Evolv-ing Thread

[BillW50]

Yeah, now your getting into one of those area's where I start to get lost... It's not that I can't figure it out at some point, but I have to weigh how many hours (or days) do I want to spend researching "how to" versus the benefit of the task done.

Ever since at least Windows 2000 and it might go back earlier, there is a file named "Host" without an extension. And whatever URL or IP address is in this text based file, your machine will block any communications with. Same idea like using a firewall to block them. It is usually found here:

C:\WINDOWS\SYSTEM32\DRIVERS\ETC

 

[tiburonfirst]

I think it is "ON" by default unless you have a metered connection.

strange - i didn't think i scrutinized those settings but must have if mike says it's turned on by default. i better pat myself on the shoulder!

 

[BillW50]

I think it is "ON" by default unless you have a metered connection.

I tried using metered, but my OneDrive automatic sync stopped working so I had to turn metered back off.

What's been working so far for me since Windows 8.0 is let it do what it wants to do. After it installs an update build you didn't want, force a hardware reboot. Windows thinks the update build crashed your system. On reboot, you'll get a boot menu that allows you to undo the update build. PIA and it could take hours. At least you don't have to babysit it. Once done, Windows will never try that update build ever again.

 

[TrollDragon]

It's not the updates I want to shut off, rather stop MS from using my computer and bandwidth to upload updates and out to others. That's MS job, let MS use their servers and pay for their own bandwidth to send updates out. As of now they are forcing us, "You will allow it, you have no choice", that's not right.

Never knew that it did that... I have a fiber connection and don't really pay no mind, if it helps someone on a slow connection get updates then works for me.

 

[TrollDragon]

Look for this setting:

Settings > Windows update > Advanced Options > Choose how updates Are Delivered

View attachment 853843

That would be the place, good find.

 

[TrollDragon]

I mentioned a few posts back about creating a firewall rule for a program, can't that maybe done with Windows Update. Rules can be made for both inbound and outbound.

That would work if you wanted to disable windows update too but I think registry option is easier.

I've locked myself out of access before "fine tuning" remote firewall rules... Thank god for TeamViewer and similar programs, but you still have to make that call to a user on the inside...

 

[SlickWilly]

So a few days ago I posted about another package that's seems lost in limbo through our wonderful postal system, I have an update and may have found some un-comforting news that may effect all of us. The package (bottle of ejuice) hasn't moved from a depot in Las Vegas since the 9th. Day before yesterday I called USPS 800 #, talked to a gal for 20 min, gave her the tracking # and she proceeds to read off the tacking screen in long drawn out detail of everything I see online... Then she says, "Well sir our policy is 1st class mail arrives 3-5 days so this is way over and we need to find out why" no kidding, that's why I called! Finally she tells me "We'll open a query, look into it and call you back in 2-3 days"

Yesterday I come home to find a message on the answering machine from a fellow named Dan at my local post office. Message says they looked into the lost package and have sent a "request to locate" to the manager of the LV depot. So I called Dan and asked him why the heck did they assign this to you folks? He tells me they have a new system and it "has a lot of problems" and that for some odd reason lost package tracking is now assigned to the post office of where the package is addressed for delivery instead of the depot where it was last scanned, wow! I apologized to him, told him this doesn't make sense and sorry for creating you a problem, I asked him if he was aware of the other lost package I had recently that looped back and forth between PA and TX for an entire month, he told me yes and that they are a lot of problems with this new system. Yikes. So, I have to wonder, what's going to happen the next few weeks when USPS is stressed during the holiday rush? Counting on Xmas packages showing on time this year?

There's our government at work! Sure you want to trust them being in charge of your health care?

 

[SlickWilly]

I tried using metered, but my OneDrive automatic sync stopped working so I had to turn metered back off.

What's been working so far for me since Windows 8.0 is let it do what it wants to do. After it installs an update build you didn't want, force a hardware reboot. Windows thinks the update build crashed your system. On reboot, you'll get a boot menu that allows you to undo the update build. PIA and it could take hours. At least you don't have to babysit it. Once done, Windows will never try that update build ever again.

OneDrive, that made me think there may be another factor as to what is set On or Off by default in Win 10, if you use the MS account or not. I choose not to use the MS account, during setup I use the Offline Account option. I didn't fill out who I am or where I live, didn't give any email or phone number. Going that route you don't have the MS Cloud "OneDrive" activated, I don't want it. I also don't want a lot of the other crap like any Sync, Find my device, Linked cell phone, My Location and most importantly Cortana! In our laptops I disable the camera's and microphones and put tape over them. I take tape bend one end over to stick to itself to make a little pull tab and use tape on my cell phone too, if I want to use the camera I pull the tape off, take the pic and put the tape back on. I like my privacy, well as much of it as I can keep anyways, I refuse to make it easy for them.

 

[TrollDragon]

I had customers with tape over their webcam before...

We walk around the house and talk in very hushed tones, just in case Google is listening.

 

[BillW50]

I didn't fill out who I am or where I live, didn't give any email or phone number. Going that route you don't have the MS Cloud "OneDrive" activated, I don't want it. I also don't want a lot of the other crap like any Sync, Find my device, Linked cell phone, My Location and most importantly Cortana!

Yes, same here. Except I found out by accident one day that OneDrive was very useful for storing my GlucoseOne database (GlucoseOne requires regedit to change the path). Thus no matter where I am, what machine I am on, my database is available whenever I am online. Then I started to add PDF manuals to OneDrive. Then adding those little utility installs. Works like a home server without using your electricity to run one. Just use Microsoft's electricity instead.

ADDED: I could do the same thing by carrying around a flash drive I guess. Although iOS doesn't like flash drives too well. Apple thinks if you want more memory, buy Apple memory.

 

[Punk In Drublic]

OneDrive, that made me think there may be another factor as to what is set On or Off by default in Win 10, if you use the MS account or not. I choose not to use the MS account, during setup I use the Offline Account option. I didn't fill out who I am or where I live, didn't give any email or phone number. Going that route you don't have the MS Cloud "OneDrive" activated, I don't want it. I also don't want a lot of the other crap like any Sync, Find my device, Linked cell phone, My Location and most importantly Cortana! In our laptops I disable the camera's and microphones and put tape over them. I take tape bend one end over to stick to itself to make a little pull tab and use tape on my cell phone too, if I want to use the camera I pull the tape off, take the pic and put the tape back on. I like my privacy, well as much of it as I can keep anyways, I refuse to make it easy for them.

All of that and they can still tell when you are online watching PewDiePie videos.

I use OneDrive, among other cloud services. Doesn’t really bother me that my e-juice recipes are stored in the same cloud service as what your financial institutions use. And yes, pictures of my cat could be on the same partition as your last tax statement….whether you like that or not.

As much as I applaud your efforts in securing your privacy, I have to ask, what measures do you take to ensure your privacy is secure with other services? Can you ensure the pizza restaurant you ordered online from the other week is not selling your private information, or dealing with a security breach? Even if your credit information has been encrypted, it does not take much for a somewhat intelligent thief to social engineer their way into your digital life.

I’ve worked in cyber security. Social Engineering is a serious problem and one that does not discriminate on what cloud services you use or do not use, or operating system. If you are connected to the internet, or use any kind of digital service (which is impossible these days), you are a potential target. As I typed this post, your financial institution has probably received a good 100+ attacks. Only takes one to get through.

 

[TrollDragon]

watching PewDiePie videos

That thing needs to be cleansed with fire...

 

[Punk In Drublic]

Updating an OS is a major PIA. But it can be managed so it is not so intrusive. Since it’s introduction in 2015, Win 10 has patched over 1100 vulnerabilities. In comparison for the same time frame, Linux Kernel, OS X and Win 7 all pretty much experienced the same amount of vulnerabilities. Details of said vulnerabilities needs to defined, for they can be anything from DoS, Code Execution or Privilege and or Information Gains. Majority where found without being exploited, some where discovered via exploitation (none in Win 10). Personally, I would rather deal with a PIA update, than deal with the snot nosed kid down the street practicing his new hacker skills on my wireless network trying to exploit a known vulnerability.

 

[awsum140]

I feel that the fewer bread crumbs I leave around the lower the likelihood of me having a problem. All of my local purchases, gas, groceries, pizza and so on, are cash and I only use the ATM at my local bank branch. I do shop online but only use one credit card and it has been used nefariously but each time the CC company has caught it and sent me an email asking if I made a purchase of something somewhere. Every time the charge has been eliminated and they send a new card. That hasn't happened in over two years now. I also check the statement, carefully, each month and watch for bogus charges, like $1.00 from someplace I've never heard of, in case someone is testing to see if the data they have will work. I only watch videos on YouTube, no account. I'm not a "twit" and don't use any of the other "popular" social platforms, they're all, basically, sewers anyway. My email is on a secured server that offers encryption if I want it as well and I use a VPN when on the internet to make it a little harder for tracking to be worthwhile.

In the mean time almost every one of my wife's co-workers, all heavy social media users and online banking and shopping fans, have been hacked pretty badly and it's cost some of them thousands not to mention the disaster of recovering from it. If you sew a million seeds you're bound to reap one potato. I severely limit the number of seeds I sew.

In terms of the "cloud", what happens when the sun comes out and the cloud evaporates? Then add in how many people can see that cloud. I keep my data to myself on local drives and local backups. Drives are cheap so having enough isn't much of a problem, at leasts compared to ten years ago plus I don't need an internet connection, another security problem, to retrieve that data.

All that said, I also know it's impossible in our connected world to stay completely off the radar. I just want to have the radar signature of a B1 bomber. The thing that bothers the heck out of me is that commercial services, banks, credit card companies, insurance companies, doctors, hospital, and the list goes on for paragraphs worth, can get breached and either announce it months or years after the fact or not even report it at all. Some of them don't even have rudimentary security or don't bother to keep it up to date since that costs money. They all do assure us that the security of our account information is their "highest" priority. I guess they take their cues from politicians.

 

[CMD-Ky]

I wish that I had the background to understand your post. I have used Linux and contemplated using it full time but there are a few programs that have no Linux equivalent. My "solution", born of utter ignorance, is to allow Win 10 to do its updating thing unimpeded by me. I avoid Google to the extent possible. I have an anti-virus and have no rationale for choosing the one that I did. I have rented a VPN for a fairly reasonable yearly fee. I back the system daily, saving a weeks worth, so that if things go awry I can restore the system to my last daily pretty easily. For me in my unknowing, it seems a crap shoot and I hope for the best.

Updating an OS is a major PIA. But it can be managed so it is not so intrusive. Since it’s introduction in 2015, Win 10 has patched over 1100 vulnerabilities. In comparison for the same time frame, Linux Kernel, OS X and Win 7 all pretty much experienced the same amount of vulnerabilities. Details of said vulnerabilities needs to defined, for they can be anything from DoS, Code Execution or Privilege and or Information Gains. Majority where found without being exploited, some where discovered via exploitation (none in Win 10). Personally, I would rather deal with a PIA update, than deal with the snot nosed kid down the street practicing his new hacker skills on my wireless network trying to exploit a known vulnerability.

 

[BillW50]

All of that and they can still tell when you are online watching PewDiePie videos.

I use OneDrive, among other cloud services. Doesn’t really bother me that my e-juice recipes are stored in the same cloud service as what your financial institutions use. And yes, pictures of my cat could be on the same partition as your last tax statement….whether you like that or not.

As much as I applaud your efforts in securing your privacy, I have to ask, what measures do you take to ensure your privacy is secure with other services? Can you ensure the pizza restaurant you ordered online from the other week is not selling your private information, or dealing with a security breach? Even if your credit information has been encrypted, it does not take much for a somewhat intelligent thief to social engineer their way into your digital life.

I’ve worked in cyber security. Social Engineering is a serious problem and one that does not discriminate on what cloud services you use or do not use, or operating system. If you are connected to the internet, or use any kind of digital service (which is impossible these days), you are a potential target. As I typed this post, your financial institution has probably received a good 100+ attacks. Only takes one to get through.

Oh... I think you meant this reply more so with SlickWilly. I wanted nothing in the cloud and I fought as hard as I could to keep things out of there. But it did no good. Google, Microsoft, Apple, etc. collects whenever they can get and stores it in their cloud. And once one gets something, it seems like everyone also gets it. They must be part of some sort of some huge data sharing community.

Once in the 90's, Microsoft had a patch to fix something. I forget what it was, but I really wanted it. And to get it, you had to setup a Microsoft account. And two things I couldn't leave blank was my name and zipcode. So I thought fine, they could have that. That isn't much to go on. The next screen totally blew me away. It showed are you this Bill, who lives at... and is this your phone number... and you work at... during the hours of... and your boss' name is... and his phone number is..., and you prefer Coke over Pepsi, etc.

GEEZ! This is back when the Internet was still young and browsers wasn't even around yet. And wow was there a HUGE backlash from customers over this. And today I think the same thing is going on, but they no longer tell you what they know about you anymore. So it won't freak you out.

 

[BillW50]

All of that and they can still tell when you are online watching PewDiePie videos.

That thing needs to be cleansed with fire...

What is funnier... I don't know what PewDiePie videos are and I am still laughing.

 

[Punk In Drublic]

I wish that I had the background to understand your post. I have used Linux and contemplated using it full time but there are a few programs that have no Linux equivalent. My "solution", born of utter ignorance, is to allow Win 10 to do its updating thing unimpeded by me. I avoid Google to the extent possible. I have an anti-virus and have no rationale for choosing the one that I did. I have rented a VPN for a fairly reasonable yearly fee. I back the system daily, saving a weeks worth, so that if things go awry I can restore the system to my last daily pretty easily. For me in my unknowing, it seems a crap shoot and I hope for the best.

No operating system is void of vulnerabilities. It’s impossible! Vulnerabilities are not necessary malware, and not all malware has a working virus definition to prevent an exploit or infection. A vulnerability could be an information gain, such as allowing critical information to be read by a remote host such as a web server.

The Spectre and Meltdown vulnerability exploited how the Intel x86 architect, which almost every modern computer uses, stored critical information. With the right tools this information could be accessed leaving the device open to being compromised. Fortunately for us, the smart people at Google found these 2 vulnerabilities through security testing – but this security flaw was present dating back to the early 2000’s. That’s pretty f’n serious. This is just an extreme example of a vulnerability, and one that demonstrates that virus software would have no effect on preventing.

Within a large financial institution, I gave a pretty brave demonstration on compromising a computer through the use of Bluetooth just by using a cell phone…NOT a smart phone. I gained access through a BT headset. I could have easily planted a key logger, gaining all kinds of information to which no virus checker would have ever found. I sent the company into a frenzy, and almost lost my job. But instead they used my exploit to help patch systems and employ stricter security practices.

Hackers are also not always after financial gain, but the thrill of compromising another computer that could allow the potential for serious damage. If you are connected to the interwebz, it is good practice to keep your operating system up to date. Regardless if you Google or not

 

[TrollDragon]

I remember back in the day reading an article by Steve Gibson (SpinRite HD repair software) about having his site knocked offline for 2 weeks (DDos attack) by a 13 year old kid with 500 machines under his control.

We used to have a little fun back when 95 and NT were commonplace using WinNuke to blue screen a few choice sales people during the middle of a big sale entry.

We were just lowly IT grunts in their eyes.

 

[SlickWilly]

All of that and they can still tell when you are online watching PewDiePie videos.

I use OneDrive, among other cloud services. Doesn’t really bother me that my e-juice recipes are stored in the same cloud service as what your financial institutions use. And yes, pictures of my cat could be on the same partition as your last tax statement….whether you like that or not.

As much as I applaud your efforts in securing your privacy, I have to ask, what measures do you take to ensure your privacy is secure with other services? Can you ensure the pizza restaurant you ordered online from the other week is not selling your private information, or dealing with a security breach? Even if your credit information has been encrypted, it does not take much for a somewhat intelligent thief to social engineer their way into your digital life.

I’ve worked in cyber security. Social Engineering is a serious problem and one that does not discriminate on what cloud services you use or do not use, or operating system. If you are connected to the internet, or use any kind of digital service (which is impossible these days), you are a potential target. As I typed this post, your financial institution has probably received a good 100+ attacks. Only takes one to get through.

Oh I agree, there is no hiding from big brother. Hell they can follow you anywhere you go with satellites now, even heard talk which may or not be true but it wouldn't surprise me if it is, via satellites they can tell what room people are in while inside your own house. Go to any big city now and they can follow you where ever you go with all the camera's that are everywhere. Next time your in a city look up, way up high on poles there are camera's everywhere and they have facial recognition run with AI. Those scenes in the Jason Bourne movies where there is a room full of monitors and people who follow Bourne's every move while on the run, bet you .... that's close to the truth. Think a VPN hides you from the gov? Nope! Bill Binney said they can just trace through packets, if you don't know who Binney is watch the movie below, A Good American.

I know I can't hide from "them" and it pisses me off, it is illegal for our gov to spy on us without a warrant but they do it anyway. Like I said, I'll do what ever I can to make it harder for them.

​