Paranoid Banking Computer.

[Sampei.Nihira]

@Andy Ful

Better protection (free) against zero-day vulnerabilities could be achieved with 0Patch:

Long Live Windows 10 - 0patch

Pricing and Plans - 0patch

P.S.

As you know, I wouldn't use that PC exclusively for online banking.

 

[Andy Ful]

You have successfully built a "digital fortress" that can survive the End-of-Life of Windows 10.

Most work was done/recommended for Enterprises by Microsoft.
I only added:

• NextDNS as the default-deny domain blocker, which is a nice addition to Microsoft Defender Network Protection.
• Blocking Console Window Host (conhost.exe) on the kernel level, which can effectively blind the attackers at the post-exploitation stage.

 

[Andy Ful]

@Andy Ful

Better protection (free) against zero-day vulnerabilities could be achieved with 0Patch:

Long Live Windows 10 - 0patch

Pricing and Plans - 0patch

P.S.

As you know, I wouldn't use my PC exclusively for online banking.

Yes, 0patch can be considered in the case of some kernel exploits.
Using it for all exploits would be rather impossible on the computer of a friend.

 

[Andy Ful]

Paranoid banking on the new computer (Windows + Linux in VirtualBox).

As it was mentioned in the OP, instead of using Windows OS, it is possible to use Linux, etc.
One of the available solutions is as follows:

1. Install VirtualBox.
2. Create a VM with any small reputable Linux distro.
3. Install the AdGuard AdBlocker extension in the browser.
4. Deactivate blocking ADs and Trackers in AdGuard.
5. Use the user rule: ||*^$all
6. Add to the AdGuard Allowlist the banking website and some other necessary websites.
7. Set a free DOH in the browser.

Point 4 is necessary because AdGuard uses blocking lists with a combination of block/allow rules. For example, the "abc" TLD can be generally blocked except for some trusted websites. Those rules will bypass the global blocking rule from point 5. After applying point 4, those trusted websites will be blocked (trusted websites might be compromised).

To whitelist any concrete website, just copy the blocked domain from the AdGuard block page and paste into AdGuard Whitelist.

In the above example, I skipped the banking domain, but added MalwareTips and domains needed to run Office Apps online.

REMARKS.
The "Proceed anyway button", can sometimes temporarily allow the blocked website.
The default-deny rules work only in the browser and not system-wide, like in paranoid banking with Windows OS. However, the Linux VM is well isolated from the real system, so this should not impact the security.

 

[Sampei.Nihira]

You can also do this with uBlock Origin Lite, just enter these 1 DNR rules:

action:
  type: block
condition:
  urlFilter: ^
  resourceTypes:
    - csp_report
    - font
    - image
    - main_frame
    - media
    - object
    - other
    - ping
    - script
    - stylesheet
    - sub_frame
    - webbundle
    - websocket
    - webtransport
    - xmlhttprequest
---
action:
  type: allow
condition:
  requestDomains:
    - malwaretips.com
    - login.live.com
    - outlook.office.com
  resourceTypes:
    - csp_report
    - font
    - image
    - main_frame
    - media
    - object
    - other
    - ping
    - script
    - stylesheet
    - sub_frame
    - webbundle
    - websocket
    - webtransport
    - xmlhttprequest
---

 

[Sampei.Nihira]

I'll never get used to the slow editing speed.

So there are two rules, and you have to add the exception domains under requestDomains.
Of course, there's no “proceed anyway” button.

 

[Sampei.Nihira]

@Andy Ful

Even simpler.
Only the first blocking rule.
Use the slider in Basic and move it to no filtering on the websites you want to allow.
In “Filtering mode details” you can check the list of excluded domains:





In this mode, uboL does not consume CPU, RAM, or other resources compared to AG.