3 ms·

Shutting off smartscreen is short sighted and wrong. Its no different than the lists Chrome and FF use to block malicious sites. These lists are shared via a sh

Shutting off smartscreen is short sighted and wrong. Its no different than the lists Chrome and FF use to block malicious sites. These lists are shared via a shared security initiative between the major browser makers. Disabling this is a good way to make sure you get cryptolocker. Shutting off cloud-based protection in Defender is equally stupid. Now you're not getting instant and up to date virus definitions from the cloud-based system of honey pots, third party hashes, etc. All you have then is day or days old virus defs that are pretty much useless against modern polymorphic threats. I really hate it when people purposely conflate security and privacy to win political points. None of the above is controversial and if you run any AV or use any browser, you're already doing this and you didn't have a problem with it before. I think its pretty clear that the person who made this list just found all the sliders for 'no' and doesn't realize what he's doing from a security perspective. If you use Windows, you should be using all the security features you possibly can (on top of running behind a router doing IPS/IDS and making sure to use a standard non-admin account - the UAC fails in many places limited standard users don't). Signed, a Windows sysadmin. edit: really downvotes? Telling people to disable security features in an OS shouldnt be applauded, especially on a tech forum. This is "grandpa" level IT advice here.

norea-armozel 11y ago
The problem I have with the current settings in Windows 10 is how they seem to lump together vital security update functionality with Cortana and other datamining features. They shouldn't be part of the same 'module' as it were. But someone at MS HQ thought it was a good idea for some odd reason. I can't see this as anything but a way to sweeten the medicine they feel we need to take. IMO, if they were up front about what each feature does and how to enable/disable it wouldn't get anything close to the pushback it's getting now. It just seems the suits on high think they know better than the rest of us and that's a troubling attitude. What if they think that end-to-end encryption isn't a good thing and that they need to force us "naughty children" to not use it? Well there goes your enterprise customers who have to use said encryption to secure work stations from industrial espionage.
- drzaiusapelord 11y ago
  Well, I'm not an expert on UI stuff, but the author did go right into Defender's settings and choose to disable the cloud definitions. How is that misleading? MS didn't hide that setting. Its in a logical place. Its obvious the author didn't bother to understand what cloud definitions are, just saw the word "cloud," and put on his Mr. Privacy Expert hat and told everyone to turn it off. I do agree that Smartscreen is in a silly place, but because MS now uses it for not only sites but MS Store links, it kinda makes sense to move it out of the browser and into a more general place. Sadly, links like these guides get everywhere on the internet. Lots of people are now going to be at risk at easily avoided malware and phishing attempts because of his laziness and stupidity. In a couple months we'll have articles about "Why is Windows 10 getting so much malware?" Gee maybe because everyone disabled the security features in an angry privacy fit without considering the consequences or thinking through the problem? The same way geeks freaked out when the UAC in Vista was revealed and disabled it, along with the security layer it provides.
jonathonf 11y ago
The issue is that both SmartScreen and Defender 'cloud' protection upload or otherwise inform Microsoft about what you are downloading. For example, it could conceivably track and prevent you from downloading and using Tor. For most Western countries that's not a problem, but is the data sent encrypted? Could an adversary (nation-state) MITM your connection (e.g. GFoC) and immediately be informed about who downloaded Tor, even if they had been using a VPN or other circumvention mechanism? (Windows Defender scans files as soon as you open the directory, not just the first time) Also, I don't think Defender's cloud-based protection has anything to do with updates. These are delivered via WU; I think it's more to do with informing Microsoft about detection or suspicious files so they can be analysed. (Not voted either way) Edit: I really wish people would say why they downvote. Otherwise I have no idea what you disagree with or whether you think what I've written is factually incorrect.
- jonathonf 11y ago
  Here's the exact wording from Windows Defender settings: "Get better, faster protection by sending Microsoft information about potential security problems Windows Defender finds" The 'Privacy Statement' underneath links here: http://windows.microsoft.com/en-us/windows/preview-privacy-statement http://windows.microsoft.com/en-us/windows/preview-privacy-s... (and yes, this was a Windows 8.1 -> 10 upgrade, not a tech preview install). Under 'Data We Collect', the third bullet point: "when you open a file, we may collect information about the file, the application used to open the file, and how long it takes to use it for purposes such as improving performance (e.g. to help retrieve documents more quickly)" Note, I have 'Cloud-based protection' disabled and I'm still getting (near daily) definition updates, so the two definitely are not related.
arca_vorago 11y ago
Let's clarify: disabling smartscreen for privacy reasons is different that keeping it enabled for security reasons. Smartscreen sends urls you visit to Msoft, and since Win8, it sends filenames of downloaded files to Msoft too. As for the security argument, smartscreen only works in IE, so for those of use who don't want any of that turned on, and use FF (instead of chrome), where we download the blacklist instead of sending it outside our network, we can still maintain the same level of security while adding a layer to our privacy. The same for cloud based Defender. There is no reason I shouldn't be able to turn it off if I have an approriate replacement that protects my privacy. Which also means you are wrong when you say "if you run any AV or use any browser, you're already doing this". Nope, not at all, and either you are unaware of what you speak of or you are being disingenuous.
- drzaiusapelord 11y ago
  >The same for cloud based Defender. There is no reason I shouldn't be able to turn it off if I have an approriate replacement that protects my privacy. Your AV is doing exactly what Smartscreen does and so do many security products. Its a common feature, where are the privacy guides for that? Oh right, there's a double standard for MS. Also, the author didn't disable Defender because he is using a different AV. He left it on and just disabled the cloud definitions feature, meaning he's not going to be up-to-date on definitions. Cloud defs are a bit different than what you get via WU. Its a dynamic list of suspicious hashes that's constantly being updated via honeypots and such. The author clearly does not understand what he is recommending.
  - arca_vorago 11y ago
    "Your AV" you don't know what AV I'm using, and you're wrong. I have setup a local update server which regularly downloads updates from the vendor and then updates endpoints on the LAN with no traffic going from LAN->Cloud for that. "so do many security products. Its a common feature" That also is why I don't use those products, and many others would agree. "where are the privacy guides for that?" I don't know, but are you trying to pretend there are none? If you are asking did you even do a couple of searches? I doubt it. "Oh right, there's a double standard for MS." Nope, same standard for all things. I don't like it if you send any of my or my computers info to servers without my knowledge of the content or purpose and I explicitly approve. "Also, the author didn't disable Defender because he is using a different AV. He left it on and just disabled the cloud definitions feature, meaning he's not going to be up-to-date on definitions." Once again... wrong. The cloud feature is for sending info about what is on your computer to MS so they can use it to update the definitions, it does not provide the definitions itself. "Cloud defs are a bit different than what you get via WU. Its a dynamic list of suspicious hashes" if this is true, then I would be wrong on the previous section, but I have seen no documentation that specifies this. Care to provide a source for this info?

norea-armozel 11y ago

The problem I have with the current settings in Windows 10 is how they seem to lump together vital security update functionality with Cortana and other datamining features. They shouldn't be part of the same 'module' as it were. But someone at MS HQ thought it was a good idea for some odd reason. I can't see this as anything but a way to sweeten the medicine they feel we need to take. IMO, if they were up front about what each feature does and how to enable/disable it wouldn't get anything close to the pushback it's getting now. It just seems the suits on high think they know better than the rest of us and that's a troubling attitude. What if they think that end-to-end encryption isn't a good thing and that they need to force us "naughty children" to not use it? Well there goes your enterprise customers who have to use said encryption to secure work stations from industrial espionage.

drzaiusapelord 11y ago
Well, I'm not an expert on UI stuff, but the author did go right into Defender's settings and choose to disable the cloud definitions. How is that misleading? MS didn't hide that setting. Its in a logical place. Its obvious the author didn't bother to understand what cloud definitions are, just saw the word "cloud," and put on his Mr. Privacy Expert hat and told everyone to turn it off. I do agree that Smartscreen is in a silly place, but because MS now uses it for not only sites but MS Store links, it kinda makes sense to move it out of the browser and into a more general place. Sadly, links like these guides get everywhere on the internet. Lots of people are now going to be at risk at easily avoided malware and phishing attempts because of his laziness and stupidity. In a couple months we'll have articles about "Why is Windows 10 getting so much malware?" Gee maybe because everyone disabled the security features in an angry privacy fit without considering the consequences or thinking through the problem? The same way geeks freaked out when the UAC in Vista was revealed and disabled it, along with the security layer it provides.

jonathonf 11y ago

The issue is that both SmartScreen and Defender 'cloud' protection upload or otherwise inform Microsoft about what you are downloading. For example, it could conceivably track and prevent you from downloading and using Tor. For most Western countries that's not a problem, but is the data sent encrypted? Could an adversary (nation-state) MITM your connection (e.g. GFoC) and immediately be informed about who downloaded Tor, even if they had been using a VPN or other circumvention mechanism? (Windows Defender scans files as soon as you open the directory, not just the first time) Also, I don't think Defender's cloud-based protection has anything to do with updates. These are delivered via WU; I think it's more to do with informing Microsoft about detection or suspicious files so they can be analysed. (Not voted either way) Edit: I really wish people would say why they downvote. Otherwise I have no idea what you disagree with or whether you think what I've written is factually incorrect.

jonathonf 11y ago
Here's the exact wording from Windows Defender settings: "Get better, faster protection by sending Microsoft information about potential security problems Windows Defender finds" The 'Privacy Statement' underneath links here: http://windows.microsoft.com/en-us/windows/preview-privacy-statement http://windows.microsoft.com/en-us/windows/preview-privacy-s... (and yes, this was a Windows 8.1 -> 10 upgrade, not a tech preview install). Under 'Data We Collect', the third bullet point: "when you open a file, we may collect information about the file, the application used to open the file, and how long it takes to use it for purposes such as improving performance (e.g. to help retrieve documents more quickly)" Note, I have 'Cloud-based protection' disabled and I'm still getting (near daily) definition updates, so the two definitely are not related.

arca_vorago 11y ago

Let's clarify: disabling smartscreen for privacy reasons is different that keeping it enabled for security reasons. Smartscreen sends urls you visit to Msoft, and since Win8, it sends filenames of downloaded files to Msoft too. As for the security argument, smartscreen only works in IE, so for those of use who don't want any of that turned on, and use FF (instead of chrome), where we download the blacklist instead of sending it outside our network, we can still maintain the same level of security while adding a layer to our privacy. The same for cloud based Defender. There is no reason I shouldn't be able to turn it off if I have an approriate replacement that protects my privacy. Which also means you are wrong when you say "if you run any AV or use any browser, you're already doing this". Nope, not at all, and either you are unaware of what you speak of or you are being disingenuous.

drzaiusapelord 11y ago
>The same for cloud based Defender. There is no reason I shouldn't be able to turn it off if I have an approriate replacement that protects my privacy. Your AV is doing exactly what Smartscreen does and so do many security products. Its a common feature, where are the privacy guides for that? Oh right, there's a double standard for MS. Also, the author didn't disable Defender because he is using a different AV. He left it on and just disabled the cloud definitions feature, meaning he's not going to be up-to-date on definitions. Cloud defs are a bit different than what you get via WU. Its a dynamic list of suspicious hashes that's constantly being updated via honeypots and such. The author clearly does not understand what he is recommending.
- arca_vorago 11y ago
  "Your AV" you don't know what AV I'm using, and you're wrong. I have setup a local update server which regularly downloads updates from the vendor and then updates endpoints on the LAN with no traffic going from LAN->Cloud for that. "so do many security products. Its a common feature" That also is why I don't use those products, and many others would agree. "where are the privacy guides for that?" I don't know, but are you trying to pretend there are none? If you are asking did you even do a couple of searches? I doubt it. "Oh right, there's a double standard for MS." Nope, same standard for all things. I don't like it if you send any of my or my computers info to servers without my knowledge of the content or purpose and I explicitly approve. "Also, the author didn't disable Defender because he is using a different AV. He left it on and just disabled the cloud definitions feature, meaning he's not going to be up-to-date on definitions." Once again... wrong. The cloud feature is for sending info about what is on your computer to MS so they can use it to update the definitions, it does not provide the definitions itself. "Cloud defs are a bit different than what you get via WU. Its a dynamic list of suspicious hashes" if this is true, then I would be wrong on the previous section, but I have seen no documentation that specifies this. Care to provide a source for this info?