Microsoft Windows Privacy Precautions

Do you take any special privacy precautions when you have to use Microsoft Windows in a vm or, god forbid, as a main os?

I have a bare metal Windows machine. I keep it completely off the network. Installing software by copying .exe files on USB sticks is awkward but I get by.

I just take care not to login or do anything important. Nor connect it from my desktop. Whenever i have to use a windows machine, it's connection is severely limited to whatever is essential. Which isn't anything fancy, just let the main linux OS control incoming/outgoing connections, and block everything. When you need to use something, unblock that thing.

>>2028 >just let the main linux OS control incoming/outgoing connections, and block everything. When you need to use something, unblock that thing. How do you achieve that? iptables?

>>2030 If he's using it inside a VM, it's just a matter of setting firewall rules for virtual machine's process

>>2034 >it's just a matter of setting firewall rules for virtual machine's process iptables can't filter traffic for individual applications.

>>2035 Lol, i just went to research it a bit and apparently in Linux-based systems you can't restrict specific process from accesing the network without getting through the fuss of using additional tool to launch the desired software everytime, and it's nowhere near as flexible and persistent as native Windows firewall. I wouldn't have thought before, that Linux is so retarded in this particular regard... https://unix.stackexchange.com/questions/68956/block-network-access-of-a-process The only acceptable solutions seems to be third-party programs like https://github.com/themighty1/lpfw This is pretty weird state of things for me, especially considering how much of a secure and networking-oriented OS Linux is striving to be (or at least majority of the userbase is claiming to be)

>>2025 Also to answer OP's original question - yes, on my machine running Windows natively i make sure that there are NO unknown/unwanted network connections, not a single unknown process/service is running in the background, the system is firewalled properly, and I don't use proprietary software for privacy-sensitive tasks like web browsing, password storage and such. If i was really paranoid i could inspect the traffic from outside of the OS' POV, with external hardware filter, but i'm not THAT paranoid, and only monitor it with Wireshark running on the same host. Oh, and don't even think of using Windows 10. As long as you can get reasonably safe environment after tedious configuration and removing components from older versions, this is not the case with 10, which is completely broken in this regard.

>>2038 >without getting through the fuss of using additional tool to launch the desired software everytime That's not what's going on here. The stackoverflow answer is launching the process under a new network namespace which will then be governed by its own iptable rules. >The only acceptable solutions seems to be third-party programs MAC frameworks like SELinux can also restrict individual applications. https://www.linux.com/learn/using-selinux-and-iptables-together >lpfw I wouldn't use that particular tool personally. It's a single 3000 line source file written by a guy who doesn't even know C++ well enough to use new instead of malloc. It looks to me like the way it works is keeping track of pids of running processes (iptables can filter based on pid). It's not clear what happens if a process terminates and another process takes the old pid before the firewall rules are revoked though. iptables can also filter based on userid and groupid so that is another possible approach. Tails, uses this technique to block non-Tor traffic from leaking. But another limitation of iptables is that it only works with ip addresses, not hostnames. So you can't block everything to *.microsoft.com. For that, the only solution I've come up with is using a local proxy server like Privoxy or Squid. >This is pretty weird state of things for me, I'm pretty sure the BSDs (and therefor OSX) are in the same boat as Linux. If Microsoft is doing something different to the rest of the world, I wouldn't jump to the conclusion that it is necessarily a good thing. Path based access controls are inherently weak. What happens when a process forks or relaunches itself under a new name or a user symlinks to another path, will it be restricted by the same rules? Probably not.

>>2040 >I'm pretty sure the BSDs (and therefor OSX) are in the same boat as Linux. If Microsoft is doing something different to the rest of the world, I wouldn't jump to the conclusion that it is necessarily a good thing. I could get a bit mischievous and say that it doesn't also mean you should assume it's bad. Microsoft's doing a fuarrrkton of bad things, but this isn't one of them imo, even if it's not the strongest security measure, its presence doesn't do any harm, since you can still do basic per IP blocking, while having the possibility to even strenghten it a bit with per-process filtering (which on Windows is resolved by full path to the process, instead of PIDs, like you mentioned), even if it's not 100% bulletproof solution (there aren't such ones anyway). >What happens when a process forks or relaunches itself under a new name Well, you can always block ALL outgoing traffic and keep adding exceptions laboriously, so there's much less chance to get exploited the way you mentioned. I didn't test how Windows' firewall is handling symlinking/hardlinking, I suppose it's transparent for it though. A good solution for per-process FW i can think off the top of my head right now is to check executable's checksums to determine whether a rule applies to it or not. >I'm pretty sure the BSDs (and therefor OSX) are in the same boat as Linux. It's a bit unclear whether you can set up outgoing per-process rules on OSX, but the other way around (inboud) is apparently possible, according to this: https://support.apple.com/en-us/HT201642

>>2041 >(which on Windows is resolved by full path to the process, instead of PIDs, like you mentioned), I said I suspect lpfw works that way, not Windows. >its presence doesn't do any harm I'm not sure if that's a correct assumption. It could case problems if an application can rename itself and gain access it wouldn't otherwise get. >Well, you can always block ALL outgoing traffic and keep adding exceptions laboriously, so there's much less chance to get exploited the way you mentioned. I guess I didn't explain it well. >Launch Firefox, pid=2 >Application firewall sets system firewall rule, pid=2 can access everything >Launch junk applications to exhaust free pids >Kill Firefox and quickly launch BadApp pid=2 >BadApp has access to everything until (or if) application firewall notices that pid=2 is not Firefox anymore >I didn't test how Windows' firewall is handling symlinking/hardlinking, I suppose it's transparent for it though. What makes it "transparent"? If the mapping is path => rule and you change the path then the rule changes too. >check executable's checksums to determine whether a rule applies to it or not. That might be a good idea. >OS X includes an application firewall you can use to control connections made to your computer from other computers on your network. Yeah, it looks like it's inbound only to prevent port stealing. Still cool though.

>>2030 I personally use a pfsense box as my router and the firewall on there to block Windows telemetry. I also have an application on my Windows machine that modifies the registry and blocks updates to deter telemetry. There's websites out there that have guides with firewall rules. I simply blacklisted the websites listed on it.

To get close to privacy with windows, I use Blackbird and Ultimate Windows Tweaker. The first is oriented toward privacy and security hardening, and the second is like a gui to tweak numerous settings, that are otherwise scattered across the configuration panels.

>>2678 Actually most of the things BlackBird enables, i can get by manual confuguration, but i realize it's tedious AF. Also what's up with all those "privacy" and "debotnetting" tools for Windows, why most of them isn't even open source (don't tell me about the OS not being open source itself, this is different, it's a thing you'd naturally expect from such tools, given their usage scenario and premises)

>>2689 not same poster but this one is open source if you're looking for one: https://github.com/10se1ucgo/DisableWinTracking