Advanced Plus Security Lightning_Brian's 2021 Security Configuration

[Lightning_Brian]

Hello MT Friends!

Happy New Year! Hard to believe we are closing out another year here.

I have made some good changes as of late and I wanted to post this in my 2021 build.

***DNS changes will be coming in the near future. For now I'm listing this as 'none' with the note that I will be changing this up soon.***

I know many of you might be thinking "man this guy pays some serious cash for some serious software" and I do agree. Some software I have on lifetime licenses while others I do pay a yearly fee for. I aim for the maximum security to ensure a nice and tight setup.

I will highlight some changes in the change log section so you can see what I am changing or upgrading/updating my software to.

Let me know your thoughts of my setup!

Thanks!
Brian

 

[Gandalf_The_Grey]

Great config as always

A suggestion for a DNS is Quad9 based on this review here: Malicious site filters on DNS in 2020 – Skadligkod.se
But that also depends how fast or slow it is where you live.

What you think about changing browsers?
Google Chrome and/or Microsoft Edge are in theory much more secure than Firefox.
Privacy wise Brave seems to be the best one right now.

 

[harlan4096]

Maybe "a bit overkill" -> Noton 360 Premium (paid - latest release), VoodooShield Premium...

 

[ForgottenSeer 85179]

Google Chrome and/or Microsoft Edge are in theory much more secure than Firefox.

Well. In practice too: Firefox and Chromium Security | Madaidan's Insecurities (madaidans-insecurities.github.io)

 

[Gandalf_The_Grey]

Well. In practice too: Firefox and Chromium Security | Madaidan's Insecurities (madaidans-insecurities.github.io)

Of course, but what is the change that he gets infected while using Firefox with AdGuard and NoScript and Norton 360 as real time protection?
That makes it theoretical again.

 

[ForgottenSeer 85179]

Of course, but what is the change that he gets infected while using Firefox with AdGuard and NoScript and Norton 360 as real time protection?
That makes it theoretical again.

If the malware is known or detected then yes you're right.
Anyway sandboxing browser / reducing attack surface is always a good idea

 

[Lightning_Brian]

Hello!

@Gandalf_The_Grey and @security123 ! Great points here! I'll have to look into maybe using Brave here. I don't do anything "risky" outside of my isolated VM setup that I explained in my 2019 configuration. However, I do agree that Chrome based browsers do have some good hardening involved. I like Firefox for privacy as its not data mining everything like the folks at Google is doing with their browser. @Gandalf_The_Grey you are right Brave may be my go to solution here. More to come on that side!

Thanks for the DNS recommendation @Gandalf_The_Grey ! I will look into it.

CloudFlare at 1.1.1.1 seems interesting too. Any thoughts about this DNS provider for the side of security/privacy etc. etc. ?

~Brian

 

[ForgottenSeer 85179]

I like Firefox for privacy as its not data mining everything like the folks at Google is doing with their browse

This isn't right. Firefox use telemetry by default and some even can't disable in normal UI.
Firefox does mine data and isn't so good for privacy as you think. You read more at my posted link.

 

[Lightning_Brian]

This isn't right. Firefox use telemetry by default and some even can't disable in normal UI.
Firefox does mine data and isn't so good for privacy as you think. You read more at my posted link.

Humbling saying: Matter of opinion for some things for data mining. If we really don't want any data mined we are left with very few and far between for browsers.

If you know Google like I do you never want to use them for data protection. However, I don't want to jump down that rabbit hole with my friends at MT. =) Lets just say if you ever manage a website and use Google Analytics you will know in two seconds Google isn't the best choice for privacy rights. With this being said, what is your go to web browser of choice? Do you like Brave or which web browser do you like?

Brian

 

[ForgottenSeer 85179]

With this being said, what is your go to web browser of choice? Do you like Brave or which web browser do you like?

I only use Edge on Desktop as it's from Microsoft and i trust them. Obviously, else i wouldn't use Windows.
I don't like Brave because of their suspicious Ad system. Yes i know it's Opt-In but that doesn't matter for me.

 

[Gandalf_The_Grey]

Hello!

@Gandalf_The_Grey and @security123 ! Great points here! I'll have to look into maybe using Brave here. I don't do anything "risky" outside of my isolated VM setup that I explained in my 2019 configuration. However, I do agree that Chrome based browsers do have some good hardening involved. I like Firefox for privacy as its not data mining everything like the folks at Google is doing with their browser. @Gandalf_The_Grey you are right Brave may be my go to solution here. More to come on that side!

Thanks for the DNS recommendation @Gandalf_The_Grey ! I will look into it.

CloudFlare at 1.1.1.1 seems interesting too. Any thoughts about this DNS provider for the side of security/privacy etc. etc. ?

~Brian

CloudfFlare is good for speed and innovation but not for security or privacy. They don't seem to block anything.

 

[ForgottenSeer 85179]

They don't seem to block anything.

Not even with their blocking version? Because they provide a non-blocking and blocking version.

 

[HarborFront]

IMO, if you always use your VPN like I do then DNS settings is not required. Your VPN provider will handle it.

 

[Handsome Recluse]

Why do you also have multiple password managers?

 

[danb]

Maybe "a bit overkill" -> Noton 360 Premium (paid - latest release), VoodooShield Premium...

Yeah, I have heard that Norton's toggling computer lock is amazing, you probably do not need both .

 

[harlan4096]

Specially if He set Norton settings to Aggressive, that probably will lead to some false positives

 

[danb]

Specially if He set Norton settings to Aggressive, that probably will lead to some false positives

Microsoft was hacked. It is time we lock our computers.

 

[ForgottenSeer 85179]

Microsoft was hacked.

Without damage so everything is ok

 

[Gandalf_The_Grey]

Not even with their blocking version? Because they provide a non-blocking and blocking version.

The last test done are not good for Cloudflare:
2020-05-03: Malicious site filters on DNS in 2020 – Skadligkod.se

Domains connected to the following categories has been selected:

• 12 phishing links
• 12 malware links

The DNS providers included in the test are:

• Quad9 – 9.9.9.9
• Cloudflare family – 1.1.1.2
• OpenDNS – 208.67.222.222
• CleanBrowsing – 185.228.168.9
• Adguard DNS – 176.103.130.130

In comparison I did a check on Cloudflare’s default DNS 1.1.1.1 and Googles DNS 8.8.8.8 as well, also when it is known that those are not blocking any content.

The blocking is been done in two different ways depending on the DNS provider.

• not resolving the domain with NIXDOMAIN (Quad9 + CleanBrowsing) or by answering with IP 0.0.0.0 (Cloudflare).
• Answering with an IP of the DNS provider blockpage. (Adguard DNS + OpenDNS)

Total percentage of blocked domains:

• Quad9 = 96 % (23/24)
• CleanBrowsing = 75 % (18/24)
• AdGuard DNS = 54 % (13/24)
• OpenDNS = 46 % (11/24)
• Cloudflare families 13 % (3/24)

Blocked Phishing domains:

• Quad9 = 100%
• CleanBrowsing = 100 %
• OpenDNS = 92 %
• Adguard DNS = 42 %

Non other DNS services blocked any phishing domain tested.

Blocked Malware domains:

• Quad9 = 92 %
• Adguard DNS = 67 %
• CleanBrowsing = 50 %
• Cloudlare family = 25 %

Non other DNS services blocked any malware domain tested.

2020-08-06: Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

15 links from urlhaus. No time for phishing

Extensions:
Chrome's safebrowsing: block 12/15 + warn: 3/15 = 15/15
Bitdefender: 14/15
Malwarebytes: 10/15
Avira: 8/15
Norton: 7/15
Emsisoft: 5/15
Microsoft WDBP: 5/15 (tested a few times, same result)

DNS:
neustar (Threat Protection): 14/15
nextDNS: 14/15
quad9: 9/15
adguard family: malware 2/15 | adult 4/15 = 6/15
cleanbrowsing secure: 5/15
cloudflare malwares+adults: 2/15
openDNS family: 2/15

 

[silversurfer]

Confirmed here on my personal testing recently some days ago:
Cloudflare's "Malware and Adult Content Blocking" blocks almost none URL delivering fresh malware!

Beside NextDNS, Quad9 seems to be the best DNS service to block malware, 3rd place for CleanBrowsing.