Add files via upload

Manage-BrowserPrivacy.ps1

@@ -39,6 +39,7 @@ param(
     [switch]$DisableAll,
     [switch]$EnableAll,
     [switch]$IncludeAll,
+    [switch]$IncludeSecurity,   # also disable [SEC] URL-check features in bulk actions
     [string]$Csv
 )
 
@@ -122,7 +123,8 @@ function New-PolicyControl {
     param(
         [string]$Name, [string]$Browser, [string]$PolicyPath,
         [string]$ValueName, [int]$OnValue, [int]$OffValue,
-        [string]$Note = ''
+        [string]$Note = '',
+        [switch]$Security   # marks a control whose "Disabled" state REDUCES protection
     )
     [pscustomobject]@{
         Type      = 'Reg'
@@ -133,6 +135,7 @@ function New-PolicyControl {
         ValueName = $ValueName
         OnValue   = $OnValue
         OffValue  = $OffValue
+        Security  = [bool]$Security
         AdminReq  = $true
     }
 }
@@ -216,6 +219,23 @@ function Get-Controls {
         -ValueName 'NetworkPredictionOptions' -OnValue 0 -OffValue 2 `
         -Note '0=predict always 2=never') )
 
+    # --- Edge SmartScreen: URL / site / download reputation (SECURITY) ---
+    [void]$c.Add( (New-PolicyControl -Name 'SmartScreen (URL/site check)' -Browser Edge -PolicyPath $edge `
+        -ValueName 'SmartScreenEnabled' -OnValue 1 -OffValue 0 -Security `
+        -Note 'SECURITY: checks visited URLs/downloads against Microsoft reputation') )
+
+    [void]$c.Add( (New-PolicyControl -Name 'SmartScreen PUA blocking' -Browser Edge -PolicyPath $edge `
+        -ValueName 'SmartScreenPuaEnabled' -OnValue 1 -OffValue 0 -Security `
+        -Note 'SECURITY: blocks potentially unwanted apps') )
+
+    [void]$c.Add( (New-PolicyControl -Name 'SmartScreen DNS lookups' -Browser Edge -PolicyPath $edge `
+        -ValueName 'SmartScreenDnsRequestsEnabled' -OnValue 1 -OffValue 0 -Security `
+        -Note 'SECURITY: DNS-based site reputation lookups') )
+
+    [void]$c.Add( (New-PolicyControl -Name 'Typosquatting Checker' -Browser Edge -PolicyPath $edge `
+        -ValueName 'TyposquattingCheckerEnabled' -OnValue 1 -OffValue 0 -Security `
+        -Note 'SECURITY: warns on lookalike/typo domains') )
+
     # =========================== Google Chrome ============================
     [void]$c.Add( (New-PolicyControl -Name 'Metrics Reporting (UMA)' -Browser Chrome -PolicyPath $chr `
         -ValueName 'MetricsReportingEnabled' -OnValue 1 -OffValue 0 `
@@ -229,6 +249,10 @@ function Get-Controls {
         -ValueName 'SafeBrowsingExtendedReportingEnabled' -OnValue 1 -OffValue 0 `
         -Note 'Extra page/system data to Google; SB itself stays on') )
 
+    [void]$c.Add( (New-PolicyControl -Name 'Safe Browsing (URL check)' -Browser Chrome -PolicyPath $chr `
+        -ValueName 'SafeBrowsingProtectionLevel' -OnValue 1 -OffValue 0 -Security `
+        -Note 'SECURITY: 0=off 1=standard 2=enhanced. Off stops URL reputation checks') )
+
     [void]$c.Add( (New-PolicyControl -Name 'URL-keyed Data Collection' -Browser Chrome -PolicyPath $chr `
         -ValueName 'UrlKeyedAnonymizedDataCollectionEnabled' -OnValue 1 -OffValue 0 `
         -Note 'URLs of visited pages sent to Google') )
@@ -300,6 +324,10 @@ function Get-Controls {
         -ValueName 'SearchSuggestEnabled' -OnValue 1 -OffValue 0 `
         -Note 'Chromium policy honoured by Brave') )
 
+    [void]$c.Add( (New-PolicyControl -Name 'Safe Browsing (URL check)' -Browser Brave -PolicyPath $brv `
+        -ValueName 'SafeBrowsingProtectionLevel' -OnValue 1 -OffValue 0 -Security `
+        -Note 'SECURITY: 0=off 1=standard 2=enhanced. Off stops URL reputation checks') )
+
     # Filter to installed browsers unless -IncludeAll
     if ($IncludeAll) { return $c }
     $filtered = New-Object System.Collections.ArrayList
@@ -338,26 +366,35 @@ function Show-Status {
     Write-Host ('  Browsers: {0}' -f ($det -join ', ')) -ForegroundColor DarkCyan
     Write-Host '  Enabled = collecting/on    Disabled = hardened/off' -ForegroundColor DarkCyan
     Write-Host '==================================================================' -ForegroundColor Cyan
-    Write-Host ('{0,-4}{1,-32}{2,-10}{3}' -f '#', 'Setting', 'Browser', 'State') -ForegroundColor White
+    Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '#', 'Setting', 'Browser', 'State') -ForegroundColor White
-    Write-Host ('{0,-4}{1,-32}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray
+    Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray
 
     $i = 0
-    $nEnabled = 0; $nDisabled = 0
+    $nEnabled = 0; $nDisabled = 0; $nSecOff = 0
     foreach ($ctrl in $Controls) {
         $i++
         $state = Get-ControlState -Ctrl $ctrl
         if     ($state -like 'Enabled*')  { $nEnabled++ }
         elseif ($state -like 'Disabled*') { $nDisabled++ }
+        $sec = ''
+        if ($ctrl.Security) {
+            $sec = ' [SEC]'
+            if ($state -like 'Disabled*') { $nSecOff++ }
+        }
         $lock = ''
         if ($ctrl.AdminReq -and -not $Script:IsAdmin) { $lock = ' *' }
         $flag = ''
         if (-not $Script:Browsers[$ctrl.Category].Installed) { $flag = ' (not installed)' }
-        $line = ('{0,-4}{1,-32}{2,-10}' -f $i, $ctrl.Name, $ctrl.Category)
+        $line = ('{0,-4}{1,-36}{2,-10}' -f $i, ($ctrl.Name + $sec), $ctrl.Category)
         Write-Host $line -NoNewline
         Write-Host ($state + $lock + $flag) -ForegroundColor (Get-StateColor $state)
     }
-    Write-Host ('{0,-4}{1,-32}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray
+    Write-Host ('{0,-4}{1,-36}{2,-10}{3}' -f '---', '-------', '-------', '-----') -ForegroundColor DarkGray
     Write-Host ('  Summary: {0} enabled, {1} disabled' -f $nEnabled, $nDisabled) -ForegroundColor White
+    Write-Host '  [SEC] = anti-malware URL/site check. Disabling REDUCES protection' -ForegroundColor DarkYellow
+    if ($nSecOff -gt 0) {
+        Write-Host ('  WARNING: {0} security URL-check feature(s) are currently OFF' -f $nSecOff) -ForegroundColor Red
+    }
     Write-Host '  Policies apply on next browser start. While hardened, browsers' -ForegroundColor DarkCyan
     Write-Host '  show a "managed" notice on settings pages - that is expected.' -ForegroundColor DarkCyan
     if (-not $Script:IsAdmin) {
@@ -403,11 +440,26 @@ function Invoke-ControlAction {
 }
 
 function Invoke-AllAction {
-    param($Controls, [ValidateSet('Enable','Disable')][string]$Action)
+    param(
+        $Controls,
+        [ValidateSet('Enable','Disable')][string]$Action,
+        [switch]$WithSecurity   # when disabling, also include [SEC] URL-check features
+    )
     $verb = if ($Action -eq 'Enable') { 'ENABLE (restore browser defaults)' } else { 'DISABLE (harden)' }
     Write-Host ''
     Write-Host ("Applying {0} to ALL items..." -f $verb) -ForegroundColor Cyan
-    foreach ($ctrl in $Controls) { Invoke-ControlAction -Ctrl $ctrl -Action $Action }
+    $skippedSec = 0
+    foreach ($ctrl in $Controls) {
+        # Never auto-disable anti-malware URL checks in bulk unless explicitly requested.
+        if ($Action -eq 'Disable' -and $ctrl.Security -and -not $WithSecurity) {
+            $skippedSec++
+            continue
+        }
+        Invoke-ControlAction -Ctrl $ctrl -Action $Action
+    }
+    if ($skippedSec -gt 0) {
+        Write-Host ('  Kept {0} [SEC] URL-check feature(s) ON (use -IncludeSecurity / menu "S" to disable).' -f $skippedSec) -ForegroundColor DarkYellow
+    }
     Write-Host ''
     Write-Host 'Restart the affected browsers for policies to take effect.' -ForegroundColor Cyan
     Write-Host ''
@@ -424,8 +476,9 @@ function Start-Menu {
         Write-Host '  <n>          toggle item n (Enable<->Disable)'
         Write-Host '  e <n>        enable item n'
         Write-Host '  d <n>        disable item n'
-        Write-Host '  D            disable ALL (harden)'
+        Write-Host '  D            disable ALL (harden; keeps [SEC] URL checks ON)'
         Write-Host '  E            enable ALL (restore browser defaults)'
+        Write-Host '  S            disable ALL [SEC] URL-check features (reduces security)'
         Write-Host '  b <name>     apply D to one browser (e.g. b Edge)'
         Write-Host '  r            refresh view'
         Write-Host '  c <path>     export status to CSV'
@@ -451,6 +504,17 @@ function Start-Menu {
                 }
                 Read-Host 'Press Enter'; continue
             }
+            '^S$'         {
+                $secList = @($Controls | Where-Object { $_.Security })
+                Write-Host ''
+                Write-Host 'WARNING: This turns OFF anti-malware URL/site reputation checks' -ForegroundColor Red
+                Write-Host ('(SmartScreen / Safe Browsing) for {0} item(s). Your browser will' -f $secList.Count) -ForegroundColor Red
+                Write-Host 'no longer warn about known malicious or phishing sites.' -ForegroundColor Red
+                if ((Read-Host 'Proceed? type DISABLE-SECURITY') -ceq 'DISABLE-SECURITY') {
+                    Invoke-AllAction -Controls $secList -Action Disable -WithSecurity
+                }
+                Read-Host 'Press Enter'; continue
+            }
             '^[Bb]\s+(\w+)$' {
                 $target = $Matches[1]
                 $subset = @($Controls | Where-Object { $_.Category -eq $target })
@@ -504,7 +568,7 @@ if (@($controls).Count -eq 0) {
 }
 
 if ($DisableAll) {
-    Invoke-AllAction -Controls $controls -Action Disable
+    Invoke-AllAction -Controls $controls -Action Disable -WithSecurity:$IncludeSecurity
     Show-Status -Controls $controls
     if ($Csv) { Export-StatusCsv -Controls $controls -Path $Csv }
     return

README.md

@@ -161,10 +161,44 @@ registration); only installed ones are shown unless you pass `-IncludeAll`.
 # Export status to CSV / include browsers that are not installed
 .\Manage-BrowserPrivacy.ps1 -Csv .\browser-status.csv
 .\Manage-BrowserPrivacy.ps1 -Report -IncludeAll
+
+# Harden everything AND turn off the malicious-URL checks (see warning below)
+.\Manage-BrowserPrivacy.ps1 -DisableAll -IncludeSecurity
 ```
 
 The menu supports the same commands as the Windows tool, plus
-`b <browser>` to harden a single browser at once (e.g. `b Edge`).
+`b <browser>` to harden a single browser at once (e.g. `b Edge`), and
+`S` to disable the malicious-URL checks (see below).
+
+## Safe Browsing / SmartScreen (URL reputation) - read this
+
+Some controls check the **domain / IP / URL** you visit against a cloud
+reputation service (Microsoft SmartScreen for Edge, Google Safe Browsing for
+Chrome/Brave). These are **security** features - they warn you off phishing
+and malware sites - but they work by sending URL/host data off the machine,
+so they are also a privacy consideration. They are marked **`[SEC]`** in the
+status view.
+
+Because turning them off *reduces protection*, they are handled separately:
+
+- **`-DisableAll` and the menu `D` command leave `[SEC]` items ON.** Bulk
+  hardening will not silently disable your malware protection.
+- To disable them you must be explicit:
+  - CLI: `-DisableAll -IncludeSecurity`
+  - Menu: the dedicated **`S`** command (requires typing
+    `DISABLE-SECURITY` to confirm)
+  - Or toggle the individual numbered item (that is always a deliberate act)
+- The status view prints a red **WARNING** line whenever any `[SEC]` feature
+  is currently OFF, so a hardened-too-far machine is obvious at a glance.
+
+`[SEC]` controls covered: Edge SmartScreen (site/URL check, PUA blocking, DNS
+reputation lookups, typosquatting checker); Chrome & Brave Safe Browsing
+protection level (`0` = off, disables URL reputation checks entirely).
+
+> Recommendation: leave these ON unless you have a specific reason (e.g. you
+> route all traffic through a separate filtering DNS/proxy that already does
+> this). They are the browser's main defence against phishing and drive-by
+> malware.
 
 ## How it works
 
@@ -191,11 +225,13 @@ Two things to expect:
 | **Chrome** | Metrics reporting (UMA), search suggestions, Safe Browsing extended reporting, URL-keyed data collection, cloud spell check, alternate error pages, network prediction, feedback surveys, Privacy Sandbox (prompt, Ad Topics, site-suggested ads, ad measurement) |
 | **Firefox** | Telemetry, Firefox Studies (Shield), Default Browser Agent (daily Mozilla ping), Pocket |
 | **Brave** | Rewards, Wallet, VPN, Tor windows, search suggestions (Chromium policy) |
+| **`[SEC]` URL checks** | Edge SmartScreen (site/URL, PUA, DNS lookups, typosquatting); Chrome & Brave Safe Browsing protection level |
 
 Notes:
 
-- Chrome's Safe Browsing itself is left ON; only the *extended reporting*
+- Under `-DisableAll`, Safe Browsing / SmartScreen stay ON; only the
-  (extra data to Google) is hardened.
+  *extended reporting* (extra data to Google) is hardened by default. Full
+  URL-check disabling requires `-IncludeSecurity` or the menu `S` command.
 - The three Chrome Privacy Sandbox ad policies require the Privacy Sandbox
   prompt policy to be Disabled as well - the tool includes it.
 - Brave sends comparatively little telemetry by default; its entries harden
@@ -206,7 +242,8 @@ Notes:
 
 ## CSV output columns
 
-`Name, Browser, Installed, Policy, State, Note`
+`Name, Browser, Installed, Policy, State, Note` ([SEC] items are named as
+such in the `Name` column).
 
 ---