8 ms·

Open-source tool to enforce privacy/security best-practices on Windows, macOS

168 points by e12e 4y ago

kornhole 4y ago
I love it, but my work issued PC won't let me run any of the .bat files generated or install other FOSS apps such as freetubeapp.io. I wish I knew a way around Windows Defender Smartscreen managed by my company.
- blitzar 4y ago
  privacy/security best-practices is to block the running of .bat files
- hobs 4y ago
  One of the quickest ways to get fired is to try and circumvent your work computer stuff, better to find another job where they dont lock you down so hard.
  - kornhole 4y ago
    That depends on what you are doing and your position. IT must expect senior hackers will try to find ways to improve their setup. I wish more companies would recognize that it is not wise to have their workers surveilled by external companies and instead setup these machines with tight privacy by default.
  - kaiviti 4y ago
    Better to give you less privileges than too many. And if you really need the freedom to things that you can’t. You could always use VMs, if needed.
    - hobs 4y ago
      If you can install and use virtual machines you can use hypervisor escapes - any company that lets you do that probably isn't in the list of super locked down envs (or if it is its probably for a great reason.)
- richardwhiuk 4y ago
  Use a non-work PC for non-work stuff?
  - kornhole 4y ago
    I do use a Linux PC for all personal stuff. I still want to make my work life a bit more private since MS seems to have made a business of knowing everything they can about workers.
- Karawebnetwork 4y ago
  Creating the .bat file yourself and pasting the generated code manually should allow you to run the file as admin.
- hddqsb 4y ago
  I'm curious, does the company-issue PC also prevent you from opening CMD and PowerShell? (If not, you can probably paste the commands directly there; or create a .bat file yourself as suggested in a sibling comment. But as another comment points out, trying to circumvent company restrictions is risky. Ideally you'd just have to ask IT to do it for you, until they get tired of fulfilling your requests and give you access to your machine.)
user3939382 4y ago
Depending on your field this could be a "yeah duh" comment for you, but there is a whole set of related tools and standards for this that's common when you're doing compliance-related cybersecurity, especially on server OSes. There's SCAP https://en.wikipedia.org/wiki/Security_Content_Automation_Protocol https://en.wikipedia.org/wiki/Security_Content_Automation_Pr... then a popular set of tools that implements it, for example: https://www.open-scap.org/tools/ https://www.open-scap.org/tools/ However the rulesets "profiles" are flexible, one popular one is CIS.
ddevault 4y ago
Using Windows or macOS in the first place already runs afoul of best practices for privacy and security.
- game-of-throws 4y ago
  The 90s called, they want their OS fanboy flamebait back
- mustache_kimono 4y ago
  Yeesh. MacOS is years ahead of Linux re: several important security features -- disk encryption, SecureBoot, TPM, immutable root FS. Glibly pretending it ain't so isn't making Linux better.
  - solarkraft 4y ago
    The ones you mention can be had on Linux too (optionally, as everything, of course). But one place where the Linux ecosystem is really behind is running untrusted applications.
    - mustache_kimono 4y ago
      > ones you mention can be had on Linux too First, agreed re: untrusted apps. And, yeah, maybe I should have been more clear, as you note, they are usually an option, not the standard. Full disk encryption is the standard on MacOS. With Linux, like so many things, you never know what you're going to get. Secure boot took some work to setup on Ubuntu, but works relatively flawlessly. Immutable root filesystem is something you can do with Fedora Silverblue and a few other distros, but it's nowhere near the standard it is on MacOS. And that's what I mean by years behind, sure you can do basically anything on Linux, but, if it's not the standard, is it even practical enough to be workable? Linux, for lack of a better word, bigots (and I'm a huge Linux fan!) may call MacOS is a toy OS, but, for a laptop, how much work does it take to get Linux to the point where Linux's practical security is similar to MacOS? Lots, and lots, and lots.
    - ddevault 4y ago
janandonly 4y ago
Is this a scam? How does disabling Gatekeeper, File Quarantine or automatic updates make a MacOS system safer? It looks like the opposite !
- LinuxBender 4y ago
  I have not tested this app. Does it give the person running it a clear explanation of all the potentially positive and negative ramifications of the changes? If not then I think that should be a high severity enhancement. Maybe that could even be a discussion thread in and of itself here on HN giving feedback to the developer what could go wrong with each change. e.g. functionality breakage, security impact, auditing impact and so on.
- Karawebnetwork 4y ago
  Privacy, not security. This removes features that call home. Those features are not disabled in their "standard" preset which they present as "recommended for everyone". To disable gatekeeper, you need to use the "strict preset" which they describe as "not designed for daily users, it will break important functionalities".
- amarshall 4y ago
  FWIW, the settings you refer to are under a section entitled “Privacy over security”. Though I’m not sure there’s a strong privacy argument for disabling automatic updates or the offline-only things like (I think) Quarantine. Gatekeeper, though, as I recall, does send information about all binaries being opened.
- webmobdev 4y ago
  It's to do with Privacy: Gatekeeper performs online checks to verify if an app contains known malware and whether the developer's signing certificate is revoked. Gatekeeper, file quarantine etc. are security features also designed for data collection to learn about the files and applications you have in your computer (built in anti-malware on macOS and Windows provide them a perfect excuse to harvest all your file name and file hashes to know more about you). When automatic update is enabled macOS phones Apple periodically, leaking info like your geolocation and network etc.
kevinherron 4y ago
edit: misunderstood the intention is not to install this tool/repo, but use the scripts it generates.
- Karawebnetwork 4y ago
  You click on options and it generates code that is clearly readable on the right panel. You then have the option to copy paste it yourself or download the file. Then you can read the generated bat file before running it. It's not JS either.
defrost 4y ago
I love the "build a script" interface, very clear and transparent.
- heywoodlh 4y ago
  Totally agreed. Super nice for power users who want to re-use their privacy.sexy choices without needing to re-open the app.
Dominikbec991 4y ago
- saghul 4y ago
  What about it? Some people may not have a choice but they'd still like to improve their privacy / security.
  - fortran77 4y ago
    And others use it because it's the best choice. The Annual Pwn2Own contest seems to easily crack Mac and Linux, for example https://www.zdnet.com/article/windows-ubuntu-macos-virtualbox-fall-at-pwn2own-hacking-contest/ https://www.zdnet.com/article/windows-ubuntu-macos-virtualbo...
    - blackbear_ 4y ago
      What are you trying to say? Windows was the target of three out of six successful exploits, four if you consider the platform-agnostic exploit on Virtualbox.
    - eloeffler 4y ago
      In that article, I see that Windows was pwned 3 times, while MacOS and Ubuntu were pwned once. The other winners went against VMWare and Virtualbox.
    - akerl_ 4y ago
      “Windows, Ubuntu, macOS, VirtualBox fall at Pwn2Own hacking contest”
    - politelemon 4y ago
      The point I try to make to people still stuck in the "OS-loyalty" mindset is, all OSes are vulnerable by default. What matters is what measures you take to protect yourself. If you take no measures, then you have misunderstood security and privacy. I did say I try to make the point, but brand loyalty is very difficult to talk over.
quantumfissure 4y ago
Looks like it handles a lot of items 'Shut Up 10' and 'Windows 10 cleaner' does. Great to have everything rolled into one spot, customizable, and easy to understand. Great work.
- game-of-throws 4y ago
  I trust Shut Up 10 with my life. I'm curious if there's anything on this site not covered by it.
  - WHA8m 4y ago
    Do you mean 'O&O shut up 10 ++'? I only found that. It's not open source though. How come you 'trust it with your life'?
oneplane 4y ago
Some of the choices are neither privacy nor security improvements. Take quarantine or integrity protection or signature validation for example. Those three alone limit drive-by binary malware rather effectively. The only thing one could argue for in a privacy oriented manner is the signature validation with OCSP checks since it somewhat leaks what signature owners you're trying to check. But without it you'll never be able to find out if a signature was revoked, including self-signed signatures.
- flyinghamster 4y ago
  It's a tradeoff. You can have your built-in anti-malware, or you can choose not to leak information on the files you open. Which is more important is not a "one size fits all" situation. If you shut any of that off, you should be aware of the implications, as it is a potential footgun. It's good that things with security ramifications are separated, but they must be used with care.
- layer8 4y ago
  > if a signature was revoked if a certificate was revoked (Just to prevent confusion. Someone might think that it’s possible to revoke individual signatures.)
la64710 4y ago
.sexy is not an appropriate domain name for these things imho
- game-of-throws 4y ago
  Which sentence is more offensive? - Privacy is sexy - Don't let Microsoft kill privacy The answer probably depends where you live. Stereotypically, Americans are afraid of sex, and Europeans are afraid of violence - for example many video games released in Germany were modified to have green blood. My take: both sides of the pond need to lighten up
- dang 4y ago
  "Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html All we get out of generic tangents like this is a tedious, offtopic subthread that often ends up being much larger than the on-topic discussion, and usually descends into flamewar after a while—perhaps because the mind resorts to indignation to amuse itself in the absence of anything interesting (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sort=byDate&type=comment&query=mind%20amuse%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...).
  - la64710 4y ago
    It is a useful resource (the more people are aware the better kind) but as others have pointed out the TLD will be blocked by many software/browsers and inhibit the broad distribution of the content via that fqdn. Thank you.
- pineconewarrior 4y ago
  It's very off-putting, I agree.
  - jallasprit 4y ago
    Why?
Saris 4y ago
Interesting software, seems to have a lot of options, although I'm finding it difficult to read. The font is very large and an odd style. I also can't figure out what the "REVER" option does on some entries. Resizing the window doesn't seem to do anything, the program is fixed in the middle at a certain size.
- game-of-throws 4y ago
  That toggle is supposed to say REVERT.
encryptluks2 4y ago
I've found one of the easiest ways to enforce privacy on Windows is using the Local Group Policy Editor, which can then be backed up using LGPO.exe from the Security Compliance Toolkit and re-imported to other machines. Another option is PowerShell Desired State Configuration which you can then use to backup your local GPO into a MOF file, and reapplied to multiple machines or even added as part of an unattended setup: https://docs.microsoft.com/en-us/powershell/dsc/quickstarts/gpo-quickstart https://docs.microsoft.com/en-us/powershell/dsc/quickstarts/... I'm glad other people are working on tools, but you'll probably realize sooner or later that a few registry edits are not sufficient to maintain privacy, and policies are really the better approach.
- themenomen 4y ago
  Aren't many of those only available in pro/enterprise versions of Windows?
  - encryptluks2 4y ago
    Yes and no... The gpedit.msc isn't included by default in Windows Home Edition, but it can easily be added: https://windowsreport.com/enable-gpedit-windows-11/ https://windowsreport.com/enable-gpedit-windows-11/
- Tijdreiziger 4y ago
  Do you have any suggestions for privacy-enhancing GPOs?
  - encryptluks2 4y ago
    There are too many to really point out any in particular. Here is an LGPO text file for my machine policies. These can be converted to a Policy Analyzer .PolicyRules file using LGPO.exe I believe to get more input as to what they are used for. You also have to add those policy templates (ADMX), which I have a few added for Zoom, Chrome, Firefox, LibreOffice, Office, Edge, etc. https://dpaste.com/ARRBCVVXN https://dpaste.com/ARRBCVVXN

168 points by e12e 4y ago

I love it, but my work issued PC won't let me run any of the .bat files generated or install other FOSS apps such as freetubeapp.io. I wish I knew a way around Windows Defender Smartscreen managed by my company.

blitzar 4y ago
privacy/security best-practices is to block the running of .bat files
hobs 4y ago
One of the quickest ways to get fired is to try and circumvent your work computer stuff, better to find another job where they dont lock you down so hard.
- kornhole 4y ago
  That depends on what you are doing and your position. IT must expect senior hackers will try to find ways to improve their setup. I wish more companies would recognize that it is not wise to have their workers surveilled by external companies and instead setup these machines with tight privacy by default.
- kaiviti 4y ago
  Better to give you less privileges than too many. And if you really need the freedom to things that you can’t. You could always use VMs, if needed.
  - hobs 4y ago
    If you can install and use virtual machines you can use hypervisor escapes - any company that lets you do that probably isn't in the list of super locked down envs (or if it is its probably for a great reason.)
richardwhiuk 4y ago
Use a non-work PC for non-work stuff?
- kornhole 4y ago
  I do use a Linux PC for all personal stuff. I still want to make my work life a bit more private since MS seems to have made a business of knowing everything they can about workers.
Karawebnetwork 4y ago
Creating the .bat file yourself and pasting the generated code manually should allow you to run the file as admin.
hddqsb 4y ago
I'm curious, does the company-issue PC also prevent you from opening CMD and PowerShell? (If not, you can probably paste the commands directly there; or create a .bat file yourself as suggested in a sibling comment. But as another comment points out, trying to circumvent company restrictions is risky. Ideally you'd just have to ask IT to do it for you, until they get tired of fulfilling your requests and give you access to your machine.)

user3939382 4y ago

Depending on your field this could be a "yeah duh" comment for you, but there is a whole set of related tools and standards for this that's common when you're doing compliance-related cybersecurity, especially on server OSes. There's SCAP https://en.wikipedia.org/wiki/Security_Content_Automation_Protocol https://en.wikipedia.org/wiki/Security_Content_Automation_Pr... then a popular set of tools that implements it, for example: https://www.open-scap.org/tools/ https://www.open-scap.org/tools/ However the rulesets "profiles" are flexible, one popular one is CIS.

ddevault 4y ago

Using Windows or macOS in the first place already runs afoul of best practices for privacy and security.

game-of-throws 4y ago
The 90s called, they want their OS fanboy flamebait back
mustache_kimono 4y ago
Yeesh. MacOS is years ahead of Linux re: several important security features -- disk encryption, SecureBoot, TPM, immutable root FS. Glibly pretending it ain't so isn't making Linux better.
- solarkraft 4y ago
  The ones you mention can be had on Linux too (optionally, as everything, of course). But one place where the Linux ecosystem is really behind is running untrusted applications.
  - mustache_kimono 4y ago
    > ones you mention can be had on Linux too First, agreed re: untrusted apps. And, yeah, maybe I should have been more clear, as you note, they are usually an option, not the standard. Full disk encryption is the standard on MacOS. With Linux, like so many things, you never know what you're going to get. Secure boot took some work to setup on Ubuntu, but works relatively flawlessly. Immutable root filesystem is something you can do with Fedora Silverblue and a few other distros, but it's nowhere near the standard it is on MacOS. And that's what I mean by years behind, sure you can do basically anything on Linux, but, if it's not the standard, is it even practical enough to be workable? Linux, for lack of a better word, bigots (and I'm a huge Linux fan!) may call MacOS is a toy OS, but, for a laptop, how much work does it take to get Linux to the point where Linux's practical security is similar to MacOS? Lots, and lots, and lots.
  - ddevault 4y ago

janandonly 4y ago

Is this a scam? How does disabling Gatekeeper, File Quarantine or automatic updates make a MacOS system safer? It looks like the opposite !

LinuxBender 4y ago
I have not tested this app. Does it give the person running it a clear explanation of all the potentially positive and negative ramifications of the changes? If not then I think that should be a high severity enhancement. Maybe that could even be a discussion thread in and of itself here on HN giving feedback to the developer what could go wrong with each change. e.g. functionality breakage, security impact, auditing impact and so on.
Karawebnetwork 4y ago
Privacy, not security. This removes features that call home. Those features are not disabled in their "standard" preset which they present as "recommended for everyone". To disable gatekeeper, you need to use the "strict preset" which they describe as "not designed for daily users, it will break important functionalities".
amarshall 4y ago
FWIW, the settings you refer to are under a section entitled “Privacy over security”. Though I’m not sure there’s a strong privacy argument for disabling automatic updates or the offline-only things like (I think) Quarantine. Gatekeeper, though, as I recall, does send information about all binaries being opened.
webmobdev 4y ago
It's to do with Privacy: Gatekeeper performs online checks to verify if an app contains known malware and whether the developer's signing certificate is revoked. Gatekeeper, file quarantine etc. are security features also designed for data collection to learn about the files and applications you have in your computer (built in anti-malware on macOS and Windows provide them a perfect excuse to harvest all your file name and file hashes to know more about you). When automatic update is enabled macOS phones Apple periodically, leaking info like your geolocation and network etc.

kevinherron 4y ago

edit: misunderstood the intention is not to install this tool/repo, but use the scripts it generates.

Karawebnetwork 4y ago
You click on options and it generates code that is clearly readable on the right panel. You then have the option to copy paste it yourself or download the file. Then you can read the generated bat file before running it. It's not JS either.

defrost 4y ago

I love the "build a script" interface, very clear and transparent.

heywoodlh 4y ago
Totally agreed. Super nice for power users who want to re-use their privacy.sexy choices without needing to re-open the app.

Dominikbec991 4y ago

saghul 4y ago
What about it? Some people may not have a choice but they'd still like to improve their privacy / security.
- fortran77 4y ago
  And others use it because it's the best choice. The Annual Pwn2Own contest seems to easily crack Mac and Linux, for example https://www.zdnet.com/article/windows-ubuntu-macos-virtualbox-fall-at-pwn2own-hacking-contest/ https://www.zdnet.com/article/windows-ubuntu-macos-virtualbo...
  - blackbear_ 4y ago
    What are you trying to say? Windows was the target of three out of six successful exploits, four if you consider the platform-agnostic exploit on Virtualbox.
  - eloeffler 4y ago
    In that article, I see that Windows was pwned 3 times, while MacOS and Ubuntu were pwned once. The other winners went against VMWare and Virtualbox.
  - akerl_ 4y ago
    “Windows, Ubuntu, macOS, VirtualBox fall at Pwn2Own hacking contest”
  - politelemon 4y ago
    The point I try to make to people still stuck in the "OS-loyalty" mindset is, all OSes are vulnerable by default. What matters is what measures you take to protect yourself. If you take no measures, then you have misunderstood security and privacy. I did say I try to make the point, but brand loyalty is very difficult to talk over.

quantumfissure 4y ago

Looks like it handles a lot of items 'Shut Up 10' and 'Windows 10 cleaner' does. Great to have everything rolled into one spot, customizable, and easy to understand. Great work.

game-of-throws 4y ago
I trust Shut Up 10 with my life. I'm curious if there's anything on this site not covered by it.
- WHA8m 4y ago
  Do you mean 'O&O shut up 10 ++'? I only found that. It's not open source though. How come you 'trust it with your life'?

oneplane 4y ago

Some of the choices are neither privacy nor security improvements. Take quarantine or integrity protection or signature validation for example. Those three alone limit drive-by binary malware rather effectively. The only thing one could argue for in a privacy oriented manner is the signature validation with OCSP checks since it somewhat leaks what signature owners you're trying to check. But without it you'll never be able to find out if a signature was revoked, including self-signed signatures.

flyinghamster 4y ago
It's a tradeoff. You can have your built-in anti-malware, or you can choose not to leak information on the files you open. Which is more important is not a "one size fits all" situation. If you shut any of that off, you should be aware of the implications, as it is a potential footgun. It's good that things with security ramifications are separated, but they must be used with care.
layer8 4y ago
> if a signature was revoked if a certificate was revoked (Just to prevent confusion. Someone might think that it’s possible to revoke individual signatures.)

la64710 4y ago

.sexy is not an appropriate domain name for these things imho

game-of-throws 4y ago
Which sentence is more offensive? - Privacy is sexy - Don't let Microsoft kill privacy The answer probably depends where you live. Stereotypically, Americans are afraid of sex, and Europeans are afraid of violence - for example many video games released in Germany were modified to have green blood. My take: both sides of the pond need to lighten up
dang 4y ago
"Please don't pick the most provocative thing in an article or post to complain about in the thread. Find something interesting to respond to instead." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html All we get out of generic tangents like this is a tedious, offtopic subthread that often ends up being much larger than the on-topic discussion, and usually descends into flamewar after a while—perhaps because the mind resorts to indignation to amuse itself in the absence of anything interesting (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sort=byDate&type=comment&query=mind%20amuse%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...).
- la64710 4y ago
  It is a useful resource (the more people are aware the better kind) but as others have pointed out the TLD will be blocked by many software/browsers and inhibit the broad distribution of the content via that fqdn. Thank you.
pineconewarrior 4y ago
It's very off-putting, I agree.
- jallasprit 4y ago
  Why?

Saris 4y ago

Interesting software, seems to have a lot of options, although I'm finding it difficult to read. The font is very large and an odd style. I also can't figure out what the "REVER" option does on some entries. Resizing the window doesn't seem to do anything, the program is fixed in the middle at a certain size.

game-of-throws 4y ago
That toggle is supposed to say REVERT.

encryptluks2 4y ago

I've found one of the easiest ways to enforce privacy on Windows is using the Local Group Policy Editor, which can then be backed up using LGPO.exe from the Security Compliance Toolkit and re-imported to other machines. Another option is PowerShell Desired State Configuration which you can then use to backup your local GPO into a MOF file, and reapplied to multiple machines or even added as part of an unattended setup: https://docs.microsoft.com/en-us/powershell/dsc/quickstarts/gpo-quickstart https://docs.microsoft.com/en-us/powershell/dsc/quickstarts/... I'm glad other people are working on tools, but you'll probably realize sooner or later that a few registry edits are not sufficient to maintain privacy, and policies are really the better approach.

themenomen 4y ago
Aren't many of those only available in pro/enterprise versions of Windows?
- encryptluks2 4y ago
  Yes and no... The gpedit.msc isn't included by default in Windows Home Edition, but it can easily be added: https://windowsreport.com/enable-gpedit-windows-11/ https://windowsreport.com/enable-gpedit-windows-11/
Tijdreiziger 4y ago
Do you have any suggestions for privacy-enhancing GPOs?
- encryptluks2 4y ago
  There are too many to really point out any in particular. Here is an LGPO text file for my machine policies. These can be converted to a Policy Analyzer .PolicyRules file using LGPO.exe I believe to get more input as to what they are used for. You also have to add those policy templates (ADMX), which I have a few added for Zoom, Chrome, Firefox, LibreOffice, Office, Edge, etc. https://dpaste.com/ARRBCVVXN https://dpaste.com/ARRBCVVXN