131–140 of 388 posts
Earlier quoted context omitted.
_Everyone_ is collecting our data nowadays. Who's left to sell it to?
Not everyone. FOSS doesn't.
There are probably lots of smaller examples; especially in Android.
While many AV companies are really bad, AV per say is still an extra layer of security. Telling people to remove a layer of security is bad advice. There's a problem though and if I knew how to solve it I'd be rich!
Earlier quoted context omitted.
I'm pretty sure no AV would help against targeted attacks on high profile target. If you have multi-million business to secure, you play at totally different risk model.
That's exactly what I had in mind when I read the GP. If third party AVs have a large and complex codebase with unknown or even known security flaws, they won't help much against targeted attacks or make them even easier. On the other hand, AV usability is so bad you can't expect it to help "normal" people. All those popups do more harm than good when people start ignoring them.
Earlier quoted context omitted.
It actually is worse. The problem comes "what does the interception do when it encounters an invalid certificate"? So for example a self-signed cert. does it a) create a "valid" cert itself, hiding the error from the user? This is obviously dangerous b) create an "invalid" self-signed cert. This is messy as a user will then see a self-signed cert from the A-V vendor, which they may be more or less inclined to trust c…
It can simply stop the connection and show the user, under the normal certificate, a message telling him there's a problem with the cert.
But remember like I said that's just one example of why it's a bad idea, there's others, e.g. what do you do about EV-SSL certificates? You can't fake the browser element for them (remember this is the case where the A-V product hasn't hooked the browser), so where you want to MITM a EV-SSL connection you have to downgrade it to Non-EV.
Also what do you do with certificate pinning (either browser in-built or HPKP headers?)
https://googleprojectzero.blogspot.hu/2016/06/how-to-comprom...
While many AV companies are really bad, AV per say is still an extra layer of security. Telling people to remove a layer of security is bad advice. There's a problem though and if I knew how to solve it I'd be rich!
Earlier quoted context omitted.
Yes. Also, let's finally start a public discussion about AV companies making money by selling data (they do, either all of them or most). Of course that being able to peek into https traffic gets them more data (specific urls, not just whole sites).
_Everyone_ is collecting our data nowadays. Who's left to sell it to?
This is my advice to everyone I know that gets a new Windows PC. Windows 10's built-in protection is more than adequate, and catches the majority of bad software - anything more is unnecessary, and many of the AV vendors are predatory.
Sometimes I used CClenaer and/or Spybot to deal with something really nasty, but the MS stuff really does a good job (Someone checked if the hell is frozen now ?)
Who writes all these viruses ? I mean, I've experimented with assembler when I was a teenager and I may have developed some kind of program which could replicate itself.. but I highly doubt today's viruses are written by teenagers... Who and why do people write viruses ? Is this a thing at all or are all the viruses written by the Antivirus makers themselves ? More 'threats' is good news for the A/V makers so why not…
Earlier quoted context omitted.
You can manage pre-installed root certificates manually in Windows. As far as I've seen, there was nothing sinister in default Windows root CA list.
That's hardly relevant for the average computer user. By default, root certs are updated automatically. >As far as I've seen, there was nothing sinister in default Windows root CA list. Are you in any way related to MS or is your memory just very short? >Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates https://arstechnica.com/security/2014/07/emergency-windows-u...
I'd argue that's a problem in CA trust model, not MS. If you trust a certain CA, of course you trust their issued certificates by design. Currently, if some high tier CA f*cks up, there's no other way to invalidate their issued certificates than propagating CRLs and removing its certificate from the root CA stores manually (or by updates, as in MS case).