Alternatives to using a Personal Firewall

B. Nice · 2006-06-06T17:13:22+00:00

Well knowing that it is impossible to state a one-for-all solutionhere is some input on how to start getting along in a home windowsenvironment without running a personal firewall.It is certainly not complete, but feel free to add Your tricks to thelist.Note also that:1. The right things to do in the end depends on Your environment,habits and behaviour.and2. There is no such thing as full security on the internet. Your levelof security is something You come to a balance with, the key wordbeing trust.Okay, here we go:1. If possible put an NAT router/firewall device between Yourinternet-connection and Your PC.It does filter out a lot of network traffic that is just pure noise,and it does provide a decent level of protection from "intrusionattempts" from the outside.If You are willing to invest a little money in security this is one ofthe best ways to do it.2. Disable unnescessary servicesIf directly connected to the internet, this part is *crucial*. If behind a NAT router as suggested in point 1 however, this is lessimportant as long as Your router does not forward any traffic.The ideal would be of course if You can end up having no open ports atall. A PC configured like that can be directly connected to theinternet just as safely as if You were using a personal firewall - andbest of all, without all the noise from firewall pop-ups :-)If You have a simple setup (like a stand-alone PC connected to theinternet, without any special requirements other than normal surfingand mailing around) there are pretty straight-forward step-by-stepguides available that can help You close all open ports on Yourmachine depending on the windows version You are running. Remember tocheck that Your ports actually are closed (the guide will probablytell You how to do that).Otherwise search the internet for ways to close ports You don't need.(It's a good idea to write down which services You disable and how Youdo it. You might find that You need to reopen them again at a latertime). Figuring...

B

B. Nice 20 years ago

I'm allways a little puzzled over statements like "without permission". Most home users are running their machines with administrative rights, which means they permit programs they run to do _everything_: They permit it to mess up anything from their registry to their system and personal files. But after the rise of PFW's, doing networking stuff has become some kind of de facto special case. I don't really get that, but that was a sidestep :-)

Back to the issue: Surely, I agree that with something like the Genuine Advantage Notification MS is really stretching it, and I don't defend that. But to relate it to the topic, I have a question for You: How many users do You believe actually have succeeded in preventing it from phoning home with the sole help from their PFW?. Did You succeed?

I am not sure I get Your point. Please clarify what kind of risk You are thinking of that would sacrifice Your livelihood.

/B. Nice

Vote

Z

zzy 20 years ago

I have no idea how many users have prevented it. I've used ZoneAlarm and Outpost. With ZoneAlarm it's simple; Outpost is more obtuse. I initially set ZoneAlarm to tell me when it was trying to access the Internet, and the message to that effect popped up every time I booted. I got tired of manually denying access each time, so I changed its permissions to permanent denial -- I enable it only when I want to update my Windows OS. So yes, I succeeded.

But interestingly, I just did another Windows update, and it installed a new version of Windows Genuine Advantage Notification. ZoneAlarm doesn't detect it trying to contact the Internet, and I don't see any sign of it with Port Explorer (which I'm just learning to use). So if it is still "phoning home", it's now under the radar and not where I've been able to detect it.

My point is that if I were like you in that I wouldn't allow any software on my system whose vendor I don't trust with my privacy, I wouldn't allow any Microsoft software on my system, because I certainly don't trust Microsoft with my privacy. Particularly, I wouldn't allow the Visual Basic compiler, which "phones home" every time I compile my program. I currently make most of my living selling a program largely written in VB, which requires support, modification, and the development of new versions. If I removed the VB compiler because of privacy issues, it would perhaps be noble. But it would be stupid.

Vote

D

Duane Arnold 20 years ago

What are you talking about? And you know this for a fact. How?

Duane :)

Vote

V

Volker Birk 20 years ago

This is how root kits usually work. And Zone Alarm will not detect any malware, too, which wants to phone home. And no other "Personal Firewall" ever will do so reliably, because it's impossible already in theory. Now, if someone will create a provision to detect this special version again, then a simple code update will do to prevent thereupon.

What Microsoft created with WGAN is very near to a root kit. They did the same thing Sony did lately. And I'm wondering, why they're not getting hit for that - perhaps, because their lawyers have the better concept. And because, it's clear that their customers have to bite the bullet, or they cannot use Windows again at all.

You're describing the monopoly problem here.

Yours, VB.

Vote

D

Duane Arnold 20 years ago

The whole thing is ridiculous. At best, the VB complier wants network access for possible assemblies that it may need to access that may be on another machine on the LAN. The software may have some kind of TCP software in it that will make it check for a network connection.

The PFW with application control is probably too stupid to know the difference and flags anything trying to use TCP in a LAN or WAN situation and just flags it.

Duane :)

Vote