Well, this is pretty much by design, but poses a risk anyway.  The remote connect in Live Mesh is not RDP, it is a glorified VNC, which makes sense considering that the feature should work in more than XP Pro, and Vista Enterprise and Ultimate, the only Windows clients with RDP.  It would be far superior if it was actually RDP though (hey MS, here is an idea, if the system has RDP enabled, use that instead).

RDP has a nifty and well thought out feature.  When I remotely connect to a computer the local session goes to the locked screen and remains there.  That way people near the remote machine do not see what the remote user is doing, and if the machine was already locked remotely connecting does not unlock it.  With the VNC like bastardization this is not the situation.  The remote session is simply sending key and mouse interrupts and getting a screen grab, nothing anywhere near as fancy as what RDP does.  The result is that when someone remotely connects, anyone near the local machine now also have access and can see everything the remote user is doing.  The remote connection opens the local machine up to access.

Microsoft may have weighed the risks of this and gone ahead anyway.  Host machines are likely to be at home, where the user doesn’t necessarily worry about people seeing what is happening, either because no one should be there to begin with or because they trust anyone who conceivably should be.  Users interacting with the local instance would be apparent to a remote user, as all screen activity is mirrored.  And the computer is locked once the user logs off.

People who live with roommates may not be comfortable with this, especially college kids who may not particularly trust their roommates.  Plenty of users will be remotely logged in, but not actually active (for example, out to lunch without terminating the connection, though I haven’t tested for a timeout), so they may not detect local activity, and other such scenarios. 

Honestly, I can’t think of a great fix given the current implementation.  The client/server is very simple in design and probably can’t keep the OS locked locally without OS changes.  As a possible workaround, I would suggest that if the machine supported RDP Microsoft should instead use that for the connection, offering both a superior user experience and a more secure one.  Additionally, I would posit that people using XP Pro, or either Vista version, represent a different customer segment than typical non-RDP machines, and potentially are in environments that should have tighter controls (for example, business machines where the user is trying to circumvent remote access policies through an easier means, on a poorly configured network that allows them to do so).  Ideally these machines would have policies or network controls preventing such easy access, but the ideal world and the real one are rarely one in the same.

I have to wonder how discoverable this VNC like session will be via google dorks.  It is over port 80, and there are already dorks to find VNC machines.

~ Joshbw