Mirrors/mr-r3b00t-go-darker
1
0
Fork 0
mirror of https://github.com/mr-r3b00t/go_darker synced 2026-08-07 04:33:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
Daniel Card
2026-07-04 22:03:32 +01:00
committed by GitHub
parent 2303aebf81
commit 8a1e5b056a
2 changed files with 115 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Manage-BrowserPrivacy.ps1
+74 -10
View File
@@ -39,6 +39,7 @@ param(
[switch]$DisableAll,
[switch]$EnableAll,
[switch]$IncludeAll,
[switch]$IncludeSecurity, # also disable [SEC] URL-check features in bulk actions
[string]$Csv
)
@@ -122,7 +123,8 @@ function New-PolicyControl {
param(
[string]$Name, [string]$Browser, [string]$PolicyPath,
[string]$ValueName, [int]$OnValue, [int]$OffValue,
[string]$Note = ''
[string]$Note = '',
[switch]$Security # marks a control whose "Disabled" state REDUCES protection
)
[pscustomobject]@{
Type = 'Reg'
@@ -133,6 +135,7 @@ function New-PolicyControl {
ValueName = $ValueName
OnValue = $OnValue
OffValue = $OffValue
Security = [bool]$Security
AdminReq = $true
}
}
@@ -216,6 +219,23 @@ function Get-Controls {
-ValueName 'NetworkPredictionOptions' -OnValue 0 -OffValue 2 `
-Note '0=predict always 2=never') )
# --- Edge SmartScreen: URL / site / download reputation (SECURITY) ---
[void]$c.Add( (New-PolicyControl -Name 'SmartScreen (URL/site check)' -Browser Edge -PolicyPath $edge `
-ValueName 'SmartScreenEnabled' -OnValue 1 -OffValue 0 -Security `
-Note 'SECURITY: checks visited URLs/downloads against Microsoft reputation') )
[void]$c.Add( (New-PolicyControl -Name 'SmartScreen PUA blocking' -Browser Edge -PolicyPath $edge `
-ValueName 'SmartScreenPuaEnabled' -OnValue 1 -OffValue 0 -Security `
-Note 'SECURITY: blocks potentially unwanted apps') )
[void]$c.Add( (New-PolicyControl -Name 'SmartScreen DNS lookups' -Browser Edge -PolicyPath $edge `
-ValueName 'SmartScreenDnsRequestsEnabled' -OnValue 1 -OffValue 0 -Security `
-Note 'SECURITY: DNS-based site reputation lookups') )
[void]$c.Add( (New-PolicyControl -Name 'Typosquatting Checker' -Browser Edge -PolicyPath $edge `
-ValueName 'TyposquattingCheckerEnabled' -OnValue 1 -OffValue 0 -Security `
-Note 'SECURITY: warns on lookalike/typo domains') )
# =========================== Google Chrome ============================
[void]$c.Add( (New-PolicyControl -Name 'Metrics Reporting (UMA)' -Browser Chrome -PolicyPath $chr `
-ValueName 'MetricsReportingEnabled' -OnValue 1 -OffValue 0 `
@@ -229,6 +249,10 @@ function Get-Controls {
-ValueName 'SafeBrowsingExtendedReportingEnabled' -OnValue 1 -OffValue 0 `
-Note 'Extra page/system data to Google; SB itself stays on') )
[void]$c.Add( (New-PolicyControl -Name 'Safe Browsing (URL check)' -Browser Chrome -PolicyPath $chr `
-ValueName 'SafeBrowsingProtectionLevel' -OnValue 1 -OffValue 0 -Security `
-Note 'SECURITY: 0=off 1=standard 2=enhanced. Off stops URL reputation checks') )
[void]$c.Add( (New-PolicyControl -Name 'URL-keyed Data Collection' -Browser Chrome -PolicyPath $chr `
-ValueName 'UrlKeyedAnonymizedDataCollectionEnabled' -OnValue 1 -OffValue 0 `
-Note 'URLs of visited pages sent to Google') )
@@ -300,6 +324,10 @@ function Get-Controls {
-ValueName 'SearchSuggestEnabled' -OnValue 1 -OffValue 0 `
-Note 'Chromium policy honoured by Brave') )
[void]$c.Add( (New-PolicyControl -Name 'Safe Browsing (URL check)' -Browser Brave -PolicyPath $brv `
-ValueName 'SafeBrowsingProtectionLevel' -OnValue 1 -OffValue 0 -Security `
-Note 'SECURITY: 0=off 1=standard 2=enhanced. Off stops URL reputation checks') )
# Filter to installed browsers unless -IncludeAll
if ($IncludeAll) { return $c }
$filtered = New-Object System.Collections.ArrayList
@@ -338,26 +366,35 @@ function Show-Status {
Write-Host (' Browsers: {0}' -f ($det -join ', ')) -ForegroundColor DarkCyan
Write-Host ' Enabled = collecting/on Disabled = hardened/off' -ForegroundColor DarkCyan
Write-Host '==================================================================' -ForegroundColor Cyan
Write-Host ('{0,-4}{1,-32}{2,-10}{3}' -f '#', 'Setting', 'Browser', 'State') -ForegroundColor White
Write-Host ('{0,-4}{1,-32}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray
Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '#', 'Setting', 'Browser', 'State') -ForegroundColor White
Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray
$i = 0
$nEnabled = 0; $nDisabled = 0
$nEnabled = 0; $nDisabled = 0; $nSecOff = 0
foreach ($ctrl in $Controls) {
$i++
$state = Get-ControlState -Ctrl $ctrl
if ($state -like 'Enabled*') { $nEnabled++ }
elseif ($state -like 'Disabled*') { $nDisabled++ }
$sec = ''
if ($ctrl.Security) {
$sec = ' [SEC]'
if ($state -like 'Disabled*') { $nSecOff++ }
}
$lock = ''
if ($ctrl.AdminReq -and -not $Script:IsAdmin) { $lock = ' *' }
$flag = ''
if (-not $Script:Browsers[$ctrl.Category].Installed) { $flag = ' (not installed)' }
$line = ('{0,-4}{1,-32}{2,-10}' -f $i, $ctrl.Name, $ctrl.Category)
$line = ('{0,-4}{1,-36}{2,-10}' -f $i, ($ctrl.Name + $sec), $ctrl.Category)
Write-Host $line -NoNewline
Write-Host ($state + $lock + $flag) -ForegroundColor (Get-StateColor $state)
}
Write-Host ('{0,-4}{1,-32}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray
Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray
Write-Host (' Summary: {0} enabled, {1} disabled' -f $nEnabled, $nDisabled) -ForegroundColor White
Write-Host ' [SEC] = anti-malware URL/site check. Disabling REDUCES protection' -ForegroundColor DarkYellow
if ($nSecOff -gt 0) {
Write-Host (' WARNING: {0} security URL-check feature(s) are currently OFF' -f $nSecOff) -ForegroundColor Red
}
Write-Host ' Policies apply on next browser start. While hardened, browsers' -ForegroundColor DarkCyan
Write-Host ' show a "managed" notice on settings pages - that is expected.' -ForegroundColor DarkCyan
if (-not $Script:IsAdmin) {
@@ -403,11 +440,26 @@ function Invoke-ControlAction {
}
function Invoke-AllAction {
param($Controls, [ValidateSet('Enable','Disable')][string]$Action)
param(
$Controls,
[ValidateSet('Enable','Disable')][string]$Action,
[switch]$WithSecurity # when disabling, also include [SEC] URL-check features
)
$verb = if ($Action -eq 'Enable') { 'ENABLE (restore browser defaults)' } else { 'DISABLE (harden)' }
Write-Host ''
Write-Host ("Applying {0} to ALL items..." -f $verb) -ForegroundColor Cyan
foreach ($ctrl in $Controls) { Invoke-ControlAction -Ctrl $ctrl -Action $Action }
$skippedSec = 0
foreach ($ctrl in $Controls) {
# Never auto-disable anti-malware URL checks in bulk unless explicitly requested.
if ($Action -eq 'Disable' -and $ctrl.Security -and -not $WithSecurity) {
$skippedSec++
continue
}
Invoke-ControlAction -Ctrl $ctrl -Action $Action
}
if ($skippedSec -gt 0) {
Write-Host (' Kept {0} [SEC] URL-check feature(s) ON (use -IncludeSecurity / menu "S" to disable).' -f $skippedSec) -ForegroundColor DarkYellow
}
Write-Host ''
Write-Host 'Restart the affected browsers for policies to take effect.' -ForegroundColor Cyan
Write-Host ''
@@ -424,8 +476,9 @@ function Start-Menu {
Write-Host ' <n> toggle item n (Enable<->Disable)'
Write-Host ' e <n> enable item n'
Write-Host ' d <n> disable item n'
Write-Host ' D disable ALL (harden)'
Write-Host ' D disable ALL (harden; keeps [SEC] URL checks ON)'
Write-Host ' E enable ALL (restore browser defaults)'
Write-Host ' S disable ALL [SEC] URL-check features (reduces security)'
Write-Host ' b <name> apply D to one browser (e.g. b Edge)'
Write-Host ' r refresh view'
Write-Host ' c <path> export status to CSV'
@@ -451,6 +504,17 @@ function Start-Menu {
}
Read-Host 'Press Enter'; continue
}
'^S$' {
$secList = @($Controls | Where-Object { $_.Security })
Write-Host ''
Write-Host 'WARNING: This turns OFF anti-malware URL/site reputation checks' -ForegroundColor Red
Write-Host ('(SmartScreen / Safe Browsing) for {0} item(s). Your browser will' -f $secList.Count) -ForegroundColor Red
Write-Host 'no longer warn about known malicious or phishing sites.' -ForegroundColor Red
if ((Read-Host 'Proceed? type DISABLE-SECURITY') -ceq 'DISABLE-SECURITY') {
Invoke-AllAction -Controls $secList -Action Disable -WithSecurity
}
Read-Host 'Press Enter'; continue
}
'^[Bb]\s+(\w+)$' {
$target = $Matches[1]
$subset = @($Controls | Where-Object { $_.Category -eq $target })
@@ -504,7 +568,7 @@ if (@($controls).Count -eq 0) {
}
if ($DisableAll) {
Invoke-AllAction -Controls $controls -Action Disable
Invoke-AllAction -Controls $controls -Action Disable -WithSecurity:$IncludeSecurity
Show-Status -Controls $controls
if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv }
return
README.md
+41 -4
View File
@@ -161,10 +161,44 @@ registration); only installed ones are shown unless you pass `-IncludeAll`.
# Export status to CSV / include browsers that are not installed
.\Manage-BrowserPrivacy.ps1 -Csv .\browser-status.csv
.\Manage-BrowserPrivacy.ps1 -Report -IncludeAll
# Harden everything AND turn off the malicious-URL checks (see warning below)
.\Manage-BrowserPrivacy.ps1 -DisableAll -IncludeSecurity
```
The menu supports the same commands as the Windows tool, plus
`b <browser>` to harden a single browser at once (e.g. `b Edge`).
`b <browser>` to harden a single browser at once (e.g. `b Edge`), and
`S` to disable the malicious-URL checks (see below).
## Safe Browsing / SmartScreen (URL reputation) - read this
Some controls check the **domain / IP / URL** you visit against a cloud
reputation service (Microsoft SmartScreen for Edge, Google Safe Browsing for
Chrome/Brave). These are **security** features - they warn you off phishing
and malware sites - but they work by sending URL/host data off the machine,
so they are also a privacy consideration. They are marked **`[SEC]`** in the
status view.
Because turning them off *reduces protection*, they are handled separately:
- **`-DisableAll` and the menu `D` command leave `[SEC]` items ON.** Bulk
hardening will not silently disable your malware protection.
- To disable them you must be explicit:
- CLI: `-DisableAll -IncludeSecurity`
- Menu: the dedicated **`S`** command (requires typing
`DISABLE-SECURITY` to confirm)
- Or toggle the individual numbered item (that is always a deliberate act)
- The status view prints a red **WARNING** line whenever any `[SEC]` feature
is currently OFF, so a hardened-too-far machine is obvious at a glance.
`[SEC]` controls covered: Edge SmartScreen (site/URL check, PUA blocking, DNS
reputation lookups, typosquatting checker); Chrome & Brave Safe Browsing
protection level (`0` = off, disables URL reputation checks entirely).
> Recommendation: leave these ON unless you have a specific reason (e.g. you
> route all traffic through a separate filtering DNS/proxy that already does
> this). They are the browser's main defence against phishing and drive-by
> malware.
## How it works
@@ -191,11 +225,13 @@ Two things to expect:
| **Chrome** | Metrics reporting (UMA), search suggestions, Safe Browsing extended reporting, URL-keyed data collection, cloud spell check, alternate error pages, network prediction, feedback surveys, Privacy Sandbox (prompt, Ad Topics, site-suggested ads, ad measurement) |
| **Firefox** | Telemetry, Firefox Studies (Shield), Default Browser Agent (daily Mozilla ping), Pocket |
| **Brave** | Rewards, Wallet, VPN, Tor windows, search suggestions (Chromium policy) |
| **`[SEC]` URL checks** | Edge SmartScreen (site/URL, PUA, DNS lookups, typosquatting); Chrome & Brave Safe Browsing protection level |
Notes:
- Chrome's Safe Browsing itself is left ON; only the *extended reporting*
(extra data to Google) is hardened.
- Under `-DisableAll`, Safe Browsing / SmartScreen stay ON; only the
*extended reporting* (extra data to Google) is hardened by default. Full
URL-check disabling requires `-IncludeSecurity` or the menu `S` command.
- The three Chrome Privacy Sandbox ad policies require the Privacy Sandbox
prompt policy to be Disabled as well - the tool includes it.
- Brave sends comparatively little telemetry by default; its entries harden
@@ -206,7 +242,8 @@ Notes:
## CSV output columns
`Name, Browser, Installed, Policy, State, Note`
`Name, Browser, Installed, Policy, State, Note` ([SEC] items are named as
such in the `Name` column).
---