5

I apologize if this is a newb question. Reading this prompt, it appears that I should check Private Networks and uncheck Public Networks. However, Windows defaults to the opposite being checked.

Am I misreading this? Why is the default to allow public networks, and disallow private networks? Is there ever a case where it is appropriate to allow public but not private?

Windows Security Alert

1

I am copying an answer from Microsoft Answers as it answered the question much clearer than I could explain.

Private network or home networks are when you know and trust the people and devices on the network. Computers on a home network can belong to a HomeGroup. Network discovery is turned on for home networks, which allows you to see other computers and devices on the network and allows other network users to see your computer.

Public network are for the networks in public places (such as coffee shops or airports). This location is designed to keep your computer from being visible to other computers around you and to help protect your computer from any malicious software from the Internet. HomeGroup is not available on public networks, and network discovery is turned off. You should also choose this option if you're connected directly to the Internet without using a router, or if you have a mobile broadband connection.

I would like to inform you that system network configuration does not come configured with a network. You have to configure it when you connect to the Internet connection for the first time. When configuring the network connection to the system it might have got selected to public network. However, you can change Public network to Home network from sharing center.

  • Go to settings and click on Network & Internet.
  • Click on Wi-Fi on the left pane, and click on the Manage known networks.
  • Click on the wireless network connected you want to manage and click on Properties.
  • Now turn on Make this PC discoverable.

A point missing about the public network option is that sharing services SMB, etc.. should be disabled and open ports will be greatly limit. Less open ports result in fewer attack vectors. So, choosing public network when you are using an untrusted network is much wiser.

Why is the default to allow public networks, and disallow private networks?

This is likely because most non-technical users will select the default option, which is likely safer.

  • But it to the option that is "not recommended" because of "little or no security". I am still confused. – Evorlor Jul 18 '18 at 22:19
  • My understanding, is they are advising users to not connect to public networks (café, airports, library, etc...) as they often offer "little or no security" which refers to Wi-Fi encryption and the potential for a MITM attack. Point is you cannot trust this foreign network, which may actively redirect traffic through a proxy they control to perform stripping of HTTPS. SSLStrip [ moxie.org/software/sslstrip ] – safesploit Jul 18 '18 at 22:24
1

This is old, but you are right. The default is idiotic. Point one is that allowing any Inbound-initiated traffic is a risk. Point two is that you might enable it on a Private or Domain network where you have a reasonable trust of other devices. Point three is that you would almost never trust it on a Public network. There are quite a few apps that request Inbound inbound exceptions when they don't need it. I can only conclude that the developers or packagers of the app did not really know what they were doing. They must think that, if they can bring up the prompt, you can decide what to allow.

0

A quick Google search shows a few forum posts where users have expressed similar concerns, provided below.

The synopsis from the top source I could find is that lcore.exe, the specific executable requesting this Windows firewall exception, allows you to customize your Logitech game controller behavior. In short, this allows for creating/modifying game profiles, launching games, and for exchanging game profiles with other users (import/export options), which explains why it is requesting external access.

Originally, I thought the reason the device(s) may need to communicate with an external network is to pull in updates. This could be the case, though having read further it seems that it is simply for communication relating to profile customization and sharing.

So, best practice would be to block it if you aren't using those features as it consumes additional system memory.

Sources:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.