12 ms·
AFAIK setting Windows firewall to deny all outgoing and then manually whitelisting apps you use cuts all(') logging. Microsoft would be crazy to punch backdoor
by rasz_pl 11y ago
AFAIK setting Windows firewall to deny all outgoing and then manually whitelisting apps you use cuts all(') logging. Microsoft would be crazy to punch backdoor holes in its own firewall, it would probably kill enterprise market.
' maybe almost all, you need DNS. I dont know any way of letting applications use DNS selectively, its all or nothing :(. This forces you to let svchost.exe talk outgoing 53 udp.
- woodman 11y agoThat is putting a lot of faith in both Microsoft and the windows firewall, which has historically been very weak. Microsoft has also indicated that they're not adverse to bypassing users' obvious attempts to protect themselves from spying, for example: bypassing hosts file entries for telemetric data exfiltration. So while the firewall might work today, there is absolutely nothing preventing a future update from silently changing the rules of the game.
- maxerickson 11y agoI think if that is your level of concern, you have to not use Windows, not try to patch over their control of the firewall.
- Silhouette 11y agoPresumably Microsoft are worrying by now that corporate customers with knowledgeable IT departments will reach exactly that conclusion.
- maxerickson 11y agoWouldn't those users tend to have a hardware perimeter that they could use to verify the behavior of Windows? Also, I think if Microsoft is actually worried about losing those users, it would choose not to subvert the firewall.
- Silhouette 11y agoI suspect the problem will be if they have independent security tools near their network edge that MITM their own traffic, as discussed elsewhere on HN recently. If Microsoft are hard-coding addresses and certificate details for its online services within Windows itself, the security tools won't be able to inspect that traffic, and will probably be set to block it by default. I suspect the kinds of organisations operating these tools would consider that "working as intended" in most cases, but if it interferes with the enterprise-grade configuration and update management tools then that could be an issue for them.
- maxerickson 11y agoMy point was that they will be able to detect if Microsoft is subverting the Windows Firewall, trivially. So it would be incompetent for Microsoft to subvert the firewall and expect those users not to notice and incredibly foolish for Microsoft to do it if they think those users will object by moving away from Windows.
- ionised 11y agoI've heard that adding certain entries to the hosts file doesn't stop much of the telemetry from happening, so I wouldn't be surprised if the same was true for Windows Firewall. I use a third party firewall with all the known telemetry domanins added to a block list.
- rasz_pl 11y agohosts file is no help when telemetry has hardcoded IPs. Firewall will block that as long as you know those IPs, or switch to drop all and whitelist.