Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Avoid Non-Microsoft Antivirus Software

robert.ocallahan.org

Post reply on HN
Print view View original

81–90 of 388 posts

Re: Avoid Non-Microsoft Antivirus Software

#81

Post by neko_koneko »

delegate wrote: post #79

Who writes all these viruses ? I mean, I've experimented with assembler when I was a teenager and I may have developed some kind of program which could replicate itself.. but I highly doubt today's viruses are written by teenagers... Who and why do people write viruses ? Is this a thing at all or are all the viruses written by the Antivirus makers themselves ? More 'threats' is good news for the A/V makers so why not…

There are many criminal groups that develop malware - it's a multi-million dollar business.

Re: Avoid Non-Microsoft Antivirus Software

#82

Post by mavhc »

technion wrote: post #26
shultays wrote: post #11

Earlier quoted context omitted.

> Invoice-Jan-2017.docx uh, docx files can hack my PC now? Is this a bug of MS Word or docx format really has ability to become a virus?

An extraordinary amount of Cryptolocker outbreaks were due to .docx files containing macros. Yes, it has a default behaviour of "prompt to execute macros", but it happily shows the advice in the malicious document to "please click yes at this prompt to get a free iPhone", at which point the majority of users click "yes".

.docx files can't contain macros

Re: Avoid Non-Microsoft Antivirus Software

#83

Post by josteink »

yAnonymous wrote: post #78
bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

Microsoft doesn't exactly have a great record with root certificates either. >Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates https://arstechnica.com/security/2014/07/emergency-windows-u... They revoked certs like this silently in the past which makes it even worse.

Got an example? I haven't heard anything about this and I'm genuinely curious.

Re: Avoid Non-Microsoft Antivirus Software

#84

Post by akjainaj »

bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

> In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users.

It doesn't have to be insecure. If the software that does the MITM checks the certificates correctly, I don't see how it would be worse than letting the browser handle it.

Not that I'd ever use an antivirus, of course.

Re: Avoid Non-Microsoft Antivirus Software

#85

Post by zrm »

disiplus wrote: post #58
bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

i dont think you understand how this works. they install a root certicicate on your machine and do mitm "attack" so they can scan the urls, and block some attacks (i remember when some forum had embeded a pdf, that had some attack and antivirus blocked it ) also you have installed an application that has a root acces to the pc, if it was mallicius it could do allot more damage. it is ultimately a question of trust. i…

That is a bad idea.

If you MITM the connection locally it triples the computational cost for both encryption and handshake operations. Then more websites don't use TLS because it's three times as slow for the user.

It also prevents you from using a good cipher suite when the MITM doesn't support it even though the browser and the server both do, again reducing security or performance or both. And it's very easy to screw this up the other way and have the browser show a good secure connection with strong primitives and forward secrecy while the MITM is actually communicating with the server using export ciphers or RC4.

The existence of a trusted root private key on your machine exposes you to KCI of all servers. And key compromise is not even necessary if they use the same root private key for everyone, which has actually happened.

This is not a comprehensive list of the reasons why that is a bad idea.

Re: Avoid Non-Microsoft Antivirus Software

#86

Post by microtonal »

romanovcode wrote: post #42
owenwil wrote: post #7

This is my advice to everyone I know that gets a new Windows PC. Windows 10's built-in protection is more than adequate, and catches the majority of bad software - anything more is unnecessary, and many of the AV vendors are predatory.

It sucks that you cannot reset your Windows to MS-Vendor settings. For example if you get some Acer laptop and reset it using windows built-in functionality it'll still reset it with all the bloatware - including AV.

Can't you just download a pristine Windows 10 ISO from Microsoft's website and install from that? I've done that on my Dell Precision and it works great.

Re: Avoid Non-Microsoft Antivirus Software

#87

Post by Maakuth »

delegate wrote: post #79

Who writes all these viruses ? I mean, I've experimented with assembler when I was a teenager and I may have developed some kind of program which could replicate itself.. but I highly doubt today's viruses are written by teenagers... Who and why do people write viruses ? Is this a thing at all or are all the viruses written by the Antivirus makers themselves ? More 'threats' is good news for the A/V makers so why not…

If you have some time to watch a video, here's a clip of F-Secure's Mikko Hyppönen expaining some of the origins of network attacks and malware: https://www.ted.com/talks/mikko_hypponen_fighting_viruses_de...

Re: Avoid Non-Microsoft Antivirus Software

#88

Post by noemotion »

bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

I am not disagreeing with you, but I want to point out that, usually, the certificate is generated locally during setup and then installed in the trusted certificates store. So no one else should have that certificate. I also assume there is an option somewhere to disable the MITM scanner.

Re: Avoid Non-Microsoft Antivirus Software

#89

Post by bad_user »

yAnonymous wrote: post #78
bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

Microsoft doesn't exactly have a great record with root certificates either. >Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates https://arstechnica.com/security/2014/07/emergency-windows-u... They revoked certs like this silently in the past which makes it even worse.

Any references, because I don't know what you're talking about?

I'm not a Windows user, haven't been a Windows user since 2001, my AV experience has been with the PCs of my family, whom I'm trying to keep safe.

But even if I were a Windows user, if you can't trust Microsoft, you can't trust their OS, at which point it would be better to use something else because security really depends on how trustworthy that OS and its vendor are. I do trust Microsoft more than I trust an AV vendor though.

Re: Avoid Non-Microsoft Antivirus Software

#90

Post by tomaskafka »

bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

Yes. Also, let's finally start a public discussion about AV companies making money by selling data (they do, either all of them or most).

Of course that being able to peek into https traffic gets them more data (specific urls, not just whole sites).

Post reply on HN