Making Windows 10 Secure

Yeah, I know. Windows 10 bad. Unfortunately though it is alot easier to install this spyware than it is to get Proton to work on Steam. I have games I want to play. So if you do find yourself using it how do you break the OS enough to be as secure as possible while using this soykaf heap to play some games? All I got is to disable every possible "feature," making a local account, and using the someone that cares hosts file to block some of the Microsoft tracking domains.

pi-hole maybe? i saw in github some script to disable telemetry in winshit10

Use an older version and run "destroy windows 10" on it. Air gap it. Throw it from a high enough place to totally obliterate the drives and radio hardware. You don't really make Windows 10 secure. Not to any standard that's not a joke. If you just wanna play games, don't put anything else on it and only boot it up to start a game. Maybe unplug the network after you start the game if you're extra paranoid.

https://m.majorgeeks.com/files/details/destroy_windows_10_spying.html Of course if you trust this then you shouldn't be securing a networked machine, but this is one of the things that flattens Win10 telemetry fairly well. Still not really any kind of secure... at all.

>>35145 I already use pi-hole

basically what >>35146 said otherwise have a look at this: https://invidious.tube/watch?v=YTL0i5XzS7k it's a tutorial on how to get what windows ame offers, with a newer version than they use, in the video he says directx12 games aren't gonna work but corrects himself in the comments and he made a follow up video showing they work and comparing them on windows and arch

>>35150 While this won't exactly solve the entire issue. I like that Windows AME at least de-bloats Windows and removes some of the privacy concerns making it less horrid to use.

>>35155 of course it's not perfect, after all it's still windows we're talking about, but from what i've seen it's still the best in terms of removing telemetry and bloat, the only way to solve the entire issue would be by never allowing that pc anywhere near an internet connection

>>35144 >go to settings >go to steam play >enable steam play Wow so difficult

>>35159 Wow really? No fuarrrking way. Obviously I know that. I am not a god damn retard. The problem I have been having is getting the game itself to work with the compatibility tool.

>>35156 Yeah, but unless you are sourcing the programs and documents from an entirely different computer it would be counter productive to do so. But would be good if you were running an older cracked version of Windows entirely for running older games like Unreal Tournament. Which wouldn't be a bad thing to do.

>>35144 You don't even understand the security and your use case... >blacklist malicious "wannacry" or netbios ports and alike on router or pihole >ASN block all of Microsoft and Akamai servers in router >completely disable and cripple RDP which is also used by most targeted backdoors and wannacry-like malware/ransomware Not fixable cons >while using windows, special stealth updates can introduce special backdoors into your usb devices and hard/solid drives (like the Middle East firmware malware), modify UEFI, modify your BIOS, etc. which are retained even after removing the OS >most targeted operating system for mirai forks. every gaming pc is another cryptominer. >intellectual property you create is likely stolen by either a thirdparty It's not even the tracking domains that you should be afraid of. Making OS that introduces malware to certain users (Middle East incident) secure? Not possible.

>>35237 Can't say I really knew that. I guess that's why I made this thread then. No, I guess I didn't understand the security and my use case.

Use your favorite torrenting site to snatch a copy of Windows 10 LTSC (it's the least bloated official flavor of W10), and try turning off all the settings that could be a threat to your privacy (though many skeptics wonder if turning these settings off actually turns them off, but do it just in case), then use ShutUp10 to turn off as much of the spyware as possible.

>>35246 Yeah, but it doesn't rid of all the things that >>35237 said. Right?

>>35248 IP block: OpenWRT: https://github.com/openwrt/packages/blob/master/net/banip/files/README.md OPNsense: https://docs.opnsense.org/manual/how-tos/edrop.html lists: https://filterlists.com/ https://codeberg.org/crimeflare/cloudflare-tor/src/branch/master/not_cloudflare/cidr_data https://iplists.firehol.org/ https://www.ipdeny.com/ipblocks/

Place it behind a firewall isolated from the rest of your network. How is this that hard?

>>35237 >blacklist malicious "wannacry" or netbios ports and alike on router or pihole Do you have a good explanation on Netbios in this use case? And on the router, is it simply just disablng UPnP and only allowing ports you need? I am confused what you mean block malicious wannarlcry or NetBIOS ports. (obviously OpenWRT or Pf/Opnsense and not stock firmware). >ASN block all of Microsoft and Akamai servers in router Is there a good list of servers? Also what is the issue with Akamai? That'll break a soykafload of websites because they're a popuar CDN. I assume by block on router, a simple DNS blocking is sufficient?

>>35287 DNS blocking is insufficient for security, definitely insufficient for windows, even more so with DoH, DoT,.. you don't even really need a domain name to connect. You can fetch company owned CIDR IP-ranges from AS numbers with something like: whois -h whois.radb.net -- '-i origin AS12076' | awk '/^route:/ {print $2}' > /path/to/ASN/microsoft/AS12076.txt These are (all) microsoft owned AS numbers for example: https://codeberg.org/crimeflare/cloudflare-tor/src/branch/master/not_cloudflare/cidr_data/asn_microsoft.txt (AS number to CIDR fetching is included in the openwrt banIP package)

>>35287 >Also what is the issue with Akamai? Akamai... Microsoft... it doesn't matter, it all goes straight to NSA or some other 14 Eyes surveillance agency (doesn't matter, they cooperate and exchange data anyway).

>>35291 >DNS blocking is insufficient for security What exactly are you recommending for blocking method? Ip ranges? Could they not simply work around this just as easily? >>35292 Would make a lot more sense to simply block Akamai with uMatrix or something, it would only break stuff that you don't want or need it running on. Also can you inform me on Netbios issue, and "solution"?

These were made for windows. https://github.com/crazy-max/WindowsSpyBlocker/tree/master/data Also, if you just play online games on it I would mostly just isolate it to a separate LAN2, let it botnet in there. Like >>35260 said.

>>35293 >What exactly are you recommending for blocking method? Ip ranges? Could they not simply work around this just as easily? The only workaround is using different IP's, but you just update your blocklist. Blocking by IP is more secure than blocking DNS because you don't need DNS, you do need IP connectivity. >Would make a lot more sense to simply block Akamai with uMatrix or something, it would only break stuff that you don't want or need it running on. No, it's your wandows that is connecting, not just the browser. >Also can you inform me on Netbios issue, and "solution"? I'm not sure maybe this: https://news.softpedia.com/news/badtunnel-bug-hijacks-network-traffic-affects-all-windows-versions-505294.shtml ?

>>35293 >Would make a lot more sense to simply block Akamai with uMatrix or something, it would only break stuff that you don't want or need it running on. What you do is you block connecting to corps like microsoft or akamai by default, so your wandows isn't sending the porn you watch to NSA, but then if you need to you connect to a proxy like a VPN or tor, then you can load akamai CDN or whatever in the proxied browser.

Whitelist only IP addresses of game servers your pirated games connect to using an external router for physical machine or a VM/host routing tables for virtual machine.