PrivateWin10 -> MajorPrivacy
Added 2023-09-17 09:16:51 +0000 UTCAs you may have noticed, my windows 10 privacy tool PrivateWin10 has not seen much development in the past 2 years. The reasons were many, not only lack of time due to Sandboxie-Plus, but also a couple conceptual issues with the design which can not be fixed without using a driver, as well as the substantially higher amount of fiddling around required to create a advanced UI using XAML in comparison with just Qt widgets.
So, moving forward I’m implementing a successor which will be called MajorPrivacy, a much-needed rebranding given that a private Windows 10 is not enough now we also need a private Windows 11 and soon 12 and so on and so forth…
MajorPrivacy will be like most of my other projects written in C++ and be using Qt Widgets for the user interface, and bring a new driver to add the much-needed kernel features to properly enforce advanced privacy presets.
In addition to the functionality PrivateWin10 offered, the Major will implement own rule-based software restrictions, i.e. the ability to prevent unauthorized or undesired applications from running. It will also bring a folder protection feature allowing to restrict access to confidential data to authorized processes. Its kernel-based process isolation abilities will ensure that the authorized processes cannot be tempered with providing the highest level of protection from other processes, and even a high level of protection from adversarial processes running with administrative or system privileges.
In the initial release a couple minor Priv10 features will not be included, like the filtering DNS proxy, these will be added later. Furthermore, additional new features will be added, a per process DNS filter using a hook dll, proxy injection also the driver will later implement an own firewall engine allowing for more control then is possible by only leveraging the windows firewall rules. The driver’s ability to control and block register accesses will allow to prevent unauthorized alteration of firewall rules and other guarded registry presets.
The UI concept for the Folder Control and Execution Restriction tabs will be analogues to Network Firewall tab in Priv10, a list on the left containing Program Items which can be a single program, service or a group of those, a rule list on the top right and status/logs on the bottom right. The UI will look not as modern as priv10 but will resemble SandMan.exe style wise.
Let me know what other features you would want to see or which priv10 aspects you would like to have changed.
Comments
The per-process file protection reminds me of the demo provided by EaseFilter which does exactly this, however the settings are complicated and not really designed for daily use by average Joe like me.I think the best use case of such tools is protecting important files like ssh keys and disk images, they are rarely accessed by other programmes.
Biscuit
2023-09-24 05:34:46 +0000 UTCWindows has no process level folder isolation, you could run processes under different users and configure folders to be accessible by specific users but that's not handy. There is no convenient built in way to allow one process (like notepad.exe) running under your user account to access your documents and block an other (like for example googles Software_Reporter_Tool.exe) from accessing it, its all or nothing per user. You can use SRP's to block selected applications but as a white list approach this is not convinient, if all you want is a blacklist. Glasswire, seen it, don't like it, and they only offer subscriptions, I don't use subscription based software. Turn on HVCI if you value your security, also afaik you don't need the hole HVCI only the vulnerable driver blacklist which on 11 can be switched separately (on 10 iirc it was an all or nothing switch). Also a lot of perceived threads is corporate spyware like, googles Software_Reporter_Tool.exe, MSFT's telemetry services, etc... they spy on you but don't use common malware techniques so are easy to shut up.
David Xanatos
2023-09-18 05:16:24 +0000 UTC
