7

Looking at Windows 10's firewall settings, I see dozens of authorized applications, for most of which I can't find a good reason to allow incoming traffic.

For example, I don't want Xbox, Twitter, MSN, Microsoft Edge to receive unknown traffic from the Internet.

I assume that these settings don't include traffic on already established connections (like the ESTABLISHED and RELATED states in Linux's netfilter). Indeed, I disallowed Microsoft Edge in the firewall and I still can browse.

Why does Windows allow so much applications in the firewall by default? Isn't this a security risk (for example, any of these apps could be exploited)? Is it safe to disable them all and block all incoming traffic?

EDIT : to be clear, I am only talking about inbound connections that happen without having been previously established by an outbound request. I'm totally fine with allowing all outbound connections, as these are initiated by my software.

  • 3
    I think all Metro apps are exempt from the firewall by default. Maybe this is due to additional security measures in these apps (sandbox, etc.) or it's just sloppy deployment strategy. – billc.cn Aug 10 '16 at 11:51
  • 3
    Even if Metro apps are sandboxed, I don't want them to receive traffic without a good reason. I disabled all the rules and my PC still works fine. I think I will just blame Microsoft for putting holes in their own security for no reason. – Elzo Aug 10 '16 at 12:00
  • @Amo On similar reasons I don't use microsoft OSes et al. – peterh Jan 26 '18 at 23:40
  • Those help the spy/spam program. – Overmind Mar 15 at 8:58
7

"Authorized Applications" does not equal "Open Ports." These applications have authorization to communicate through the firewall...This does not mean that they're listening on ports open through the firewall. In the case of many (if not all) of the application you listed, that means that when you open them and try to use them, they can establish connections to get the data requested. If you don't open Twitter, it isn't listening. If you do open Twitter, it still isn't listening on a port for in-bound connections. The fact that it's an authorized application means that you expect the firewall to allow it to communicate as it is designed to do. In this case, that's primarily going to be reaching out to the Twitter service to retrieve tweets.

So, while you are correct that you don't want services you don't need listening for inbound connections on open ports, that isn't what's happening here.

  • I think you're partly wrong. I disallowed all the apps, effectively blocking anything on my PC, and all still works well. This seems to means that the firewall only blocks incoming non-already-established connections, like I thought. Also, the firewall only shows "warnings" for new apps when they try to listen on a port, like the Minecraft server (only example I remember). But you're right saying that n authorized apps don't mean n listening ports. It just means that they can listen on a port, and I'm not comfortable with that. Why should they ? – Elzo Aug 10 '16 at 19:08
  • 2
    @YdobEmos No, that's not how it works. There are separate rule sets for inbound connections vs. outbound connections. If you blocked (not disabled) both inbound connections and outbound connections for an application, it should not continue to work. If this is not the case for you, I'd be interested to see it. – Xander Aug 10 '16 at 19:34
  • @YdobEmos I've just confirmed that on my system, blocking outbound connections for the Xbox app breaks it. – Xander Aug 10 '16 at 19:40
  • Then we're not talking about the same thing. I was using the simple list of apps in the Control Panel, not the "Advanced" settings, and the ones I use seem to block only inbound connections. I totally understand why blocking outbound connections would break any app that uses the Internet. My question was about inbound connections that are and shouldn't be allowed by default. Sorry for being unclear. I'll edit the question. – Elzo Aug 10 '16 at 20:38
  • "Authorized Applications" does not equal "Open Ports." - correct, but the end result is the same -- they can get through. – Overmind Mar 15 at 8:59
1

While your assumption that having more open ports increases security risk is correct, it still depends on a lot of other factors.

Now, let me ask you if you believe that closing most ports through your firewall makes you secure? Again, you cannot have an answer to that as there are way too many factors involved.

While it is advisable to keep only the necessary ports open or closed, the default Windows setup is definitely not optimum, but at least decent. This is also the reason you have access to the firewall settings and people that understand what's going on can make a choice. But to others, it might just be an inconvenience.

For example: You don't want Xbox, Twitter or MSN. But what if I'm a non-technical person that purchased a Windows machine for the sole purpose of using Xbox, Twitter and MSN? If Windows blocked them by default, I wouldn't know what to do. I would be frustrated and think that Microsoft is a bogus company etc etc.

I hope you understand what I mean. If you understand security and think a specific setup makes your computer more secure, by all means - go for it. :)

Hope this helps!

  • I understand, thank you. Problem is, I want to use Twitter or sometimes Xbox. I still use them now that I blocked them in the firewall, they work fine. The firewall only prevents apps from receiving random incoming traffic when I didn't ask for it ; if I ask Twitter to show my timeline, the server's response will come through, because it's an already established connection. My point is, there is absolutely no need for these apps to accept random packets. My PC isn't a web server, and anyone that really needs this (on a server for example) could allow what he wants. – Elzo Aug 10 '16 at 12:08
  • anyone that really needs this (on a server for example) could allow what he wants. This assumes that the person has the prerequisite knowledge. To a lot of people, this would just be an inconvenience! But I see your point. – theabhinavdas Aug 10 '16 at 12:11
  • I think that if you really need an app to listen on a port, you should learn basic security first. It may be a good thing that one can't set up a server listening publicly without knowing about firewalls. – Elzo Aug 10 '16 at 19:10
  • Actually, you can. – theabhinavdas Aug 10 '16 at 19:31
  • "closing most ports through your firewall makes you secure" is a poor way to think about things. Closing ports makes you more secure by reducing attack surface and attacker access to vulnerabilities. "closing most ports through your firewall makes you more secure – Adam Shostack Aug 10 '16 at 22:59

protected by Community Jan 21 '18 at 23:30

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.