From 8a1e5b056ac96dd4a167bea3f3304031cf4b412c Mon Sep 17 00:00:00 2001 From: Daniel Card Date: Sat, 4 Jul 2026 22:03:32 +0100 Subject: [PATCH] Add files via upload --- Manage-BrowserPrivacy.ps1 | 84 ++++++++++++++++++++++++++++++++++----- README.md | 45 +++++++++++++++++++-- 2 files changed, 115 insertions(+), 14 deletions(-) diff --git a/Manage-BrowserPrivacy.ps1 b/Manage-BrowserPrivacy.ps1 index ee97bca..e69e597 100644 --- a/Manage-BrowserPrivacy.ps1 +++ b/Manage-BrowserPrivacy.ps1 @@ -39,6 +39,7 @@ param( [switch]$DisableAll, [switch]$EnableAll, [switch]$IncludeAll, + [switch]$IncludeSecurity, # also disable [SEC] URL-check features in bulk actions [string]$Csv ) @@ -122,7 +123,8 @@ function New-PolicyControl { param( [string]$Name, [string]$Browser, [string]$PolicyPath, [string]$ValueName, [int]$OnValue, [int]$OffValue, - [string]$Note = '' + [string]$Note = '', + [switch]$Security # marks a control whose "Disabled" state REDUCES protection ) [pscustomobject]@{ Type = 'Reg' @@ -133,6 +135,7 @@ function New-PolicyControl { ValueName = $ValueName OnValue = $OnValue OffValue = $OffValue + Security = [bool]$Security AdminReq = $true } } @@ -216,6 +219,23 @@ function Get-Controls { -ValueName 'NetworkPredictionOptions' -OnValue 0 -OffValue 2 ` -Note '0=predict always 2=never') ) + # --- Edge SmartScreen: URL / site / download reputation (SECURITY) --- + [void]$c.Add( (New-PolicyControl -Name 'SmartScreen (URL/site check)' -Browser Edge -PolicyPath $edge ` + -ValueName 'SmartScreenEnabled' -OnValue 1 -OffValue 0 -Security ` + -Note 'SECURITY: checks visited URLs/downloads against Microsoft reputation') ) + + [void]$c.Add( (New-PolicyControl -Name 'SmartScreen PUA blocking' -Browser Edge -PolicyPath $edge ` + -ValueName 'SmartScreenPuaEnabled' -OnValue 1 -OffValue 0 -Security ` + -Note 'SECURITY: blocks potentially unwanted apps') ) + + [void]$c.Add( (New-PolicyControl -Name 'SmartScreen DNS lookups' -Browser Edge -PolicyPath $edge ` + -ValueName 'SmartScreenDnsRequestsEnabled' -OnValue 1 -OffValue 0 -Security ` + -Note 'SECURITY: DNS-based site reputation lookups') ) + + [void]$c.Add( (New-PolicyControl -Name 'Typosquatting Checker' -Browser Edge -PolicyPath $edge ` + -ValueName 'TyposquattingCheckerEnabled' -OnValue 1 -OffValue 0 -Security ` + -Note 'SECURITY: warns on lookalike/typo domains') ) + # =========================== Google Chrome ============================ [void]$c.Add( (New-PolicyControl -Name 'Metrics Reporting (UMA)' -Browser Chrome -PolicyPath $chr ` -ValueName 'MetricsReportingEnabled' -OnValue 1 -OffValue 0 ` @@ -229,6 +249,10 @@ function Get-Controls { -ValueName 'SafeBrowsingExtendedReportingEnabled' -OnValue 1 -OffValue 0 ` -Note 'Extra page/system data to Google; SB itself stays on') ) + [void]$c.Add( (New-PolicyControl -Name 'Safe Browsing (URL check)' -Browser Chrome -PolicyPath $chr ` + -ValueName 'SafeBrowsingProtectionLevel' -OnValue 1 -OffValue 0 -Security ` + -Note 'SECURITY: 0=off 1=standard 2=enhanced. Off stops URL reputation checks') ) + [void]$c.Add( (New-PolicyControl -Name 'URL-keyed Data Collection' -Browser Chrome -PolicyPath $chr ` -ValueName 'UrlKeyedAnonymizedDataCollectionEnabled' -OnValue 1 -OffValue 0 ` -Note 'URLs of visited pages sent to Google') ) @@ -300,6 +324,10 @@ function Get-Controls { -ValueName 'SearchSuggestEnabled' -OnValue 1 -OffValue 0 ` -Note 'Chromium policy honoured by Brave') ) + [void]$c.Add( (New-PolicyControl -Name 'Safe Browsing (URL check)' -Browser Brave -PolicyPath $brv ` + -ValueName 'SafeBrowsingProtectionLevel' -OnValue 1 -OffValue 0 -Security ` + -Note 'SECURITY: 0=off 1=standard 2=enhanced. Off stops URL reputation checks') ) + # Filter to installed browsers unless -IncludeAll if ($IncludeAll) { return $c } $filtered = New-Object System.Collections.ArrayList @@ -338,26 +366,35 @@ function Show-Status { Write-Host (' Browsers: {0}' -f ($det -join ', ')) -ForegroundColor DarkCyan Write-Host ' Enabled = collecting/on Disabled = hardened/off' -ForegroundColor DarkCyan Write-Host '==================================================================' -ForegroundColor Cyan - Write-Host ('{0,-4}{1,-32}{2,-10}{3}' -f '#', 'Setting', 'Browser', 'State') -ForegroundColor White - Write-Host ('{0,-4}{1,-32}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray + Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '#', 'Setting', 'Browser', 'State') -ForegroundColor White + Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray $i = 0 - $nEnabled = 0; $nDisabled = 0 + $nEnabled = 0; $nDisabled = 0; $nSecOff = 0 foreach ($ctrl in $Controls) { $i++ $state = Get-ControlState -Ctrl $ctrl if ($state -like 'Enabled*') { $nEnabled++ } elseif ($state -like 'Disabled*') { $nDisabled++ } + $sec = '' + if ($ctrl.Security) { + $sec = ' [SEC]' + if ($state -like 'Disabled*') { $nSecOff++ } + } $lock = '' if ($ctrl.AdminReq -and -not $Script:IsAdmin) { $lock = ' *' } $flag = '' if (-not $Script:Browsers[$ctrl.Category].Installed) { $flag = ' (not installed)' } - $line = ('{0,-4}{1,-32}{2,-10}' -f $i, $ctrl.Name, $ctrl.Category) + $line = ('{0,-4}{1,-36}{2,-10}' -f $i, ($ctrl.Name + $sec), $ctrl.Category) Write-Host $line -NoNewline Write-Host ($state + $lock + $flag) -ForegroundColor (Get-StateColor $state) } - Write-Host ('{0,-4}{1,-32}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray + Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray Write-Host (' Summary: {0} enabled, {1} disabled' -f $nEnabled, $nDisabled) -ForegroundColor White + Write-Host ' [SEC] = anti-malware URL/site check. Disabling REDUCES protection' -ForegroundColor DarkYellow + if ($nSecOff -gt 0) { + Write-Host (' WARNING: {0} security URL-check feature(s) are currently OFF' -f $nSecOff) -ForegroundColor Red + } Write-Host ' Policies apply on next browser start. While hardened, browsers' -ForegroundColor DarkCyan Write-Host ' show a "managed" notice on settings pages - that is expected.' -ForegroundColor DarkCyan if (-not $Script:IsAdmin) { @@ -403,11 +440,26 @@ function Invoke-ControlAction { } function Invoke-AllAction { - param($Controls, [ValidateSet('Enable','Disable')][string]$Action) + param( + $Controls, + [ValidateSet('Enable','Disable')][string]$Action, + [switch]$WithSecurity # when disabling, also include [SEC] URL-check features + ) $verb = if ($Action -eq 'Enable') { 'ENABLE (restore browser defaults)' } else { 'DISABLE (harden)' } Write-Host '' Write-Host ("Applying {0} to ALL items..." -f $verb) -ForegroundColor Cyan - foreach ($ctrl in $Controls) { Invoke-ControlAction -Ctrl $ctrl -Action $Action } + $skippedSec = 0 + foreach ($ctrl in $Controls) { + # Never auto-disable anti-malware URL checks in bulk unless explicitly requested. + if ($Action -eq 'Disable' -and $ctrl.Security -and -not $WithSecurity) { + $skippedSec++ + continue + } + Invoke-ControlAction -Ctrl $ctrl -Action $Action + } + if ($skippedSec -gt 0) { + Write-Host (' Kept {0} [SEC] URL-check feature(s) ON (use -IncludeSecurity / menu "S" to disable).' -f $skippedSec) -ForegroundColor DarkYellow + } Write-Host '' Write-Host 'Restart the affected browsers for policies to take effect.' -ForegroundColor Cyan Write-Host '' @@ -424,8 +476,9 @@ function Start-Menu { Write-Host ' toggle item n (Enable<->Disable)' Write-Host ' e enable item n' Write-Host ' d disable item n' - Write-Host ' D disable ALL (harden)' + Write-Host ' D disable ALL (harden; keeps [SEC] URL checks ON)' Write-Host ' E enable ALL (restore browser defaults)' + Write-Host ' S disable ALL [SEC] URL-check features (reduces security)' Write-Host ' b apply D to one browser (e.g. b Edge)' Write-Host ' r refresh view' Write-Host ' c export status to CSV' @@ -451,6 +504,17 @@ function Start-Menu { } Read-Host 'Press Enter'; continue } + '^S$' { + $secList = @($Controls | Where-Object { $_.Security }) + Write-Host '' + Write-Host 'WARNING: This turns OFF anti-malware URL/site reputation checks' -ForegroundColor Red + Write-Host ('(SmartScreen / Safe Browsing) for {0} item(s). Your browser will' -f $secList.Count) -ForegroundColor Red + Write-Host 'no longer warn about known malicious or phishing sites.' -ForegroundColor Red + if ((Read-Host 'Proceed? type DISABLE-SECURITY') -ceq 'DISABLE-SECURITY') { + Invoke-AllAction -Controls $secList -Action Disable -WithSecurity + } + Read-Host 'Press Enter'; continue + } '^[Bb]\s+(\w+)$' { $target = $Matches[1] $subset = @($Controls | Where-Object { $_.Category -eq $target }) @@ -504,7 +568,7 @@ if (@($controls).Count -eq 0) { } if ($DisableAll) { - Invoke-AllAction -Controls $controls -Action Disable + Invoke-AllAction -Controls $controls -Action Disable -WithSecurity:$IncludeSecurity Show-Status -Controls $controls if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv } return diff --git a/README.md b/README.md index 266f5cb..d1ce6ef 100644 --- a/README.md +++ b/README.md @@ -161,10 +161,44 @@ registration); only installed ones are shown unless you pass `-IncludeAll`. # Export status to CSV / include browsers that are not installed .\Manage-BrowserPrivacy.ps1 -Csv .\browser-status.csv .\Manage-BrowserPrivacy.ps1 -Report -IncludeAll + +# Harden everything AND turn off the malicious-URL checks (see warning below) +.\Manage-BrowserPrivacy.ps1 -DisableAll -IncludeSecurity ``` The menu supports the same commands as the Windows tool, plus -`b ` to harden a single browser at once (e.g. `b Edge`). +`b ` to harden a single browser at once (e.g. `b Edge`), and +`S` to disable the malicious-URL checks (see below). + +## Safe Browsing / SmartScreen (URL reputation) - read this + +Some controls check the **domain / IP / URL** you visit against a cloud +reputation service (Microsoft SmartScreen for Edge, Google Safe Browsing for +Chrome/Brave). These are **security** features - they warn you off phishing +and malware sites - but they work by sending URL/host data off the machine, +so they are also a privacy consideration. They are marked **`[SEC]`** in the +status view. + +Because turning them off *reduces protection*, they are handled separately: + +- **`-DisableAll` and the menu `D` command leave `[SEC]` items ON.** Bulk + hardening will not silently disable your malware protection. +- To disable them you must be explicit: + - CLI: `-DisableAll -IncludeSecurity` + - Menu: the dedicated **`S`** command (requires typing + `DISABLE-SECURITY` to confirm) + - Or toggle the individual numbered item (that is always a deliberate act) +- The status view prints a red **WARNING** line whenever any `[SEC]` feature + is currently OFF, so a hardened-too-far machine is obvious at a glance. + +`[SEC]` controls covered: Edge SmartScreen (site/URL check, PUA blocking, DNS +reputation lookups, typosquatting checker); Chrome & Brave Safe Browsing +protection level (`0` = off, disables URL reputation checks entirely). + +> Recommendation: leave these ON unless you have a specific reason (e.g. you +> route all traffic through a separate filtering DNS/proxy that already does +> this). They are the browser's main defence against phishing and drive-by +> malware. ## How it works @@ -191,11 +225,13 @@ Two things to expect: | **Chrome** | Metrics reporting (UMA), search suggestions, Safe Browsing extended reporting, URL-keyed data collection, cloud spell check, alternate error pages, network prediction, feedback surveys, Privacy Sandbox (prompt, Ad Topics, site-suggested ads, ad measurement) | | **Firefox** | Telemetry, Firefox Studies (Shield), Default Browser Agent (daily Mozilla ping), Pocket | | **Brave** | Rewards, Wallet, VPN, Tor windows, search suggestions (Chromium policy) | +| **`[SEC]` URL checks** | Edge SmartScreen (site/URL, PUA, DNS lookups, typosquatting); Chrome & Brave Safe Browsing protection level | Notes: -- Chrome's Safe Browsing itself is left ON; only the *extended reporting* - (extra data to Google) is hardened. +- Under `-DisableAll`, Safe Browsing / SmartScreen stay ON; only the + *extended reporting* (extra data to Google) is hardened by default. Full + URL-check disabling requires `-IncludeSecurity` or the menu `S` command. - The three Chrome Privacy Sandbox ad policies require the Privacy Sandbox prompt policy to be Disabled as well - the tool includes it. - Brave sends comparatively little telemetry by default; its entries harden @@ -206,7 +242,8 @@ Notes: ## CSV output columns -`Name, Browser, Installed, Policy, State, Note` +`Name, Browser, Installed, Policy, State, Note` ([SEC] items are named as +such in the `Name` column). ---