Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 11 x64 security hardening guide

github.com

Post reply on HN
Print view View original

31–40 of 55 posts

Re: Windows 11 x64 security hardening guide

#31

Post by josefx »

judge2020 wrote: post #18
fzfaa wrote: post #15

Earlier quoted context omitted.

I didn't know anybody saw MOTW as a positive. I hate it and I don't see what problem it solves.

Really? When it’s not you but a tech illiterate computer ‘newbie’, you don’t see any benefit to a popup warning them that “programs downloaded from the internet could be dangerous”?

Didn't we go through this with Vista? The average tech illiterate user only ends up trained to ignore and continue. You might as well drop a few hundred knives labeled "warning sharp" in the middle of a playground.

Re: Windows 11 x64 security hardening guide

#32

Post by invokestatic »

AshamedCaptain wrote: post #10
politelemon wrote: post #3

Interesting list. Any idea of the 'why' behind this? > No "Tuning" tools (not even stuff like Ccleaner!) Also what is a better alternative to 7zip > avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support)

The entire list can be summarized into "Just use the latest versions of Microsoft everything, and uninstall all 3rd party software" (how convenient, I bet they also recommend using OneDrive). They even explicitly recommend against any 3rd party security software. Yet however 7-zip gets the boot because it apparently is not compatible with a 3rd party "Anti-Exploit" software (Malwarebytes) ?

It’s actually not bad advice, and it feels crazy to say this considering the security of Windows was atrocious 15 years ago.

At least the bundled zip extractor receives auto-updates via Windows Update. If a zero day RCE drops in 7-zip, how many users will actually be patched 6 months later? 1 year later? I would imagine it would still be a viable exploit because not many people keep their third party software up to date.

Edge really does have security and isolation features that far exceed any other browser (WDAG), Windows Defender is surprisingly adequate and third-party AV software expose a substantial attack surface.

Re: Windows 11 x64 security hardening guide

#33

Post by jpeter »

josephcsible wrote: post #16

> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support), Open/ LibreOffice, Firefox, True/Veracrypt, ... This is such bad advice that I can't take the rest of this guide seriously. Edit: The rest is even worse than I was expecting. E.g.: > execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore > use the only browser on Windows that natively sup…

0-day solution for 0-IQ people

Re: Windows 11 x64 security hardening guide

#34

Post by MattPalmer1086 »

tester756 wrote: post #23
josephcsible wrote: post #16

> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support), Open/ LibreOffice, Firefox, True/Veracrypt, ... This is such bad advice that I can't take the rest of this guide seriously. Edit: The rest is even worse than I was expecting. E.g.: > execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore > use the only browser on Windows that natively sup…

>execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore that feels like a 200 IQ solution against 0days "Just use your computer one day after the 0 day"

That one made me laugh... I couldn't take anything it said seriously after that.

Re: Windows 11 x64 security hardening guide

#35

Post by _Algernon_ »

josephcsible wrote: post #16

> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support), Open/ LibreOffice, Firefox, True/Veracrypt, ... This is such bad advice that I can't take the rest of this guide seriously. Edit: The rest is even worse than I was expecting. E.g.: > execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore > use the only browser on Windows that natively sup…

>> execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore

I mean this has to be a joke, right?

Re: Windows 11 x64 security hardening guide

#36

Post by encryptluks2 »

josephcsible wrote: post #28
rubenbe wrote: post #11

As a long time Linux user, I recently got confronted with the Windows group policy editor. You can use it to disable (blacklist) all the Windows crapware (xbox, etc). Or in the extreme case, whitelist only specific files. I still prefer a text config file over the GUI, but this thing is insanely powerful.

Keep in mind that it's restricted to Pro and up. Are you a home user who wants to disable all the crapware and telemetry Microsoft infected your machine with? You've got to pay Microsoft more money to be allowed to do that!

A quick Google search will show how easy it is to enable the Local Group Policy Editor on Windows Home.

Re: Windows 11 x64 security hardening guide

#37

Post by josephcsible »

judge2020 wrote: post #18
fzfaa wrote: post #15

Earlier quoted context omitted.

I didn't know anybody saw MOTW as a positive. I hate it and I don't see what problem it solves.

Really? When it’s not you but a tech illiterate computer ‘newbie’, you don’t see any benefit to a popup warning them that “programs downloaded from the internet could be dangerous”?

It's reasonable to have guessed that there'd be a benefit before it was implemented, but now that we actually have such a popup, it's clear that there's not, because the newbies all ignore its warning and run the malware anyway.

Re: Windows 11 x64 security hardening guide

#38

Post by glowingly »

tester756 wrote: post #23
josephcsible wrote: post #16

> avoid insecure software like 7-Zip (which e.g. lacks Anti-Exploit and MOTW support), Open/ LibreOffice, Firefox, True/Veracrypt, ... This is such bad advice that I can't take the rest of this guide seriously. Edit: The rest is even worse than I was expecting. E.g.: > execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore > use the only browser on Windows that natively sup…

>execute/ open new files with one-day-delay because after one day, the malware is not 0-day anymore that feels like a 200 IQ solution against 0days "Just use your computer one day after the 0 day"

This is similar to how I used to clean computers that data was needed from.

I would isolate it for a few days (no power on, disconnected from any network, etc). Then use a burned DVD or USB with MSFT's Offline Defender. The extra few days really seemed to help the definitions catch up with whatever had infected the system in the first place.

I do not believe Offline Defender can do this anymore, so this exact approach is probably no longer doable. I also do not do family IT anymore, so I have not had to do this since Win7's heyday.

Re: Windows 11 x64 security hardening guide

#39

Post by dwattttt »

scrlk wrote: post #24
dwattttt wrote: post #22

Earlier quoted context omitted.

It's still true today; the current version of 7zip doesn't support Control Flow Guard (validated on Win11), and there's lots of security features that come _after_ supporting that.

I'm not a Windows developer, so this might be a stupid question: is simply a case of just building 7-Zip from source and enabling the Control Flow Guard flag in Visual Studio, or does it require more work?

It shouldn't take much more than that, unless you're not using Visual Studio in the first place.

Re: Windows 11 x64 security hardening guide

#40

Post by glowingly »

kevingadd wrote: post #13
pid-1 wrote: post #6

> create another Admin account and transform your current one to limited/ restricted/ standard user account to reduce the attack surface enormously. Don't use Admin account for your tasks! It's crazy how Windows doesn't have a sane way for users to became administrators temporarily. LAPS is a weird hack and Azure PIM doesn't work for local admin.

There's a 'run as' mechanism built in and accessible via GUI inside of Task Manager (File -> Run New Task) and the command prompt ('runas'). You can also open an Administrator Command Prompt.

At work, we have an applied policy that shows an elevated prompt for most things that need admin permissions. It's apparently one of those hidden UAC settings that either needs GPO or regedit to enable. So it's there, just not really exposed to end users.
Post reply on HN