Hacker News Reader

Comment by nopcode | Hacker News Reader

I preconfigure all windows machines in my family, and take away their local admin rights. No crapware installs, no disabling of updates or defender. No microsoft accounts.

They get firefox browser with adblocker preinstalled. I manage their important passwords (eg fastmail) and trained them to rely on firefox sync for the recoverable accounts.

I use MeshCentral for remote administration (amt)… its amazing for the price (free).

OPNsense firewall in all the homes. Unknown devices are isolated and egress over wireguard VPN.

View on HN

You may be surprised to learn that removing admin rights is no longer (and never really did) protect against app installs. Many developers have figured out they can just install into the user’s profile.

Only apps that truly need admin rights (that install services, etc.) would be blocked. Everything else is wide open.

The admin rights restriction on app installs was almost just a convention that people followed. Now that the app incentives have changed (malicious apps don’t try to take over the machine anymore, they just try to steal your data), admin rights restrictions are becoming irrelevant.

Not OP, but I'm surprised. So thank you.

Note however this is only partially true for single user devices, where lack of admin rights does prevent some attacker persistence, and is not at all true for multi user devices e.g. the shared family PC.

I’m not following which part you’re saying is untrue. The number of users on the machine is irrelevant as each user can install apps into their own user profile. Maybe they won’t have access to the other users’ data, but it’s enough to gain a foothold.

Persistence is easy enough with startup shortcuts or scheduled tasks in each profile.

Also, I’m not saying these apps have some kind of hidden malware, I’m saying they are operating as designed, and usually offer features in exchange for letting them do things like upload your address book, etc.

a physical jail cell and a faraday cage and you'll only need to tighten the chains a little more!

Two of the four homes already have a faraday cage :)

It was built by a german chemicals company and the reinforced concrete blocks signals.

I rented a place where the walls were lined with chicken wire. They used it to hold the plaster to the lath. I ended up needing to run a POE wifi AP to each room.

When I moved out I told the landlord that he should use it as a selling point, as some people in the area had just tried (and failed) to sue the library for not respecting their wifi allergy.

this got me rolling on the floor,lol.

Firefox Sync is great for this. It's essentially a password manager, and if you install it on Android, you can use it as the default login information autofill app.

    > No microsoft accounts.

Good look with that from now on.

"good luck" you mean?

I'm asking because I do exactly the same: no admin accounts for my family on their own Windows machine (mother in law and wife etc.).

They're also using only local account. Is Microsoft banning local accounts?

Yes, they're removing local accounts. At least in Windows Home.

A Microsoft account and an internet connection will be required to use Windows.

Reply on news.ycombinator.com