pretty much screwed!!

I don't even want to get into the backdoor nonsense -- IMHO its tinfoil hat conspiracy nutjob talk.. If there was such backdoors in bitlocker and truecrypt, etc.. Then that would be HUGE news and would be all over the net and on CNN, etc. Can you find discussions about it - sure they are all over.. Just like you can find info about how the moon landing was faked, and how we blew up the towers, etc.. And that JFK was hit by the CIA, etc..

The overall point being if they have physical access to your data, your data is not secure unless its "encrypted" with a secure method. As to the threads topic -- yeah it is child play to access a windows machine if you have physical access.. It sure is nothing new, and there have been password crackers available ever since there has been passwords ;) And there has been ways to circumvent security from the beginning..

my 2cents ;)

A few, "if this" and so long as this happens etc, but once again, a good, point proven post Budman, unlike some members on Neowin :) (Y)

For all you who think encryption cannot be evaded, check this out:

1024-bit RSA encryption cracked by carefully starving CPU of electricity

University of Michigan claims they can break the encryption simply by tweaking a device's power supply. By fluctuating the voltage to the CPU such that it generated a single hardware error per clock cycle, they found that they could cause the computer to flip single bits of the private key at a time, allowing them to slowly piece together the password.

Source: http://www.engadget.com/2010/03/09/1024-bit-rsa-encryption-cracked-by-carefully-starving-cpu-of-ele/

The encrypted drive needs to be logged in and active when this "hack" is applied though

Sure there are always a lot of if this or that scenarios when evaluating risks to your data. You need to evaluate the level of the risks, and the costs your willing to pay to mitigate those risk.. Cost being in actual hard $ or in software cost in extra steps required to access data, secure it when done with it, etc.. Be it having to plug in a usb dongle with a key on it, or put in an extra password to unlock a truecrypt volume, etc. etc.. There is always going to be costs involved with security.. Be it in performance of the machine when using an encrypted drive, or extra steps a user has to take to access the data, etc.. And don't forget the added risk your taking when you encrypt of actually locking yourself out of your own data.. There are lots of threads here of users not understanding EFS, not adhering to best practice on securing/backup up the keys - next thing you know they locked themselves out of their own data ;) When in most of these cases the user had no legit reasons to be using EFS in the first place.

You need to understand who/what your protecting your data from before you implement a security option. In many cases a good windows password and setting ntfs permissions correctly will be more than enough to secure your data from other users at your home or business, etc. Sure bypassing windows security is childs play to those that understand it and have local access - but to most users it might as well be 256bit AES encrypted data -- since they don't have a clue on how to bypass it ;)

Stopped reading there.

Why?

A few, "if this" and so long as this happens etc, but once again, a good, point proven post Budman, unlike some members on Neowin :) (Y)

That posts says I'm right and also implies that the people who believe there are backdoors are crazy and wrong. It's the complete opposite of what you're saying, so why would you thumbs up it? Am I to understand that you're retracting your false accusations?

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Why you need to take back control of your synced passwords and how to go about doing that by Paul Hill Credit: Pixabay Last month, when Google decided to introduce daily and weekly caps for Gemini, it reignited an anxiety of mine, that you can’t really depend on service providers to maintain features forever, and it got me looking into free software (as in freedom) in other areas too. One app I quickly came across was KeePassXC on desktop and KeePassDX on Android as an alternative to password manager lock-in within the Chrome or Firefox ecosystems. I personally like to switch around with browsers, and using either password manager is inconvenient, so something like KeePassXC was interesting to me. The main issue with it now is syncing; I was not sure how to do that. After a bit of research, I came across Syncthing, a tool I was vaguely familiar with but had never used because it seemed complicated. However, I was completely wrong, and honestly, I think everyone should use it if they use multiple devices. It essentially lets you share folders peer to peer across all of your devices, no cloud services that you don’t control necessary! And it was fairly simple to set up, if not a bit clunky. Since setting it up, I’ve also started using Syncthing to back up other apps too, so don’t think it’s limited to just saving password databases. You can use it for pretty much anything you use Dropbox or Google Drive for. Before continuing to talk about those apps a bit more, let’s walk back a bit and talk about browser sync. Ever since the late 2000s and early 2010s, really, since we have been using smartphones, browser sync has been a necessity of life. I don’t know about you, but I have hundreds of passwords saved. For the most part, they’re all unique, so I don’t remember them and rely on software to manage them for me. Until recently, I’ve relied on password managers in Chrome and Firefox, but what I always found annoying was that it can be hard to transfer them between browsers. Sure, on Windows it is simple enough, but on Linux, exporting bookmarks has been temperamental. It works OK nowadays, but not too long ago, Chrome required you to enable exporting passwords in chrome://flags. The situation is even worse on mobile; there is no exporting or importing of passwords of any kind. You literally have to do it on a desktop, which is incredibly annoying in our mobile-first world. Sync also lets us take out bookmarks, history, tabs, and autofill data easily. To enable sync, it’s just a matter of signing into the browser once, and it handles the rest. It’s nice and easy. Obviously, all this has some issues, including those I’ve outlined above about it being hard to transfer data between browsers, but also things such as account suspension, lost account passwords, and other lock-in mechanisms, such as passkeys, being tied to a specific browser. On a sidenote, I have just removed all of my passkeys because they can make it harder to move browsers. I think the biggest threat to your synced passwords, especially if doing this with Google, is having your account suspended. I don’t ever expect mine to be suspended, but you do hear horror stories on Reddit where people lose access to their Google accounts. Imagine if you have hundreds of passwords, then suddenly lose access to them because Google froze your account, what would you do? So yes, it can be nice to use these syncing services for their convenience, but they also have risks. You may have seen me going on about free software quite a bit in my editorials. It’s essentially a concept championed by the Free Software Foundation. It’s software under particular licenses that grant you four freedoms: run the program for any purpose (0), study and change the source code (1), redistribute copies to others (2), and the freedom to distribute modified copies to others (3). For example, if there is an app I use and one day it gets abandoned by the developer, I can keep running it or even clone the software and continue developing it. Look at the myriad of cool services Google has run over the years before killing them. You can’t take the source code for those because they are proprietary, for the most part. Both KeePassXC and Syncthing are free software, so I get the freedoms listed above. In my use case where I’m syncing a database full of my passwords, I also get proper ownership over my data, there is no losing access to the database due to a frozen account, I can access the code of the tools I’m using, and I can get support from real people online if I run into issues, rather than having to consult a vague help page from an opaque company. With the KeePassXC password manager, you create a .kdbx file, which is what will be synced between devices. KeePassXC has cross-platform apps and also has browser extensions so that the browser can fetch passwords from the database once it is unlocked. Meanwhile, Syncthing is a peer-to-peer file sync tool where you can select folders to sync between your devices. Just pop files in the folders you choose, and then they will be available across your other devices whenever they come online. Syncthing is resilient as it works over both LAN and the internet and only ever sends content between your devices, never to a third-party server somewhere else. By combining these two pieces of software, you can essentially replicate the browser sync functionality. I have had a weird, conflicting issue where a new file is appearing, but it doesn’t seem to be impacting my main password database, which is updating between devices just fine. If you want to get a setup similar to what I have, you will need to go here to download KeePassXC for your computer. Once you have that, you will need to download your passwords from your web browser to a CSV file. In Chrome, you can type chrome://password-manager/settings into the URL bar, and you should see an option to download your passwords under Export Passwords. This will give you the CSV file you need for importing into KeePassXC. If you use a different browser, just use a search engine and type “browser-name export passwords” and muddle along. In KeePassXC, you’ll want to press Import File from the home screen, select the CSV file, and create a new database from it. On one of the screens of the wizard, there will be a Title field with a drop-down selected to none. Change this to Title and continue. You’ll select a name for the database, the encryption level (the defaults are fine), and then you will pick a password. I would choose four unrelated words that are easy for you to remember, as you’ll be typing them fairly often to access your passwords. When you have all your passwords in your new database, you will want to set up the browser extension so that your browser can fetch passwords from KeePassXC. Rather than explain how to do that here, refer to KeePassXC’s guide on how to set it up properly. Once you’ve got that set up, you want to install KeePassDX on Android. You can grab it on the F-Droid store and the Google Play Store. For iPhone users, there are other .kdbx-supporting apps, but I haven’t tried any of them, so have a look around and use what suits you. Once you have that done, you will want to install Syncthing on your computer and find a third-party app for your mobile device. On Android, I use an app called BasicSync; there are also options for iOS, but again, I’ve not tried these. Once you’ve got SyncThing, you’ll want to set it up and connect all of your devices together and share a folder between your gadgets. PCWorld has a good tutorial on setting up a synchronized file between your devices using SyncThing. Once you’ve set it up, congrats, you’ll never have to touch that stuff again except for adding or removing devices. I’ll be honest, I didn’t particularly like setting up Syncthing. It didn’t take me a massive amount of time, but I think I had to check online because I found it a bit confusing. That said, I’ve had it running for several weeks now and never need to touch the Syncthing settings, so that’s very nice. I also mentioned a conflicting file. I’m not sure why this is appearing, but the main .kdbx file seems to be updating and syncing just fine. What’s nice is that both KeePassXC and Syncthing are free software, so they won’t just vanish one day; you can take the code and fork the project or use a range of alternative implementations that others have made. It’s also nice that it works over LAN, so even if your ISP is having problems, your passwords will still sync. One area where you will want to be a bit more careful with this setup is if you only have one device. I am OK because I have a computer and two phones, all synced up. If you just have one device, you will probably want to store a backup of your .kdbx file somewhere else. Obviously, you’ll also want to remember your password really well, too. If you get locked out, it's game over. Overall, if you want to take back control of your computing from big tech, taking control of your passwords is an important part of this. You don’t need to immediately clear out your browser’s password manager; try running KeePassXC and the password manager concurrently for a while to see if you run into any problems. If you do try this out, let us know some other creative ways to use Syncthing. I haven’t really come up with a solution about what to do with my bookmarks, for example.
    • If the price was a dollar, someone would complain "Why isn't it free?" If it was free, someone would complain they weren't being paid to play it.
    • That lens of history will burn if you hold it at the right angle... Warn users too late: Shame, Microsoft! That extremely minor update to an obscure Control Panel widget required 2 years of warning. Warn users too early: Shame, Microsoft! We've got better things to do. Pipeline and process be damned, we'll just always be disappointed, eh?
    • Microsoft Paint used to be my favorite Windows app as a kid, and it's still pretty good by Usama Jawad I have been using Windows since the early 2000s, when I was around 10 years old or so. I vaguely remember playing around with Windows 98 and Windows 2000, but that may have been on school PCs which had old operating systems installed. My main OS on the home PC, and the one I recall spending most time with, was Windows XP. At that time, I used the home PC to create Word and PowerPoint documents for school, but a lot of the time, I simply used it to play games. My dad would bring game discs which we would try and install on the PC, sometimes unsuccessfully, and sometimes, we would rely on flash games in the browser, like Bubble Trouble on Miniclip. However, the problem with the latter approach was the internet speed. On a good day, our dial-up internet would offer us speeds of 56 kbps, but on most days, it was closer to 33 kbps. This did not facilitate online gaming as I would often have to wait minutes for a game to load or "draw" on the screen, and trying to download pirated games wasn't simple either. I remember getting tired of waiting for online games to load and just downloading simulator games from the Big Fish Games website instead, only to be disappointed after finding out that I was just being given access to trial versions of the title, and I needed to fork out money to pay for the full version. All of this is to say that it wasn't very easy to find entertainment options on the home PC when I was a kid, due to a number of reasons, mostly outside of my control. This situation pushed me towards a rather unconventional ally: Microsoft Paint. Whenever the internet wasn't working as good as I expected, I would simply spin up Paint and draw complete rubbish on the canvas. Of course, that wasn't always the intention, but it usually happened when I messed up drawing a straight line or something, and then I would give up on that particular piece and simply draw a random collection of objects. Microsoft Paint was extremely accessible and easy to use. Even if you weren't an artist, you could quickly understand the tools at your disposal and how to leverage them on a canvas. The absolute breadth on offer ensured that each painting was truly unique, as you could utilize various combinations of tools like the pencil, paint, spray paint, and more to truly personalize your creation. Since I wasn't particularly good at drawing both on digital screen or a physical screen, I remember that my main style of art would be to insert a bunch of randomly intersecting lines and then fill them with random colors through the paint can. I have trying to replicate that art style in the latest version of Paint below, and as you can see, it's truly Pablo Picasso-esque. The human imagination truly knows no bounds Microsoft Paint kept me occupied for hours and was my best friend when video games on the home PC were inaccessible for one reason or the other. There was no academic or professional reason for which I would need to use Paint, but I still loved using it in my personal time, even if what I created wasn't worth being shown to anyone. It was simply fun. Fast-forward to today, and the situation is mostly the same. Now that I am almost 29 years old, and I still have no reason to use Microsoft Paint in a professional capacity. In fact, I don't even use it in a personal capacity, except to dabble with it from time to time, just to see if core functionalities are still intact. And I'm happy to say that I think Microsoft Paint still offers the same accessibility and inviting experience that it did to me a couple of decades ago, even though its UX has been refreshed and it's been integrated with Copilot features. Interestingly, things could have been a lot different, had Microsoft had its way. Microsoft Paint was marked for deprecation with the Windows 10 Fall Creators Update in 2017, and even began displaying a product retirement alert, urging customers to shift to Paint 3D instead. Fortunately, after consumer backlash, Microsoft reversed course on this decision, and Paint continues to be a native app inside Windows installations that can also be updated quite frequently through the Microsoft Store. Instead, Paint 3D ended up on the chopping block, which is for the better, I think. I have intermittently played around with Microsoft's refreshed Paint experience in the past few years, and I do think it has received worthwhile upgrades. the UI and the UX has been modernized while retaining core functionality, and the app is still fairly easy to use. It doesn't meet any of my use-cases, but I've never really had any use-cases ever, as described previously. Of course, the elephant in the room is the Copilot integration. Personally, I believe that this is one place where Copilot does make sense, environmental concerns aside. I know that a lot of creatives use AI to generate images, and while some may be using professional alternatives, Paint still offers a decent casual experience, with the power of Copilot. Of course, you do need to have a valid Microsoft 365 Copilot license and available credits to use it, but even if you don't, you still get the big Copilot button in the toolbar, unfortunately. All in all, I am glad that Microsoft Paint continues to be a native feature in Windows 11, and a piece of software that has evolved to meet modern needs without cutting off its own roots. It's just an iconic piece of Windows history that was an essential part of my childhood, and while I don't use it anymore, I'm just glad it is still there.
    • 2TB WD_Black SN7100 PCIe Gen4 NVMe SSD drops to its lowest price in over three months by Fiza Ali Amazon is currently offering the 2TB WD_Black SN7100 internal solid-state drive at its lowest price in over three months, so you may want to check it out, if you have been considering a storage upgrade, before the deal dries up (purchase link is toward the end of the article). Featuring a PCIe Gen 4.0 interface and M.2 2280 form factor, the SN7100 promises to deliver sequential read speeds of up to 7,250MB/s and sequential write speeds reaching 6,900MB/s, offering as much as a 35% improvement in performance compared with the previous generation. It also achieves random read speeds of 1,000,000 IOPS and random write speeds of 1,400,000 IOPS. The drive uses Western Digital’s TLC 3D NAND technology for reliable performance and is further supported by a five-year limited warranty. It also offers strong endurance, rated at up to 1,200TBW, making it suitable for demanding workloads such as gaming, content creation, and high-speed recording. Moreover, its DRAM-less architecture claims to improve power efficiency (the SSD relies on system memory for caching via HMB), while the WD_Black Dashboard software enables users to monitor drive health, install firmware updates, and activate Game Mode for potentially better performance. Finally, it operates within an operating temperature range of 0°C to 85°C, and can withstand storage temperatures from -40°C to 85°C. 2TB WD_Black SN7100 PCIe Gen4 NVMe SSD: $242.96 (Amazon US) Check this deal out if you want a 4TB option. Good to know This Amazon deal is U.S. specific, and not available in other regions unless specified. We only use first-party seller links (at the time of article publishing); ensure that you purchase from a first-party seller link only. Check out Today's Deals on Amazon | or our recent tech deals. Become a Prime member (for Students or SNAP) via Neowin Get Prime Access - Prime for half price (for qualifying Medicaid, EBT, SNAP) Subscribe to Prime Video, Audible Plus, Music Unlimited or Kindle Unlimited via Neowin As an Amazon Associate, we earn from qualifying purchases.
  • Recent Achievements

    • Week One Done
      Supreme Spray LV earned a badge
      Week One Done
    • One Month Later
      Genuinetonerink- Dubai earned a badge
      One Month Later
    • Week One Done
      Genuinetonerink- Dubai earned a badge
      Week One Done
    • One Year In
      hhgygy earned a badge
      One Year In
    • Week One Done
      AMV earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      514
    2. 2
      +Edouard
      163
    3. 3
      PsYcHoKiLLa
      87
    4. 4
      Steven P.
      74
    5. 5
      Michael Scrip
      73
  • Tell a friend

    Love Neowin? Tell a friend!