Question What would be the best privacy-focused Windows 10 solution ? (Or the best PCVR linux distro ?)

[MLG-443]

Hi,

First and foremost, I've been considering a wide variety of options for an operating system with the following priorities in mind:

1- Privacy: At the risk of sounding paranoid, the geopolitical state of MANY "democratic" countries and just the world in general is very concerning to me and thus my desire for privacy extends far beyond the mere avoidance to be tracked for advertisement purposes. I trust no institution to keep any potentially personally identifyable data about me from unscrupulous or malevolent actors whether they are government officials or brainwashed private citizens seeking to doxx and harm me over ideological differences or any other reason really . While this is so far a VERY unlikely scenario, it is something that should be addressed long before the first real signs of such a possibility become manifest. In any case, just insert right here which argument you find most compelling for ultimate privacy.

2- Compatibility and troubleshooting (mostly for gaming, streaming and more communal/social creations): I've been privately thinking about this for many years and now I should probably start committing to the bit and here's why this point matters: The really obvious answer to the first point (privacy) is a well supported Linux distro. The main issue with this becomes just how crippled will I be having to make everything work including streaming gear, software, Virtual Reality gear and VR game, artistic tools, etc.
I have had very little experience with linux and that was mostly with a remote server`s command line and tools using some "X window" thing to make windows outside of the command line appear. I have next to zero experience with a linux distro being my own desktop's OS (tried Linux Mint for a week-end). It also looks like the troubles with making VR equipments and VR games (e.g. VRchat just to name one) will be particularly daunting. I *think* it will be completely impractical to use a linux OS for that reason but I am opened to be convinced otherwise as I really like the general concept of linux and the idea of using it. I just think I'm probably screwing myself if I adopt it and waste weeks on end trying to solve what I expect to be a copious amount of problems with every new thing I will be compelled to delve into. My time will be even more precious than it is now and I think I can't afford it.

3- Perfomance: An obvious one but a distant third as far as I'm concerned. I'm okay with losing 5-ish percent of my computer's performance but I can't be left in the dust with intolerable lag spikes just not working (point #2).

4- Cyber-security: I know the best cyber-security often is human skepticism and good browsing practices. I don't fool around and am not a gullible idiot online who downloads and run anything it finds off the web but I am human and technically, mistakes *can* happen so this priority #4 is a nice-to-have just in case of a once-in-a-blue moon foul up... or in case I happen to fall victim to any of those scary 0-click exploits (or whatever they are called for when no human stupidity is required).

This has led me to consider the following options:

1. A gaming-oriented fixed-update (LTS) linux distro with a good deal of support and help online + proton and wine. Ideal for priority #1 but likely terrible for #2. Yes, I know. Linux gaming is getting good... but it appears to not be good for VR at all. Am I wrong ?

2. Same kind of linux distro but with a virtual machine running an actual windows installation for what really cannot work under linux w/ proton or wine. This is undermining priority #1 if the windows virtual machine isn't stripped of all its privacy-violating components and apparently having a windows virtual machine can do some of what wine and proton can't but isn't at all a panacea to the shortcomings of option #1.

3. Download and install a custom windows ISO from a "reputable source": Save your breath, the irony of the glaring security flaw of downloading a custom ISO from an unofficial source isn't lost on me at all. However, I am still wondering just how compromized a OS with a well established reputation like Ghost Spectre could be ? This is my least favorite option but I'm not sure I should count it out. Is it really purged of all spying ? If it is, all three priorities are well adressed but again how long is this project going to last ?

4. MAKE my own custom windows 10 ISO with reputable DISM tools like MSMG toolkit or NTlite: This is my favorite one so far but I am really unsure. It requires I give myself a fair bit of trouble upfront but if it all goes right, I can have the ideal system for all three priorities. I understand it requires trusting another piece of software but IIRC MSMG toolkit (for example) is open source and well established and NTlite is basically a state-of-the-art freemium product for this purpose specifically AFAICT.

I did try option #4 with MSMG toolkit and it *seems* to be doing what I wanted it to until windows update appeared to have reinstalled some of the stuff I explicitly disabled/removed.

Can these "DISM tools" get rid of *all* the privacy violations in a windows ISO ?
Do I need to purge windows Update too from my custom ISO ? (thereby compromising security)
Can I do that and then decide to test any software I want to run on it on another computer with proper security first as a safety measure ? Would that be good enough ?
Could Windows Defender be a potential privacy violator ?
Can I manually provide any windows defender security update (without Windows Updates being enabled) ?
What if I mess with the /etc/hosts file in windows to prevent it from communicating with any and all microsoft own or operated server ? Can that be done and will it be reliable ?
Should I even consider windows 11 over windows 10 ???

I am opened to any propositions, argument, corrections to any of my observations and assumptions, and new options if I haven't listed them yet.

Thank you.

 

[DSzymborski]

If 1. is actually a real concern for you, then it's not a matter of finding the right solution for gaming and streaming. It would mean gaming and streaming are over for you. It would also mean that you really can't connect with any websites; your only solution is a completely offline PC.

Engaging in society has always involved some level of assumption of risk. Just because it's privacy data these days more than, say, contracting tuberculosis doesn't mean it's any different.

 

[Ralston18]

Seconding @DSzymborski

And I will ask what do you consider as private data? Your name, address, phone number, family members, relatives, friends, interests, license plates, etc., etc.. are already "out there" in many places: Governments, NGO's, Businesses.

My primary concern is ensuring that my financial accounts are protected.

And I do remain very careful about providing any information about anything to anyone without good reason for doing so. Along with avoiding shady websites and clickbait temptations.

= = = =

As for the four options being considered - well fair enough. But they are not enough.

Overall, the measures/protections that you have in mind are all likely to be an exercise in fultility with little or no beneficial ROI. Even trivial in some ways.

If you are important enough or criminal enough then someone looking to "violate your privacy" will do so. That someone will do so via a subpoena, a warrant and other legal means. Otherwise, someone really looking to "get you" will just maliciously violate your privacy with little or no inhibitions about doing so.

Windows 10/11/ Linux, Defender, custom ISO, etc. generally moot at this point.

Just take the basic precautions along with everyone else, enjoy your games and other online activities.

 

[MLG-443]

If 1. is actually a real concern for you, then it's not a matter of finding the right solution for gaming and streaming. It would mean gaming and streaming are over for you. It would also mean that you really can't connect with any websites; your only solution is a completely offline PC.

Engaging in society has always involved some level of assumption of risk. Just because it's privacy data these days more than, say, contracting tuberculosis doesn't mean it's any different.

I agree but Isolation is not an option. I know some level of risk has to be taken. Moreover priorities #1 and #2 are sort of even I put privacy first but it isn't by much.

 

[COLGeek]

It seems you are concerned about government awareness of your activities. What about your ISP, your accounts on other services (i.e., Google, Apple, etc.), and your banking/credit activity? All of these entities likely know more about you than a typical government entity.

If you have come to the attention of government authorities, then that is another matter altogether and no access protections will suffice. There is no such thing as complete digital anonymity.

This concern and your other stated desires are contradictory.

If you want the things you want, you are going to have to become a digital denizen and no OS/platform is going to hide you completely.

So, what is the major concern here?

 

[DSzymborski]

I agree but Isolation is not an option. I know some level of risk has to be taken. Moreover priorities #1 and #2 are sort of even I put privacy first but it isn't by much.

Then, don't worry about it. If you stream, game, and use the internet, then none of the other options will be worthwhile. You've already figured out the optimal practice for someone who wants to use the internet with some semblance of normality: be skeptical of clicking things, practice good browser safety, and keep your antivirus updated.

Other than that, if the concern is the geopolitical state of democratic countries, then the solution *is* isolation.

 

[MLG-443]

Seconding @DSzymborski

And I will ask what do you consider as private data? Your name, address, phone number, family members, relatives, friends, interests, license plates, etc., etc.. are already "out there" in many places: Governments, NGO's, Businesses.

My primary concern is ensuring that my financial accounts are protected.

And I do remain very careful about providing any information about anything to anyone without good reason for doing so. Along with avoiding shady websites and clickbait temptations.

= = = =

As for the four options being considered - well fair enough. But they are not enough.

Overall, the measures/protections that you have in mind are all likely to be an exercise in fultility with little or no beneficial ROI. Even trivial in some ways.

If you are important enough or criminal enough then someone looking to "violate your privacy" will do so. That someone will do so via a subpoena, a warrant and other legal means. Otherwise, someone really looking to "get you" will just maliciously violate your privacy with little or no inhibitions about doing so.

Windows 10/11/ Linux, Defender, custom ISO, etc. generally moot at this point.

Just take the basic precautions along with everyone else, enjoy your games and other online activities.

I understand warrants and subpoena are a thing but I am not aiming for anything illegal (so far - who knows how twisted the law can become in the future) and I understand privacy cannot (and should not be expected to) be absolute.

Moreover, I am not seeking to make my real personal information as you listed it with "

Your name, address, phone number, family members, relatives, friends, interests, license plates, etc.

" private or unknown to the government for example. I am just seeking to make my future online activities on a specific streaming computer traceable back to my known identity for as few people and institutions as possible and make it as hard as possible.

Edit: Excuse my delayed response. I am having a lot of connectivity troubles with this website particularly and posting have become difficult.

 

[USAFRet]

In the context of human - online activities, your operating system is far down the list of "offenders".

Cell phone, browser, search history, shopping habits, etc, etc.
Alexa, smart bulbs and sockets, Ring doorbell camera, etc, etc.

I've looked into a couple of the off channel cut down Windows 10 'versions'. From what I see, those are less safe and secure than the normal Windows install.
The things that are cut out in the name of "telemetry" can render it quite insecure, and less usable.

 

[35below0]

Not exactly a privacy tool, but Windows Firewall Control adds a layer of defense against telemetry, apps "phoning home", and processes using your internet connection (outgoing/incoming firewall connections) silently.

Any attempt to establish an incoming or outgoing connection will trigger a pop-up window naming the process and asking you what kind of limits to set, including disabling the connection completely for that process.

Windows 10 Firewall Control: Sphinx Software

Windows 10 Firewall Control: simple and exhaustive solution for applications network activity controlling and monitoring. Prevents undesired programs and Windows updates, informational incoming and outgoing leakage of applications running locally or remotely. Provides detailed logging and...

www.sphinx-soft.com

You will have to buy it in order to be able to block/unblock even system processes. The free version does not allow that. It does allow control over non system processes. Translated into human that means you can block programs like Adobe, Gigabyte driver updates, games, the web browser (though that is completely pointless), but most importantly anything suspicious that tries to use the internet connection. You would expect a game to connect online, or Steam, or a browser. But if something tries to connect for no apparent reason, and has an unusual name or it doesn't look like something you installed, you can block it and try to learn what it is and how it got on your PC.
It kind of acts like NoScript for Win 10/11.

I've used the free version for many years and later bought the full version. I'm not paranoid about privacy but i do want something more thorough than Windows Firewall and customizable enough to allow trusted applications to run normally once i have confirmed i actually know what they are and allowed them limited or unlimited access.

It is no magic bullet but it is useful against malware or unwanted rubbish.

 

[hotaru.hino]

There's only one thing that trying to hide your information will do: give you potentially less spam in your mailbox.

If anyone wants to find you, a determined person will. If you don't make yourself an interesting target, then nobody will bother you.

 

[MLG-443]

Alright, do I conclude from all these exchanges that a minimally altered Windows install is the best option and not Linux ?

Is it safe and a good idea to use O&O shutup10++ on it according to you ?
Can I update Windows Defender without relying on Windows Update ?

 

[Unolocogringo]

About the best you can get simply is.
Windows 10
Spybot Anti beacon. Turns off windows telemetry.
Malware bytes premium. Great virus protection With firefox add on it also blockd tracking cookies and ads with tracking cookies.
Firefox with Ghostery add on. Also blocks more tracking cookies.
With safe internet habits some information is still collected for website functionality, but you computer is not a data harvester for others.

 

[USAFRet]

Alright, do I conclude from all these exchanges that a minimally altered Windows install is the best option and not Linux ?

Is it safe and a good idea to use O&O shutup10++ on it according to you ?
Can I update Windows Defender without relying on Windows Update ?

Linux only counts if your desired applications run in Linux.

Windows Defender updates happen literally every day. New security definitions.

 

[MLG-443]

Windows Defender updates happen literally every day. New security definitions.

Okay but can it be done outside of windows update ??! Like how individual updates for earlier versions of the Windows operating system could be manually downloaded as KBXXXXXX.exe or something like that ?

 

[USAFRet]

Okay but can it be done outside of windows update ??! Like how individual updates for earlier versions of the Windows operating system could be manually downloaded as KBXXXXXX.exe or something like that ?

Yes, you can download them manually, via powershell.
https://www.manageengine.com/patch-management/windows-defender-definitions-updates.html

Again, this is a daily thing.

 

[MLG-443]

I don't understand how I missed the existence of the Enterprise LTSC edition !
Any thought on this one ? It seems to be in favor with gamers based on some quick search !

 

[USAFRet]

I don't understand how I missed the existence of the Enterprise LTSC edition !
Any thought on this one ? It seems to be in favor with gamers based on some quick search !

The problem with "Enterprise" is obtaining a valid license.

Generally, that is only available with a Volume Licensing Agreement. Not as a single purchase.