SECURITY: Complete Protomartyr's ThinkPad Security Config 2019

[Protomartyr]

This is my current security config that I've been running for around a week with no problems.

Any tips/suggestions to improve/streamline my setup would be greatly appreciated!

 

[harlan4096]

@Protomartyr:

I'm not very fond of Windows Backup and Restore , I would suggest better Macrium Reflect Free or AOEMI Backupper, both are free and reliably.

As for "Virus and Malware Removal Tools", You may add: ZAM Free, remove MalWareBytes Free to this section (since You already have it as real-time solution), EmsiSoft Emergengy Kit and HitManPro Free.

Please kindly reflect Your changes editing Your config, and announcing them here, thanks for sharing

 

[notabot]

@Protomartyr:

I'm not very fond of Windows Backup and Restore , I would suggest better Macrium Reflect Free or AOEMI Backupper, both are free and reliably.

As for "Virus and Malware Removal Tools", You may add: ZAM Free, remove MalWareBytes Free to this section (since You already have it as real-time solution), EmsiSoft Emergengy Kit and HitManPro Free.

Please kindly reflect Your changes editing Your config, and announcing them here, thanks for sharing

I use something else too because I needed different functionalities, but out of curiosity, what’s wrong with Windows Backup and Restore ?

 

[harlan4096]

Often there are users reporting getting issues with it...

 

[Protomartyr]

Added:
- Emsisoft Emergency Kit

I love the portability of Emsisoft's program, so it was an instant add to my collection. Plus there was no email sign-up/registration needed. Just a simple download and install. I'm still trying to find official portable versions of HitmanPro and Zemana Anti-Malware. From what I saw in my search, both downloads were for trials.

Going to spend the weekend evaluating Macrium Reflect Free and AOMEI Backupper.

Also removed Malwarebytes from the 'Virus and Malware Removal Tools' section since I already have the Premium version listed under the 'Real-time' section.

Thank you for the suggestions @harlan4096 !

 

[Protomartyr]

Added:
- Enabled auto lock of computer through registry

I'm usually pretty good at making sure I lock my laptop when I leave to do something but I've been forgetting lately. Decided to set my computer to auto-lock after being idle for 10 minutes. You can do this on Windows 10 Pro edition but not on the Home edition since there's no access to the Local Security Policy feature. To get around this, I just had to add a new DWORD value named InactivityTimeoutSecs and set it to 600 seconds. Got the job done!

Also, I was doing a few scans before making a system image for this week. Windows Defender and Malwarebytes Premium reported everything was fine. Decided to run Emsisoft Emergency Kit that I just added today. To my surprise it picked up 2 Trojans in the 'C:\Windows\IULOGS\' directory. Not sure how long they've been there but I'm glad I got it off my system. Nice work, Emsisoft!

 

[LDogg]

Think you have too many Privacy related web extension and "i don't care about cookies" can also be use as a filter list inside your adblocker. Overall though nice setup.

~LDogg

 

[Protomartyr]

@LDogg

Thanks for the feedback! Yeah I've been wanting to cut down on the number of extensions I use. What extensions do you think I should cut out (along with 'I don't care about cookies)?

 

[Protomartyr]

Added:
- HitmanPro Free (second opinion scanner)
- Nano Defender (to Firefox; already have it on Chrome)
- uBlock Origin (to Firefox; already have it on Chrome)

Removed:
- I don't care about cookies (browser extension; instead I integrated it into uBlock as a filter list)
- CanvasBlocker (browser extension)

 

[oldschool]

What extensions do you think I should cut out

Here are my thoughts:
You don't need Windows Defender Browser Protection. You have Smartscreen which is enough unless you have very risky browsing habits, in which case you could add Bitdefender Trafficlight. But you already have a locked-down system so not really needed. You can get rid of Nano Defender and rely on µBO alone, or you could add the Nano Defender Integration filter list into uBO. And you can replace Decentraleyes, Canvas Defender and Privacy Badger with Privacy Possum which will make your attack surface smaller. PP does the job of all three of the others IMO.

Remember friend: Stay safe, not paranoid.

 

[Protomartyr]

You can get rid of Nano Defender and rely on µBO alone, or you could add the Nano Defender Integration filter list into uBO.

This has been something that I've never found a clear answer to. I have always thought importing the Nano Defender Integration filter list into uBO was enough.

However, through my search it seems that the extension needs to be installed as well? See this ghacks article (link), this reddit thread (link), and finally the developer's installation instructions (link). That's why I have the extensions installed along with uBlock Origin. I might do some testing with the Nano Defender extension uninstalled to see if it still works with just the filter lists alone.

Bitdefender Traffic Light has been an extension I've seen recommended quite often that I've never gotten a chance to test out. Same with Privacy Possum. I'll be testing these two extensions this week and removing the other redundant/unneeded extensions.

Thanks for your recommendations!

 

[oldschool]

This has been something that I've never found a clear answer to. I have always thought importing the Nano Defender Integration filter list into uBO was enough.

However, through my search it seems that the extension needs to be installed as well? See this ghacks article (link), this reddit thread (link), and finally the developer's installation instructions (link). That's why I have the extensions installed along with uBlock Origin. I might do some testing with the Nano Defender extension uninstalled to see if it still works with just the filter lists alone.

Bitdefender Traffic Light has been an extension I've seen recommended quite often that I've never gotten a chance to test out. Same with Privacy Possum. I'll be testing these two extensions this week and removing the other redundant/unneeded extensions.

Thanks for your recommendations!

About Nano Integration - The 1st and 3rd instructions you reference are in agreement. I use that method. Honestly, I don't run into many anti-adblock walls (I can't remember the last one I saw) and I've done pretty well with µBO alone as it has improved greatly with the recent updates. Do your own testing and see what you think.

BDTL has done well in @Evjl's Rain testing here Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings and members I trust advise it as well.

Privacy Possum - Fingerprinting is a multi-faceted problem and I doubt any single or multiple extensions can give 100% protection. This is just my view based on what I've read. My view of Privacy Badger is that even with the claimed improvements with the recent update, the extension doesn't give me enough feedback/info relative to claimed improvements. I don't do technical testing so I can't give fully qualified answers on questions of privacy protection, but I've decided for myself to keep it simple. Less is more thinking. I figure if I cut out a majority or just a whole bunch of tracking methods and keep a lean browser attack surface, then I can live with the results - whatever they may be. So ublock origin and PP is enough for me. Let me know what your experience is after you do some testing.

BTW, I use uBO in medium mode so that does the heavy lifting for me.

 

[Protomartyr]

Added:
- Bitdefender Traffic Light (Chrome & Firefox browser extensions)
- Privacy Possum (Chrome & Firefox browser extensions)

Removed:
- Decentraleyes (Chrome & Firefox browser extensions)
- Malwarebytes Browser Guard (Firefox browser extension; using Bitdefender Traffic Light instead so my extensions match with Chrome)
- Nano Defender (Chrome & Firefox browser extensions; using the Nano Defender Integration filter lists in uBlock Origin instead)
- Privacy Badger (Chrome & Firefox browser extensions)
- Windows Defender Browser Protection (Chrome browser extension)

 

[Protomartyr]

Just a minor update.

Set ConfigureDefender to Max protection (was on High before) just to see how it runs. So far so good!

 

[LDogg]

Added:
- HitmanPro Free (second opinion scanner)
- Nano Defender (to Firefox; already have it on Chrome)
- uBlock Origin (to Firefox; already have it on Chrome)

Removed:
- I don't care about cookies (browser extension; instead I integrated it into uBlock as a filter list)
- CanvasBlocker (browser extension)

Fantastic changes, and solely for privacy aspects just use Privacy Possum, does a lot of blockage under one tin.

~LDogg

 

[Protomartyr]

Added:
- CleanBrowsing DNS ('Security' filter)

Removed:
- Bitdefender Traffic Light (due to privacy concerns & changes in permissions)

 

[Protomartyr]

Removed:
- Firefox Multi-Account Containers
- Temporary Containers (Firefox browser extension)

I run Firefox in permanent incognito mode now, so those extensions weren't needed.

 

[ForgottenSeer 823865]

There is nothing wrong about Windows7 Backup & Restore. On my end, It never failed a restore, unlike all the other 3rd party softs I used. However it is very slow, and due to how I use my systems, I can't make it my main imaging soft. So i use it only as a failsafe, if the others fails.

 

[Protomartyr]

@Umbra Yeah Windows 7 Backup & Restore has never failed me.

I didn't realize 3rd party software used compression methods to make the backup image smaller. I've come to find out that some even have the option to verify the integrity of a backup. These two features are very intriguing so I've been meaning to try an alternative backup imaging software once I get a new external HDD. Macrium Reflect Free and AOMEI Backupper are two programs that I have on my 'To Test' list.

Which ones do you personally recommend?

 

[ForgottenSeer 823865]

@Protomartyr go for Macrium, I use it, the speed is awesome, if you use the paid version, you access to incremental backups which take max 5mn for a full 40gb system backup and less than a minute for the following ones. Restore about 5mn.