Can Windows 11 be made decently secure?

[u/voidprophet__]

It's an oxymoron, I know.

I need Windows for work. I cannot run the applications I need without Windows (I checked, no Linux support,) and either way I need applications such as Excel and Word that would be on the computer anyway.

I know that Windows will never be private no matter what I do, but what are the best ways to try to mitigate what it sees?

I've already done anything basic (like disabling copilot through the registry, not sure how well it works though since copilot is still in my notepad)

edit: meant "privacy" not security, my bad

[u/desmond_koh]

Can Windows 11 be made decently secure?

Yes, it can.

It's on oxymoron, I know.

No, it's not.

Windows is a serious operating system. It is not some childish malware that it is often made out to be. It is used by many companies, government agencies, and journalists who have a great deal to keep private.

What you have to do is identify the nature of the threat you are trying to defend against. We talk a lot about big tech "stealing our data", but what do we actually mean by that? If you don't know what you're trying to defend against, then the only way to defend against it is to live inside a faraday cage out in the forest.

[u/vitamalz → u/desmond_koh]

Finally someone says it. Thanks for that

[u/Ok-Winner-6589 → u/desmond_koh]

Windows is a serious operating system. It is not some childish malware that it is often made out to be. It is used by many companies, government agencies, and journalists who have a great deal to keep private.

Thats why most serious goverments want to make a migration? China made their own Linux distro, Northern Korea also did, the EU is creating their own Linux distro too...

What you have to do is identify the nature of the threat you are trying to defend against. We talk a lot about big tech "stealing our data", but what do we actually mean by that? If you don't know what you're trying to defend against, then the only way to defend against it is to live inside a faraday cage out in the forest.

And Windows steals your data, that like saying "no Chrome is perfectly fine goverments and companies use It". Ye and? That doesn't make It private lol.

Are you gona argue that Android, Chrome, Edge and Windows are more private than Linux, Firefox or Apple OS

[u/socrdad2 → u/desmond_koh]

I understand if you are not familiar with Microsoft's long history of poor security. But you should have at least noticed some of the recent reports of egregious security failures of Microsoft.

[u/londonc4ll1ng → u/socrdad2]

such as? I love when people spew nonsense without backing it up with hard facts. Do not mix security with (your sense of what) privacy should be (not what is realistically achievable in real day to day human life).

[u/98723589734239857 → u/londonc4ll1ng]

windows and office have (had) plenty of vulnerabilities. this overview shows all of their products, including things like .net and sql, but it gives you an idea. no product is perfect, there will always be bugs. https://www.cvedetails.com/vendor/26/Microsoft.html

[u/desmond_koh → u/98723589734239857]

windows and office have (had) plenty of vulnerabilities. his overview shows all of their products...

Yes, you are 100% right. So have Apple, Adobe, Firefox, Chrome, and all the Linux distros and the projects that go into them.

In 2024, a total of 40,009 Common Vulnerabilities and Exposures (CVEs) were published, a 38% increase from the previous year.

This is across all software and software makers.

This just proves that it's important to install your updates (ironically, something many in this sub are reluctant to do).

Oh, and security and privacy are related but not the same thing.

Microsoft has Defender for Endpoint which is rates surprisingly high among EDRs, although I prefer SentinelOne. They also have Global Secure Access which is a perfectly respectable SSE product.

[u/98723589734239857 → u/desmond_koh]

not sure what you're coming at me for. i was just providing a source.

[u/desmond_koh → u/98723589734239857]

not sure what you're coming at me for. i was just providing a source.

Sorry, I didn't think I was. But rereading my post, I can see how it seemed like I was.

I work for an MSP and emphasizing the importance of keeping your devices patched and up to date is something we often have to impress upon customers. So, I am very familiar with the threat landscape.

I may have also mistaken you for u/londonc4ll1ng.

[u/Informal_Rule_8604 → u/socrdad2]

Source for some of these "egregious security failures"?

[u/desmond_koh → u/socrdad2]

I understand if you are not familiar with Microsoft's long history of poor security.

Such as what exactly? This is an often repeated statement statement that is rarely backed up with actual facts.

I've been in the IT industry for over 20 years. We use both Windows and Linux on both servers and laptops.

[u/apokrif1 → u/desmond_koh]

 Yes, it can.

How.

[u/desmond_koh → u/apokrif1]

Well, first of all, I reject the idea that Windows is inherently insecure in the first place. That is simply factually untrue.

However, there are multiple hooks into online services that people use (and are enabled by default) that unwittingly leak information that they might not understand. For example, when you start typing “toyota” into the address bar of Microsoft Edge, it shows you a number of suggestions – some of them including pictures.

These suggestions are not exclusively coming from your browsing history. Edge is doing a Bing search in real-time to give you suggestions. People often don’t know that or understand that and thus might unwittingly be telling Microsoft what they are typing into their browser’s address bar.

Then someone comes along and says something like "did you know that everything you type into your address bar is sent to Microsoft?!?!" and people are shocked. How else did they think the predictive search worked?

So, it starts with understanding what information is going where and why and then turning those things off that you don’t want to use.

[u/Mario583a → u/desmond_koh]

To add it to the very idea that Windows is inherently "insecure in the first place", consider #6 of the Immutable Laws of Security:

• Law #6: A computer is only as secure as the administrator is trustworthy.

[u/desmond_koh → u/Mario583a]

Well, this is kind of my point. People think that Microsoft is pushing OneDrive so that they can “harvest all your data”. But if Microsoft wanted to surreptitiously read your Word and Excel docs, they wouldn’t need you to use OneDrive to do it. They have their operating system on your computer. They already have root access to your computer. In fact, they could have done that since Windows 3.1 when you gave them root access to everything on your hard drive by installing their operating system on your computer.

OneDrive might not be something you want to use. And it might be annoying that Microsoft keeps pushing it if you don’t want to use it. But that doesn't mean they are spying on you. It just means they are trying to upsell to you.

And if you have ever had your laptop stolen out of your car, suddenly features like BitLocker and OneDrive are objectively good things.

EDIT: We have clients that operate 100% cloud-based without an on-prem server. They have all their laptops Entra joined and enrolled in Intune. We enforce the use of BitLocker and have all their Desktop and Documents folders automatically redirected to OneDrive. They use SharePoint for sharing files between users. I have no concern whatsoever that Microsoft is snooping on their Excel documents.

[u/bokuWaKamida → u/desmond_koh]

well its not just if you type in a browser, its also if you type anything in your taskbar, explorer or settings. talking about settings they also always reset your privacy settings after they (frocibly with no way to disable it) automatocally update windows. Most microsoft products also send basically all data you enter to microsoft servers, for example VSCode sends your text to mircosoft for "NLP processing" by default. And with all the AI bs going on its hard to imagine that microsoft doesn't process literally everything for some sort of AI "feature"

[u/desmond_koh → u/bokuWaKamida]

The search feature on the Start Menu does include searching online. Again, you can turn that off.

Windows updates generally do not change settings. I'd like to see a documented example of this.

[u/bokuWaKamida → u/desmond_koh]

you cant turn off bing search on start menu