How much of this applies to win10?
Windows 11 x64 security hardening guide
21–30 of 55 posts
Re: Windows 11 x64 security hardening guide
#22> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support), Open/ LibreOffice, Firefox, True/Veracrypt, ... This is such bad advice that I can't take the rest of this guide seriously. Edit: The rest is even worse than I was expecting. E.g.: > execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore > use the only browser on Windows that natively sup…
The whole thing gives off a smell of cargo cult security. E.g. "7-Zip doesn't have anti exploit support". Dug in to the source for that claim - it's a forum post of someone running Windows XP in 2020 (!) with an ancient version of Malwarebytes.
It's still true today; the current version of 7zip doesn't support Control Flow Guard (validated on Win11), and there's lots of security features that come _after_ supporting that.
Re: Windows 11 x64 security hardening guide
#23> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support), Open/ LibreOffice, Firefox, True/Veracrypt, ... This is such bad advice that I can't take the rest of this guide seriously. Edit: The rest is even worse than I was expecting. E.g.: > execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore > use the only browser on Windows that natively sup…
>execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore
that feels like a 200 IQ solution against 0days
"Just use your computer one day after the 0 day"
Re: Windows 11 x64 security hardening guide
#24Earlier quoted context omitted.
The whole thing gives off a smell of cargo cult security. E.g. "7-Zip doesn't have anti exploit support". Dug in to the source for that claim - it's a forum post of someone running Windows XP in 2020 (!) with an ancient version of Malwarebytes.
It's still true today; the current version of 7zip doesn't support Control Flow Guard (validated on Win11), and there's lots of security features that come _after_ supporting that.
I'm not a Windows developer, so this might be a stupid question: is simply a case of just building 7-Zip from source and enabling the Control Flow Guard flag in Visual Studio, or does it require more work?
Re: Windows 11 x64 security hardening guide
#25> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support), Open/ LibreOffice, Firefox, True/Veracrypt, ... This is such bad advice that I can't take the rest of this guide seriously. Edit: The rest is even worse than I was expecting. E.g.: > execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore > use the only browser on Windows that natively sup…
Are we sure this isn't a parody? You know, Poe's Law and all.
Re: Windows 11 x64 security hardening guide
#26Interesting list. Any idea of the 'why' behind this? > No "Tuning" tools (not even stuff like Ccleaner!) Also what is a better alternative to 7zip > avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support)
> Any idea of the 'why' behind this? I'm pretty curious, too > Also what is a better alternative to 7zip is 7zip necessary nowadays? can the built in zip/unzip feature be enough?
Doesn't work on all zip files I receive.
Doesn't support the bz2 and other that are quite frequent in my environment.
I haven't tested it, but my perception is that it's slower when there are a lot of small files.
Re: Windows 11 x64 security hardening guide
#27The best and simplest way to keep Windows 11 safe is to burn the disk it is installed on with gasoline; buying another and installing a Linux distribution such as Debian, OpenSuse and Fedora.
Re: Windows 11 x64 security hardening guide
#28As a long time Linux user, I recently got confronted with the Windows group policy editor. You can use it to disable (blacklist) all the Windows crapware (xbox, etc). Or in the extreme case, whitelist only specific files. I still prefer a text config file over the GUI, but this thing is insanely powerful.
Keep in mind that it's restricted to Pro and up. Are you a home user who wants to disable all the crapware and telemetry Microsoft infected your machine with? You've got to pay Microsoft more money to be allowed to do that!
Re: Windows 11 x64 security hardening guide
#29Interesting list. Any idea of the 'why' behind this? > No "Tuning" tools (not even stuff like Ccleaner!) Also what is a better alternative to 7zip > avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support)
7-zip is infamous at this point for having security holes, and iirc it still is compiled without things like control flow integrity or stack checks. It at least has ASLR now. For zips the windows built in support might be adequate, but I've yet to find a safe 7z unarchiver :(
I haven’t use it, but this fork of 7zip claims to have added some security features including Control Flow Guard and Control-flow Enforcement Technology (CET) Shadow Stack: https://github.com/M2Team/NanaZip
Re: Windows 11 x64 security hardening guide
#30> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support), Open/ LibreOffice, Firefox, True/Veracrypt, ... This is such bad advice that I can't take the rest of this guide seriously. Edit: The rest is even worse than I was expecting. E.g.: > execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore > use the only browser on Windows that natively sup…
[deleted]