What is your security setup these days?

W.10 Home x64 22H2
Local Account - Standard user - Limited permissions
UAC maximum - Always notify
Cloudflare DNS
Onedrive,Cortana,Advertising ID,Web Search - disabled
Usage of location data for Cortana disabled
Telemetry OFF
Removed some Windows optional features.

Microsoft Defender Firewall hardened with H_C.
Microsoft Defender hardened with Configure Defender (Customized level) - Cloud Block Level

• Ransomware protection - disabled
• No run in a sandbox
• Core Isolation: Memory integrity - disabled
• Some softwares hardened with maximum AE protection
• All Windows Exploit Protection options - enabled

MS Edge --disable-webgl --no-pings --enable-features=IsolateSandboxedIframes

• Home page: https://start.duckduckgo.com/
• Search engine = only DDG
• Enabled Security Mitigations - Strict
• Detection Protection - Strict
• Clipboard permissions - blocked
• Next DNS DOH - HaGeZi Multi PRO++ + OISD big
• Share browsing data with other Windows features - disabled

Policies:

• AutomaticHttpsDefault = 2
• HideFirstRunExperience - true
• DnsOverHttpsMode = secure
• DnsOverHttpsTemplates = Next DNS
• TLSCipherSuiteDenyList = "0x002f","0x0035","0xc013","0x009c","0xc014","0x009d"
• HubsSidebarEnabled - false
• CryptoWalletEnabled - false
• SyncDisabled - true
• AudioSandboxEnabled - true
• NetworkServiceSandboxEnabled - true
• Edge3PSerpTelemetryEnabled - false
• AllowSurfGame - false
• ExtensionManifestV2Availability= 2
• WebWidgetAllowed - false
• ShowRecommendationsEnabled - false
• ManagedSearchEngines = [{"allow_search_engine_discovery":false},{"is_default":true,"name":"DuckDuckGo","keyword":"duckduckgo.com","search_url":"https://duckduckgo.com/?q={searchTerms}","suggest_url":"https://www.duckduckgo.com/qbox?query={searchTerms}","image_search_url":"https://www.duckduckgo.com/images/detail/search?iss=sbiupload"}]

Edge://flags:

Enabled:

• Block scripts loaded via document.write
• TLS 1.3 Early Data
• TLS 1.3 hybridized Kyber support
• Block insecure private network requests.
• Parallel downloading
• Show block option in autoplay settings
• Experimental Tracking Prevention Features
• Enable Kyber768 + NIST-P384 TLS Kyber Confidentiality
• Project Robin experiment
• Enable Digital Signature for PDF
• New PDF Viewer
• Strict-Origin-Isolation
• Back-forward cache - Enabled force caching all page
• Third-party Storage Partitioning
• Origin-keyed Agent Clusters by default
• Origin-keyed Processes by default

Disabled:

• Privacy Sandbox Ads Notice

Extensions:

• uBlock Origin Lite
• SwiftDial
• Stream Recorder - off by default
• Video DownloadHelper - off by default

Firefox

• Home page: https://start.duckduckgo.com/
• Search engine = DDG
• Next DNS DOH - HaGeZi Multi PRO++ + OISD big
• Tracking protection: Strict
• DNS over HTTPS : Max Protection
• HTTPS-only-mode enabled
• Pocket disabled
• Clearing browsing data on exit
• Firefox telemetry disabled
• Protection against fraudulent content and dangerous software enabled - all enabled
• Some FastFox.js settings
• Some Arkenfox.js settings

Policies

• OverridePostUpdatePage set to ""

Extensions

• uBlock Origin - Hard Mode with TLD's
• Video DownloadHelper - off by default
• HLS Downloader - off by default

 

@Sampei Nihira Thanks for report your config
but it becomes heavy and boring
even worse, 5 times in 2 months, that's most of the last 2 pages of the forum..
stop it please LOL
we don't care about full config flags and policies about edge !
Betterfox > Edge

 

Exactly, if he was not reporting his config there would be nothing to read. He is the only reason I watch this thread.

You do not care! For example Chromium browsers ignore DOH and use DNS by default. The devil is hidden in details, vulnerabilities abuse those, and 99% malware infects PC via a browser, so closing every door and window can help.

P.S. You can always put the user on Ignore list, I do it all the time.

 

There are 2 changes in this configuration that you cannot put in the previous configurations because they are not editable.
If you don't care, you don't read.

 

Windows 21H2:

WHHL with both SWH and WDAC enabled

MX Linux 23:

Uncomplicated Firewall with outgoing restrictions to select ports and some IP addresses
Apparmor hardening of browsers, Network Manager, pulse Audio and Libreoffice, plus a few other common services.

 

@TairikuOkami
thanks for advice
done! Sampei Nihira on ignore list and it's now easier to read
He was constantly bragging about every change edge config and spamming his full config every week.
It's completely useless and annoying.
i dont care about security from Edge

BTW "the devil is blocked" by BLACKFOG with ADX + HitmanPro.Alert / OSArmor (choose one of two)..
Cheers

 

Firewall & Anti-Virus:
Router NAT/SPI (Password Protected)
Windows Firewall (Malwarebytes Windows Firewall Control 6.11.0.0)
Malwarebytes Premium 5.1.6.117

Blocking/Hardening:
AppGuard 6.7.129.2
HitmanPro.Alert 3.8.26 Build 983
Quad9 DNS

 

@digmor crusher Is this still your security config? Wanting to keep it simple.

 

You betcha.

 

Hi.
Did you stop BlackFog ?!
br.

 

Nope. Just looking at alternate configs. I have different setups in different Windows instances.

 

Windows 11 Home 23H2
NVMe SSD

Windows Firewall Control (Malwarebytes)
OLD EXE Radar Pro + NVT Driver Radar Pro
On- Demand Shadow Defender
AppLocker & WDAC courtesy AaronLocker- AppLOcker Hardening
Microsoft Defender
OLD Secure Folders

Chrome w/uBlock and AdGuard

https://github.com/microsoft/AaronLocker

 

W.10 Home x64 22H2
Local Account - Standard user - Limited permissions
UAC maximum - Always notify
Cloudflare DNS
Onedrive,Cortana,Advertising ID,Web Search - disabled
Usage of location data for Cortana disabled
Telemetry OFF
Removed some Windows optional features.

Microsoft Defender Firewall hardened with H_C.
Microsoft Defender hardened with Configure Defender (Customized level) - Cloud Block Level

• Ransomware protection - disabled
• No run in a sandbox
• Core Isolation: Memory integrity - disabled
• Some softwares hardened with maximum AE protection
• All Windows Exploit Protection options - enabled

MS Edge --disable-webgl --no-pings --enable-features=IsolateSandboxedIframes

• Home page: https://start.duckduckgo.com/
• Search engine = only DDG
• Enabled Security Mitigations - Strict
• Detection Protection - Strict
• Clipboard permissions - blocked
• Next DNS DOH - HaGeZi Multi PRO++ + OISD big
• Share browsing data with other Windows features - disabled

Policies:

• AutomaticHttpsDefault = 2
• BrowserSignin = 0
• HideFirstRunExperience - true
• DnsOverHttpsMode = secure
• DnsOverHttpsTemplates = Next DNS
• TLSCipherSuiteDenyList = "0x002f","0x0035","0xc013","0x009c","0xc014","0x009d"
• HubsSidebarEnabled - false
• SyncDisabled - true
• AudioSandboxEnabled - true
• NetworkServiceSandboxEnabled - true
• Edge3PSerpTelemetryEnabled - false
• AllowSurfGame - false
• ExtensionManifestV2Availability= 2
• WebWidgetAllowed - false
• ShowRecommendationsEnabled - false
• ShowDownloadsInsecureWarningsEnabled = true
• ManagedSearchEngines = [{"allow_search_engine_discovery":false},{"is_default":true,"name":"DuckDuckGo","keyword":"duckduckgo.com","search_url":"https://duckduckgo.com/?q={searchTerms}","suggest_url":"https://www.duckduckgo.com/qbox?query={searchTerms}","image_search_url":"https://www.duckduckgo.com/images/detail/search?iss=sbiupload"}]

Edge://flags:

Enabled:

• Block scripts loaded via document.write
• TLS 1.3 Early Data
• Block insecure private network requests.
• Parallel downloading
• Show block option in autoplay settings
• Experimental Tracking Prevention Features
• Project Robin experiment
• Enable Digital Signature for PDF
• New PDF Viewer
• Strict-Origin-Isolation
• Back-forward cache - Enabled force caching all page
• Origin-keyed Agent Clusters by default
• Origin-keyed Processes by default

Extensions:

• uBlock Origin Hard Mode with TLD's
• AdGuard AdBlocker Hard Mode with TLD's - off by default
• Stream Recorder - off by default
• Video DownloadHelper - off by default

Firefox

• Home page: https://start.duckduckgo.com/
• Search engine = DDG
• Next DNS DOH - HaGeZi Multi PRO++ + OISD big
• Tracking protection: Strict
• DNS over HTTPS : Max Protection
• HTTPS-only-mode enabled
• Pocket disabled
• Clearing browsing data on exit
• Firefox telemetry disabled
• Protection against fraudulent content and dangerous software enabled - all enabled
• Some FastFox.js settings
• Some Arkenfox.js settings

Policies

• OverridePostUpdatePage set to ""
• DontCheckDefaultBrowser = true
• OverrideFirstRunPage set to ""

Extensions

• uBlock Origin - Hard Mode with TLD's
• Video DownloadHelper - off by default
• HLS Downloader - off by default

 

"Core Isolation: Memory integrity - disabled"

Is it by choice or due to driver(s) compatibility?

 

Compatibility.

 

This policy is obsolete.

 

Policy removed.
Thank you.

 

Avast Premium

 

Linux.

 

I'm currently giving G Data Internet Security a try. I like it so far.

 

I'm still enjoying Windows Security. Built-in. Effectivve. Free. What's not to like?

 

Windows 10 (AtlasOS)

• disabled Windows Defender

OSArmor Personal
Malwarebytes Windows Firewall Control
Google Chrome (DuckDuckGo Privacy Essentials + NoScript)
Keyscrambler Personal
Easeus Todo Backup Free

 

Windows 11 23H2

Macrium Reflect X
Eset Nod32 Antivirus
uBlock Origin

HitmanPro
Norton Power Eraser

 

I removed WFC and I solely rely on NextDNS now as my AV and anti-tracking protection. I use DoT+DoH(browsers), the insecure DNS (UDP via port 53) is blocked via a firewall as well as port 80 via browsers. My signature sums it up.