Windows 10 Enterprise ignores various privacy settings

Re:Windows 10 Enterprise ignores various privacy settings by viraptor on Sunday May 21, 2017 @07:31PM (#14389849)

I'm curious what was the biggest issue with whitelisting. Was it about making sure services work, or about standard users' daily work? Did you try to comply on everything, or just have a PCI compliant zone?

Also, do you remember what was the specific reason for failing the audit? This all sounds interesting since you've gone though that experience.

[ Parent | on HN ]

Re:Windows 10 Enterprise ignores various privacy settings by proactivesvcs on Sunday May 21, 2017 @07:54PM (#14389957)

Some of this stuff goes via CDNs. Once you start blocking those, a lot of collateral damage will turn up at unexpected times as providers switch CDNs.

[ Parent | on HN ]

Re:Windows 10 Enterprise ignores various privacy settings by viraptor on Sunday May 21, 2017 @08:06PM (#14390003)

All of the first-party connections seem to have proper DNS names, even on CDN (microsoft.com, microsoft.com.akadns.net). The ad networks are obvious third party that could be dropped. I mean, there could be more stuff I didn't see, but from the screenshots, dns blackholing seems viable.

[ Parent | on HN ]

Re:Windows 10 Enterprise ignores various privacy settings by sathackr on Sunday May 21, 2017 @08:30PM (#14390111)

DNS blackholing is playing whack-a-mole. I can blackhole scontent.xx.fbcdn.net today, and I have no assurance or confidence that they won't use scontent.xx.fbcdn2.net tomorrow.

DNS/FW whitelist is the only way to have even a little confidence that egress is controlled at this point.

[ Parent | on HN ]

Re:Windows 10 Enterprise ignores various privacy settings by viraptor on Sunday May 21, 2017 @09:18PM (#14390291)

I meant blackholing as a technique. It can be either a blacklist or a whitelist, and yeah... whitelist seems more secure here

[ Parent | on HN ]