Advanced Plus Security kC77's Security Config for 2021

[kC77]

only just found this section, thought id share!

 

[kC77]

not only for security, but more for privacy, over the past few months ive replaced many apps & services with better or self hosted solutions....... and i am totally trying to degoogle my life.

Chrome -> Brave
google search -> Brave Search
uBlockorigin > no longer needed as already running pihole network wide & brave has great inbuilt adblock no extension required
google dns > cloudflare > unbound (recursive dns sec on my pi3) i am the DNS!
gmail > protonmail
google calendar & contacts > netxcloud (self hosted on secondary rasperry pi4b)
google drive & dropbox > netxcloud (self hosted on secondary rasperry pi4b)
google photos > netxcloud (self hosted on secondary rasperry pi4b)
google keep > standard notes
microsft onenote > standard notes
Google Maps > Magic Earth
Google Authenticator - AndroidOTP (on mobile) & keepass (when on desktop/laptop)

after for years being so reliant on google accounts & google services ........my next step is to put calyxOS on my pixel4

 

[Kongo]

Great move and great alternatives. Still, there are two things I would change.

1. Instead of Dropbox you could use MEGA which is open-source and private friendly. It even supports anonymous payment options like Bitcoin or PaySafeCard.

2. Consider using Quad9 DNS instead of Cloudflare which is better in terms of privacy and even security (malicious sites blocking abilities)

Edit: Whoops, you are not using Dropbox. Got you wrong, my bad.

 

[kC77]

Great move and great alternatives. Still, there are two things I would change.

1. Instead of Dropbox you could use MEGA which is open-source and private friendly. It even supports anonymous payment options like Bitcoin or PaySafeCard.

2. Consider using Quad9 DNS instead of Cloudflare which is better in terms of privacy and even security (malicious sites blocking abilities)

Hi thanks, I'm avoiding the middlemen in both of those...
Running nextcloud I am my own mega... I control the encryption keys and access and host it myself.

As for DNS, I actually block all outbound DNS requests unless it comes from my own hosted unbound server (recursive)
So all my pi knows is the root.hints.....and dnssec from there, the pi-hole then categorizes the clients as to what they can or cannot access (social/porn/tracking/telemetry etc) I have zero reliance on any public DNS provider gathering up data, and if any device or malware tries to bypass it (hardcoded DNS), it's blocked at the firewall.

 

[kC77]

So the only reason for using Cloudflare is speed?

There is no cloudflare at all...

I used to use Google DNS... Then I used to use cloudflare .... But now neither.... My only dns server is myself

Every device (even when I'm mobile I vpn to home) gets the DNS of my unbound/pihole server

Pihole passes these queries on and according to the blocklists deals with accordingly

So unbound is the recursive DNS server, it doesn't have any forward lookups or upstream DNS... All it knows are the root hints and deals with dnssec.... It caches queries, but even when not cached is blisteringly quick.

unbound - Pi-hole documentation

docs.pi-hole.net

 

[plat]

I am curious as to what method you used to bypass the cpu requirement for Windows 11. Do you like Windows 11? I was OK with it but then encountered an annoying disk issue that compelled me to reinstall Windows 10. Definitely seeing the difference in performance (11 is better).

 

[Kongo]

There is no cloudflare at all...

I used to use Google DNS... Then I used to use cloudflare .... But now neither.... My only dns server is myself

Every device (even when I'm mobile I vpn to home) gets the DNS of my unbound/pihole server

Pihole passes these queries on and according to the blocklists deals with accordingly

So unbound is the recursive DNS server, it doesn't have any forward lookups or upstream DNS... All it knows are the root hints and deals with dnssec.... It caches queries, but even when not cached is blisteringly quick.

unbound - Pi-hole documentation

docs.pi-hole.net

I guess it's too late for my brain to work, sorry for that. Got it now, thanks for the explanation

 

[kC77]

I am curious as to what method you used to bypass the cpu requirement for Windows 11. Do you like Windows 11? I was OK with it but then encountered an annoying disk issue that compelled me to reinstall Windows 10. Definitely seeing the difference in performance (11 is better).

Hi, running a few machines (work laptop/main desktop/surface pro all on windows 11) (but all have TPM) this regtweak allowed the CPU to be bypassed

• create a new registry entry on HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup Use the “REG_DWORD” type
• Name it “AllowUpgradesWithUnsupportedTPMOrCPU”
• Set value to “1”
• Reboot your system

From <Microsoft shares Windows 11 TPM check bypass for unsupported PCs>

i was running windows 11 from insider (since late august) and had no major issues, with any 3rd party apps/drivers, performance has been as good if not better for most things.

 

[kC77]

I guess it's too late for my brain to work, sorry for that. Got it now, thanks for the explanation

no worries.... for most people the best would be to use quad9 or cloudflare especially with the additional filtering they provide... e.g malware blocking/cloud filtering, the upsides to these services is ease of use & security the downsides to these services is privacy.
.
however I am not interested in the protection/filtering they provide, I am already covered for protection..... I am more interested in privacy, my DNS queries are not being logged in the traditional manner, yes cloudflare etc may say they dont log your queries..... but im not so sure and id rather take control of this myself.
now when any device on my lan or vpn client looks up a domain, it goes to my pi, pihole checks the lists.... if its good, it gets sent to unbound that uses the root hints Root Servers to then securely via dnsec if possible try to resolve the record and caches it on my pi.... at no point is any public/upstream dns server involved.
if it was a domain in my blocklist/regex then it just gets sunk.

i've never been a big linux user, but raspberry pis are amazing devices.....
a good firewall... a pi for pihole/unbound and a pi for nextcloud.... many happy windows devices private and secure behind it.... ill update again in 2022... probably have 45 raspberry pis by then!

 

[CyberTech]

Google Authenticator - AndroidOTP (on mobile) & keepass (when on desktop/laptop)

after for years being so reliant on google accounts & google services ........my next step is to put calyxOS on my pixel4

What about Aegis Authenticator and andOTP? they are the best Authenticator for Android phone thats privacy

According to the sources, Avoid Authy or Google Authenticator.

 

[kC77]

What about Aegis Authenticator and andOTP? they are the best Authenticator for Android phone thats privacy

According to the sources, Avoid Authy or Google Authenticator.

yes AndOTP thats what im using, google auth has gone
"Google Authenticator - AndroidOTP (on mobile) "

that should of read "Google Authenticator -> AndOTP (on mobile) "

thanks!