Why does Windows 10 have so many open ports by default?

Question

Looking at Windows 10's firewall settings, I see dozens of authorized applications, for most of which I can't find a good reason to allow incoming traffic.

For example, I don't want Xbox, Twitter, MSN, Microsoft Edge to receive unknown traffic from the Internet.

I assume that these settings don't include traffic on already established connections (like the ESTABLISHED and RELATED states in Linux's netfilter). Indeed, I disallowed Microsoft Edge in the firewall and I still can browse.

Why does Windows allow so much applications in the firewall by default? Isn't this a security risk (for example, any of these apps could be exploited)? Is it safe to disable them all and block all incoming traffic?

EDIT : to be clear, I am only talking about inbound connections that happen without having been previously established by an outbound request. I'm totally fine with allowing all outbound connections, as these are initiated by my software.

Answer 1

"Authorized Applications" does not equal "Open Ports." These applications have authorization to communicate through the firewall...This does not mean that they're listening on ports open through the firewall. In the case of many (if not all) of the application you listed, that means that when you open them and try to use them, they can establish connections to get the data requested. If you don't open Twitter, it isn't listening. If you do open Twitter, it still isn't listening on a port for in-bound connections. The fact that it's an authorized application means that you expect the firewall to allow it to communicate as it is designed to do. In this case, that's primarily going to be reaching out to the Twitter service to retrieve tweets.

So, while you are correct that you don't want services you don't need listening for inbound connections on open ports, that isn't what's happening here.

Answer 2

While your assumption that having more open ports increases security risk is correct, it still depends on a lot of other factors.

Now, let me ask you if you believe that closing most ports through your firewall makes you secure? Again, you cannot have an answer to that as there are way too many factors involved.

While it is advisable to keep only the necessary ports open or closed, the default Windows setup is definitely not optimum, but at least decent. This is also the reason you have access to the firewall settings and people that understand what's going on can make a choice. But to others, it might just be an inconvenience.

For example: You don't want Xbox, Twitter or MSN. But what if I'm a non-technical person that purchased a Windows machine for the sole purpose of using Xbox, Twitter and MSN? If Windows blocked them by default, I wouldn't know what to do. I would be frustrated and think that Microsoft is a bogus company etc etc.

I hope you understand what I mean. If you understand security and think a specific setup makes your computer more secure, by all means - go for it. :)

Hope this helps!