Securing a little girl's christmas laptop? Firewall, Anti-virus, and child proofing.

runswithascript

We're picking up a Windows 7 Starter netbook for a 9 year old today and I'd rather source any security software myself.

Will be using Firefox with Ad-Block for browsing. If you know any good security addons that would help please mention them.

I was thinking of Microsoft Security Essentials for the anti-virus because I only ever seem to read good things about it - is there a better AV out there?
?

Do I need something separate for adware and malware?

As a linux user for my firewall I use iptables and have only ever heard how weak the built in Windows firewall is - is this still the case? If so please recommend one. The laptop will usually be connecting behind a Netopia 2247.

What's the best way to prevent adult websites and unsuitable content displaying in the browser? Being able to block Facebook would be nice, but not a necessity as I am sure I can find other ways. I am aware IE has some preventative measures to block content but we will be sticking with Firefox thank you very much.

yoyo

dusf wrote: »

We're picking up a Windows 7 Starter netbook for a 9 year old today and I'd rather source any security software myself.

Will be using Firefox with Ad-Block for browsing. If you know any good security addons that would help please mention them.

I was thinking of Microsoft Security Essentials for the anti-virus because I only ever seem to read good things about it - is there a better AV out there?

As a linux user for my firewall I use iptables and have only ever heard how weak the built in Windows firewall is - is this still the case? If so please recommend one. The laptop will usually be connecting behind a Netopia 2247.

What's the best way to prevent adult websites and unsuitable content displaying in the browser? Being able to block Facebook would be nice, but not a necessity as I am sure I can find other ways. I am aware IE has some preventative measures to block content but we will be sticking with Firefox thank you very much.

MSE and Adblock are great options . I would advise K9 child Protection (Free) for a firewall filtering program, it actually uses the cloud for definitions, so its pritty accurate, you can also block other categories social networking, alcohol, gambling, warez etc. Make sure you give her only a standard user account, and you yourself password protect the administrator account, that way she'd find it quite difficult to bypass the filter!

Nick

iMax

MS used to have an application under the LIVE umbrella which gave parental controls. This included being able to remotely monitor & also block sites & it could email you if anyone tried to connect to your specific blocked sites.

You should also install prey project software on it as you can track it if stolen.

runswithascript

yoyo wrote: »

MSE and Adblock are great options . I would advise K9 child Protection (Free) for a firewall filtering program, it actually uses the cloud for definitions, so its pritty accurate, you can also block other categories social networking, alcohol, gambling, warez etc. Make sure you give her only a standard user account, and you yourself password protect the administrator account, that way she'd find it quite difficult to bypass the filter!

Nick

All good advice.

Can I assume from your not mentioning it that you are satisfied with the Windows 7 Starter built in firewall then?

iMax wrote: »

MS used to have an application under the LIVE umbrella which gave parental controls. This included being able to remotely monitor & also block sites & it could email you if anyone tried to connect to your specific blocked sites.

You should also install prey project software on it as you can track it if stolen.

I'll look into both - and the prey thing sounds very cool

U_Fig

one way of blocking websites is using the hosts file...open up the hosts file located at C:\Windows\System32\drivers\etc\ in notepad you will need to do this as administrator so run notepad first as admin and then open the file.then add this to the bottom

127.0.0.1                     www.facebook.com

this will send all requests to Facebook to the localhost and it will not connect.. this is easily bypassed using proxy servers but I doubt many 9 year old will know about these. you can also do this with anyother site just use the same address and put the site name in

yoyo

dusf wrote: »

All good advice.

Can I assume from your not mentioning it that you are satisfied with the Windows 7 Starter built in firewall then?



I'll look into both - and the prey thing sounds very cool

The Windows inbuilt Firewall is fine, you can get some bloated thingy but why when the Windows one does the job?

Nick

syklops

but I doubt many 9 year old will know about these

Don't underestimate the 9 year olds.

OP, are you sure you want a netbook and not a desktop. A desktop can be placed in the living room or the kitchen. Somewhere an adult is always around. A netbook can be taken anywhere.

Ad block Pro, and flashblock are two good apps. Make sure she knows how to use them and how to add ads to the blacklist.

Set up the PC using the Administrator account but do not let her have admin access. If she wants to install additional software you will have to do it. Give her a user account with limited privileges.

Encourage her to use it in family areas, and dont install the driver for the webcam if it has one. If she needs to use it, she can ask you to 'fix' it. But, dont let her wander around with a functioning one.

JonathanAnon

yoyo wrote: »

MSE and Adblock are great options . I would advise K9 child Protection (Free) for a firewall filtering program, it actually uses the cloud for definitions,

I'm with Yoyo on the MSE.. best AV and lightest load on the system.... and on the K9... though test it every few weeks to make sure it's still installed and functional... I would use Google Chrome as the browser, instead of Firefox..

syklops wrote:

Encourage her to use it in family areas, and dont install the driver for the webcam if it has one. If she needs to use it, she can ask you to 'fix' it. But, dont let her wander around with a functioning one

This might be a good idea as well.. hi syk ... maybe if you disabled the wireless on the laptop (and on the router) and have it so that she needs to plug in a cable to connect to the internet, this would give you the most comprehensive control of Internet access.. This would restrict access to the web to within the cable length of the Internet router.. i.e. it wont be possible to be in the bedroom roaming the net.. if wireless is required by other devices you could limit wifi access by MAC Address.

One way of blocking websites is using the hosts file...open up the hosts file located at C:\Windows\System32\drivers\etc\ in notepad you will need to do this as administrator so run notepad first as admin and then open the file.then add this to the bottom

Editing the hosts file is certainly a way of blocking websites.. it's how I block the ads from coming up on boards.ie ... LOL... but it's not really a solution for a home user trying to block multiple websites of undefined IP addresses..

the_syco

yoyo wrote: »

The Windows inbuilt Firewall is fine, you can get some bloated thingy but why when the Windows one does the job?

Nick

From what I've seen with Windows security, once the virus gets in, you're ****ed, as it only has a passive type of scan, and isn't that much up to date.

The_Thing

If I were the OP the last thing I'd do before handing over the laptop was use Acronis True Image (or similar) to create an image of the drive after all the updates, settings and tweaking has been done on it - that way when the netbook is eventually messed up you can restore it using the image rather than having to start from scratch.

yoyo

the_syco wrote: »

From what I've seen with Windows security, once the virus gets in, you're ****ed, as it only has a passive type of scan, and isn't that much up to date.

Hence I suggested OP to lock down the kids account (standard user) and he is the only Admin with a password . That should be totally secure with my other suggestions. If a virus knocks off the windows firewall/AV it will likely knock off zone Alarm, Norton etc. Preventing that virus in the first place is the best solution . MSE does update quite frequently, its just silent compared to the others hence its not as noticeable , Which is the best way

Nick

BopNiblets

U_Fig wrote: »

one way of blocking websites is using the hosts file...open up the hosts file located at C:\Windows\System32\drivers\etc\ in notepad you will need to do this as administrator so run notepad first as admin and then open the file.then add this to the bottom

127.0.0.1                     www.facebook.com

this will send all requests to Facebook to the localhost and it will not connect.. this is easily bypassed using proxy servers but I doubt many 9 year old will know about these. you can also do this with anyother site just use the same address and put the site name in

Was about to suggest the same, including this file that's already got a load of nasty sites and ad sites blocked:
http://someonewhocares.org/hosts/

EvilMonkey

Use open DNS

runswithascript

So far: Firefox with Ad-Block, MSE installed, Ad-Aware with Safe Browser Plugin, Windows Firewall On, Updates set to automatic, K-9 child protection activated, specific websites blocked with the hosts file, using OpenDNS and Prey Software.

Do I need to do all this to each account individually, or is there some way to install to both user accounts at the same time?

syklops wrote: »

OP, are you sure you want a netbook and not a desktop. A desktop can be placed in the living room or the kitchen. Somewhere an adult is always around. A netbook can be taken anywhere.

Raised this with the girl's mother and she's happy with the netbook solution and planning to keep a good eye on goingson.

syklops wrote: »

Ad block Pro, and flashblock are two good apps. Make sure she knows how to use them and how to add ads to the blacklist.

Encountered flashblock before paired with no script and both seem a bit too much hassle to be! Thanks though.

syklops wrote: »

Set up the PC using the Administrator account but do not let her have admin access. If she wants to install additional software you will have to do it. Give her a user account with limited privileges.

Already created her a limited account but your comment got me thinking and I think it would be a good idea for her Mom's account to be limited and blocked also for when her daughter happens to use it, and then if someone using either account want to install software or access certain websites blocked by K-9 her Mom will have to input the password.

Tried to set her Mom's account to Standard and it wouldn't allow me because it's greyed out. I'm guessing this is because there it is the only account of the two created set to admin, but isn't there a pre-existing admin account Administrator because when I try to create it I'm told it's there already.

What's the best way to have both user accounts set to Standard?

syklops wrote: »

Encourage her to use it in family areas, and dont install the driver for the webcam if it has one. If she needs to use it, she can ask you to 'fix' it. But, dont let her wander around with a functioning one.

JonathanAnon wrote: »

This might be a good idea as well.. hi syk ... maybe if you disabled the wireless on the laptop (and on the router) and have it so that she needs to plug in a cable to connect to the internet, this would give you the most comprehensive control of Internet access.. This would restrict access to the web to within the cable length of the Internet router.. i.e. it wont be possible to be in the bedroom roaming the net.. if wireless is required by other devices you could limit wifi access by MAC Address.

Her Mom's happy to leave the webcam intact as both wikll be Skyping distant relatives often.

JonathanAnon wrote: »

Editing the hosts file is certainly a way of blocking websites.. it's how I block the ads from coming up on boards.ie ... LOL... but it's not really a solution for a home user trying to block multiple websites of undefined IP addresses..

Worked a treat on facebook anyway!

The_Thing wrote: »

If I were the OP the last thing I'd do before handing over the laptop was use Acronis True Image (or similar) to create an image of the drive after all the updates, settings and tweaking has been done on it - that way when the netbook is eventually messed up you can restore it using the image rather than having to start from scratch.

Yes, this especially interests me, but does it differ much from System Restore, should I also be doing stuff with Windows Restore too or is it automatic, and can I put the Acronis True Image on the existing drive (even on a separate partition)? I don't think her Mom would be prepared to invest in a separate drive at the moment.

BopNiblets wrote: »

Was about to suggest the same, including this file that's already got a load of nasty sites and ad sites blocked:
http://someonewhocares.org/hosts/

Nice, so I just use this instead:

127.0.0.1  (is there a certain number of tabs or spaces here?) http://someonewhocares.org/hosts/

?

yoyo wrote: »

MSE does update quite frequently, its just silent compared to the others hence its not as noticeable , Which is the best way

MSE's installed and I don't even see it running in the system tray so I'm this is what you mean and exactly how it's supposed to be!

EvilMonkey wrote: »

Use open DNS

Done. Just trying to work out if I should use FamilyShield OpenDNS on the little girl's account, but regular OpenDNS on her Mom's.

syklops

Do I need to do all this to each account individually, or is there some way to install to both user accounts at the same time?

You dont need to install the software again, you just need to allow access to the different programs for the limited account. You can do this using the command line tool cacls. I am not sure how to do it from the GUI.

I highly recommend both. I understand that no-script can be a hassle for some sites, and for a child to use could be annoying, but I would urge you to use flashblock, for two reasons, the most vulnerable piece of software on the computer is Adobe flash with exploits coming out for it all the time. With flash block enabled, you lessen your chances of being infected with something. In a few minutes I will be writing a blog post for our corporate blog page demonstrating how one can talk over a PC including taking over the webcam, just by opening a malicious PDF attachment.

Also adverts of a 'salacious' nature tend to be flash. You would be amazed how the innocent googling of a teen girl can bring you to some really inappropriate stuff.

Already created her a limited account but your comment got me thinking and I think it would be a good idea for her Mom's account to be limited and blocked also for when her daughter happens to use it, and then if someone using either account want to install software or access certain websites blocked by K-9 her Mom will have to input the password.

Why would she ever need to use her Moms account? I would try to avoid that situation. Its very easy to get into the habit of 'just using Moms account' if Moms account has more access. Either give Mom full admin, or give her the same as the daughter.

Tried to set her Mom's account to Standard and it wouldn't allow me because it's greyed out. I'm guessing this is because there it is the only account of the two created set to admin, but isn't there a pre-existing admin account Administrator because when I try to create it I'm told it's there already.

I have seen this before. When setting up the PC it asks the name of the person who owns the PC, and they type in their name, and they get set as the administrator. Therre is no account called Administrator. Its meant to be a security feature, but it doesn't offer much. It looks like Moms account is admin. Log in as her, and you should be able to create another account with admin rights, log in as that and then reconfigure moms account with low level privileges. Thats assuming I understand your problem.

Yes, this especially interests me, but does it differ much from System Restore, should I also be doing stuff with Windows Restore too or is it automatic, and can I put the Acronis True Image on the existing drive (even on a separate partition)? I don't think her Mom would be prepared to invest in a separate drive at the moment.

In my experience System Restore only works about half the time, and even then you dont always get the desired results. Acronis takes a snapshot of the configuration of your drive, everything thats on it. Files, programs configuration settings the lot. System Restore just saves the registry.

Nice, so I just:

127.0.0.1  (is there a certain number of tabs or spaces here?) http://someonewhocares.org/hosts/

No, what you do is download the hosts file at http://someonewhocares.org/hosts/ and save it to where your current hosts file is (which from memory is "C:\Windows\System32\drivers\etc\") and reboot. Make sure in view options that the box for "Show file type extensions" is ticked, and that the file name is just "hosts" and not hosts.txt.

Done. Just trying to work out if I should use FamilyShield OpenDNS on the little girl's account, but regular OpenDNS on her Mom's.

Its your call. I don't have any experience with the FamilySheild.

runswithascript

syklops wrote: »

You dont need to install the software again, you just need to allow access to the different programs for the limited account. You can do this using the command line tool cacls. I am not sure how to do it from the GUI.

Thanks, I'll research a GUI way.

In a few minutes I will be writing a blog post for our corporate blog page demonstrating how one can talk over a PC including taking over the webcam, just by opening a malicious PDF attachment.

Have you a link for this blog or is it on an intranet? I'm going to re-enable no script and flashblock on my own PC to see again exactly how intrusive it needs to be.

Also adverts of a 'salacious' nature tend to be flash. You would be amazed how the innocent googling of a teen girl can bring you to some really inappropriate stuff.

Fair point, but I feel with Ad-Block, K-9 Child Protection, and OpenDNS' Family Shield we have that covered for the most part.

Why would she ever need to use her Moms account? I would try to avoid that situation. Its very easy to get into the habit of 'just using Moms account' if Moms account has more access. Either give Mom full admin, or give her the same as the daughter.

Them both always using their own accounts is the policy I've advised, I just think it's inevitable for things to eventually lax somewhat at sometimes.

"Mommy can I just check my mail on your account quickly?" etc.

I have the same security set up for both accounts only her mother uses regular OpenDNS instead of the family version.

I have seen this before. When setting up the PC it asks the name of the person who owns the PC, and they type in their name, and they get set as the administrator. There is no account called Administrator. Its meant to be a security feature, but it doesn't offer much. It looks like Moms account is admin. Log in as her, and you should be able to create another account with admin rights, log in as that and then reconfigure moms account with low level privileges. Thats assuming I understand your problem.

Her Mom's account currently is the admin, but I think we put her daughters name into the Win 7 configuration wizard on first boot.

Do I really need to create a separate but unused account that will annoyingly be visible when selecting a user on login just to set both to standard?

Basically I'd like two user accounts requiring the admin password for anything like installing programs etc.

In my experience System Restore only works about half the time, and even then you dont always get the desired results. Acronis takes a snapshot of the configuration of your drive, everything thats on it. Files, programs configuration settings the lot. System Restore just saves the registry.

Okay, but would it still make sense to configure System Restore aswell? I think some of it is automatic.

I was thinking of creating a separate partition of about 30GBs or so for a backup, will Acronis allow me to back up there, and does it differ on anything other than price to Clozezilla?

They are not prepared to purchase a backup drive at this time.

127.0.0.1  (is there a certain number of tabs or spaces here?) http://someonewhocares.org/hosts/

No, what you do is download the hosts file at http://someonewhocares.org/hosts/ and save it to where your current hosts file is (which from memory is "C:\Windows\System32\drivers\etc\") and reboot. Make sure in view options that the box for "Show file type extensions" is ticked, and that the file name is just "hosts" and not hosts.txt.

Thanks.

ANSI

Comdo firewall if not happy with the win 7 one

kippy

dusf wrote: »

syklops wrote: »

You dont need to install the software again, you just need to allow access to the different programs for the limited account. You can do this using the command line tool cacls. I am not sure how to do it from the GUI.

Thanks, I'll research a GUI way.

In a few minutes I will be writing a blog post for our corporate blog page demonstrating how one can talk over a PC including taking over the webcam, just by opening a malicious PDF attachment.

Have you a link for this blog or is it on an intranet? I'm going to re-enable no script and flashblock on my own PC to see again exactly how intrusive it needs to be.

Also adverts of a 'salacious' nature tend to be flash. You would be amazed how the innocent googling of a teen girl can bring you to some really inappropriate stuff.

Fair point, but I feel with Ad-Block, K-9 Child Protection, and OpenDNS' Family Shield we have that covered for the most part.

Why would she ever need to use her Moms account? I would try to avoid that situation. Its very easy to get into the habit of 'just using Moms account' if Moms account has more access. Either give Mom full admin, or give her the same as the daughter.

Them both always using their own accounts is the policy I've advised, I just think it's inevitable for things to eventually lax somewhat at sometimes.

"Mommy can I just check my mail on your account quickly?" etc.

I have the same security set up for both accounts only her mother uses regular OpenDNS instead of the family version.

I have seen this before. When setting up the PC it asks the name of the person who owns the PC, and they type in their name, and they get set as the administrator. There is no account called Administrator. Its meant to be a security feature, but it doesn't offer much. It looks like Moms account is admin. Log in as her, and you should be able to create another account with admin rights, log in as that and then reconfigure moms account with low level privileges. Thats assuming I understand your problem.

Her Mom's account currently is the admin, but I think we put her daughters name into the Win 7 configuration wizard on first boot.

Do I really need to create a separate but unused account that will annoyingly be visible when selecting a user on login just to set both to standard?

Basically I'd like two user accounts requiring the admin password for anything like installing programs etc.

In my experience System Restore only works about half the time, and even then you dont always get the desired results. Acronis takes a snapshot of the configuration of your drive, everything thats on it. Files, programs configuration settings the lot. System Restore just saves the registry.

Okay, but would it still make sense to configure System Restore aswell? I think some of it is automatic.

I was thinking of creating a separate partition of about 30GBs or so for a backup, will Acronis allow me to back up there, and does it differ on anything other than price to Clozezilla?

They are not prepared to purchase a backup drive at this time.

127.0.0.1  (is there a certain number of tabs or spaces here?) http://someonewhocares.org/hosts/

No, what you do is download the hosts file at http://someonewhocares.org/hosts/ and save it to where your current hosts file is (which from memory is "C:\Windows\System32\drivers\etc\") and reboot. Make sure in view options that the box for "Show file type extensions" is ticked, and that the file name is just "hosts" and not hosts.txt.

Thanks.

Windows 7,although not sure about starter,comes with an imaging option built in. Look for "create a system image"in the "backup"menus. You will also need to create a startup disc to enable you to use this image. Also under backup somewhre. Good suggestions so far.

Nothingbetter2d

you need this

http://www.netnanny.ie/

it blocks all known porn and other assorted adult content

yoyo

Nothingbetter2d wrote: »

you need this

http://www.netnanny.ie/

it blocks all known porn and other assorted adult content

K9 is free and does this, K9 also doesn't use "definitions files", it uses the cloud so will stay more up to date than Net Nanny. Its bizare people still pay for stuff they can get free, or go to the painstaking task of editing the hosts file, when they can install a simple app that they themselves can disable if they like, but the kid can't due to a password.

Nick

runswithascript

ANSI wrote: »

Comdo firewall if not happy with the win 7 one

That's just it - can I be happy with it? And what's more for my own use on Windows XP, can I trust that firewall?

kippy wrote: »

Windows 7,although not sure about starter,comes with an imaging option built in. Look for "create a system image"in the "backup"menus. You will also need to create a startup disc to enable you to use this image. Also under backup somewhre. Good suggestions so far.

Cheers I will take a look, and try to compare it to Clonezilla.

ANSI

dusf wrote: »

That's just it - can I be happy with it? And what's more for my own use on Windows XP, can I trust that firewall?
.

I would not be happy with windows firewal anyway. as far as i know there is no outward control so if anything gets in it will not stop it connecting out. That could be importand on a pc with info like bank info etc

runswithascript

This setup has been working fine since Christmas but recently for all websites Bluecoat is giving the following error:

K9 Web Protection Error
Filter Error
Cannot Contact K9 Service
K9 Web Protection was unable to communicate with the Blue Coat Service Points.
K9 Web Protection needs to access the Internet in order to get a rating for Web sites. Although K9 is able to access the Internet at this time, it appears that the Blue Coat Service Points are unavailable. Please wait and try again later. You can also disable K9 to access the Internet, but you will *NOT* be filtered.
You may also choose from the following administrative options:
Try Again Try to access the Web site again.
Enter Supervisor Mode Allow *ALL* Web access
WARNING: In Supervisor Mode K9 will not block any Web content. Malware and Phishing protection will also be disabled.
Get Help View support and feedback options for K9 Web protection.

I have tried reinstalling K-9, removing all other security software, and disabling the Windows firewall but the problem persists.

Interestingly this problem only occurs in my girlfriend's house on her Eircom DSL using a Netopia 2247, when I take the netbook to my own place where I have a UPC connection everything works as it should.

I'm hoping when I'm next over there changing the DNS servers from Eircom's will make a difference.

Have any of you encountered this?

I like the Bluecoat K-9 setup, when it works, but just in case what would you recommend as a replacement?

yoyo

dusf wrote: »

This setup has been working fine since Christmas but recently for all websites Bluecoat is giving the following error:

K9 Web Protection Error
Filter Error
Cannot Contact K9 Service
K9 Web Protection was unable to communicate with the Blue Coat Service Points.
K9 Web Protection needs to access the Internet in order to get a rating for Web sites. Although K9 is able to access the Internet at this time, it appears that the Blue Coat Service Points are unavailable. Please wait and try again later. You can also disable K9 to access the Internet, but you will *NOT* be filtered.
You may also choose from the following administrative options:
Try Again Try to access the Web site again.
Enter Supervisor Mode Allow *ALL* Web access
WARNING: In Supervisor Mode K9 will not block any Web content. Malware and Phishing protection will also be disabled.
Get Help View support and feedback options for K9 Web protection.

I have tried reinstalling K-9, removing all other security software, and disabling the Windows firewall but the problem persists.

Interestingly this problem only occurs in my girlfriend's house on her Eircom DSL using a Netopia 2247, when I take the netbook to my own place where I have a UPC connection everything works as it should.

I'm hoping when I'm next over there changing the DNS servers from Eircom's will make a difference.

Have any of you encountered this?

I like the Bluecoat K-9 setup, when it works, but just in case what would you recommend as a replacement?

It does sound like a Eircom DNS issue. K9 uses cloud based difinitions so needs to be able communicate with K9 servers to know what to block.

Nick

runswithascript

yoyo wrote: »

It does sound like a Eircom DNS issue. K9 uses cloud based difinitions so needs to be able communicate with K9 servers to know what to block.

Nick

Great, at least I know what is most likely causing the problem, any idea why Eircom would block this?

Also, do you know any alternatives to OpenDNS? I think their servers were causing problems with the bittorrent protocol which is used sometimes on the netbook.

Cabaal

dusf wrote: »

Also, do you know any alternatives to OpenDNS? I think their servers were causing problems with the bittorrent protocol which is used sometimes on the netbook.

Could use google's dns
https://developers.google.com/speed/public-dns/