Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Avoid Non-Microsoft Antivirus Software

robert.ocallahan.org

Post reply on HN
Print view View original

141–150 of 388 posts

Re: Avoid Non-Microsoft Antivirus Software

#141

Post by akjainaj »

raesene6 wrote: post #134
akjainaj wrote: post #124

Earlier quoted context omitted.

It can simply stop the connection and show the user, under the normal certificate, a message telling him there's a problem with the cert.

So to do that it's going to stop the users browsing session, redirect them to a local web page and then present something to let them make a decision about carrying on? not the best user experience in the world.. But remember like I said that's just one example of why it's a bad idea, there's others, e.g. what do you do about EV-SSL certificates? You can't fake the browser element for them (remember this is the case…

Of course there are lots of what-ifs, but how do you tamper with HTTPS traffic if you don't MITM?

Re: Avoid Non-Microsoft Antivirus Software

#142

Post by provirus »

tempestn wrote: post #19

What's more, as third party antivirus software becomes increasingly irrelevant, many of these companies resort to harmful and even actively malicious tactics to stay in business. On the more benign end, you see an increase in 'safe web browsing' and such tools that parse javascript while browsing and somehow attempt to make it.. safer, I guess. My main experience with these things is when they randomly decide to bloc…

Given how they often MITM the connection they would be able to do things like reorder Google search results. This would be a huge revenue stream. Can also sell browsing data to advertisers to target specific people.

Re: Avoid Non-Microsoft Antivirus Software

#143

Post by fuzzy2 »

I'd like to agree. But I can't. Even if disregard detection scores, Defender/Security Essentials is slow. It uses humongous amounts of CPU time, which slows down slower PCs (like Celeron N3150) a lot. It also tends to saturate disk I/O.

In short: It sucks so bad it's virtually unusable.

Re: Avoid Non-Microsoft Antivirus Software

#144

Post by hsivonen »

ForFreedom wrote: post #127

I got for free Norton Security with my new Dell laptop. On installing I was unable to enable windows defender or firewall. Norton takes over the security by default. I contacted Symantec and had to uninstall Norton Security and install Norton Antivirus for the windows firewall to be activated.

The first thing you should do with a PC is to delete all partitions and install a fresh OS. Even if you aren't installing Linux, you should download untampered Windows 10 (the same edition that the PC came licensed for) from Microsoft and do a fresh install without OEMware.

Re: Avoid Non-Microsoft Antivirus Software

#146

Post by kbart »

neko_koneko wrote: post #133
lmns wrote: post #113

Earlier quoted context omitted.

That's exactly what I had in mind when I read the GP. If third party AVs have a large and complex codebase with unknown or even known security flaws, they won't help much against targeted attacks or make them even easier. On the other hand, AV usability is so bad you can't expect it to help "normal" people. All those popups do more harm than good when people start ignoring them.

Well, I agree that AV most likely wouldn't protect you against targeted attacks - but most of the attacks that we investigated were targeted quite broadly - phishing email campaigns targeting financial organizations (with address lists based on some hacked legitimate resources for accountants, for example). And usually these attack succeeded because of insecure infrastructure, poorly trained admins, old, non-updating…

"usually these attack succeeded because of insecure infrastructure, poorly trained admins, old, non-updating systems (some people still think using Windows XP on internet-connected computers is fine)"

In this case, there are much bigger problems than the lack of AV.

Re: Avoid Non-Microsoft Antivirus Software

#147

Post by zrm »

disiplus wrote: post #108
zrm wrote: post #85

Earlier quoted context omitted.

That is a bad idea. If you MITM the connection locally it triples the computational cost for both encryption and handshake operations. Then more websites don't use TLS because it's three times as slow for the user. It also prevents you from using a good cipher suite when the MITM doesn't support it even though the browser and the server both do, again reducing security or performance or both. And it's very easy to sc…

ok some of those are valid concerns but i would argue that being infected trumps all of those. they have to get it only once.

Compromising TLS is an infection vector. People regularly download programs from trusted websites and run them. Some apps automatically download updates from the vendor's site via TLS.

AV scanners do not have a 100% detection rate. Letting malware be where a trusted program is expected is how you get infected.

Re: Avoid Non-Microsoft Antivirus Software

#148

Post by hannob »

bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

I've written and talked about this a couple of times. Each and every one of these products does some kind of TLS security degredation:

* https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-...

* https://media.ccc.de/v/camp2015-6833-tls_interception_consid...

Re: Avoid Non-Microsoft Antivirus Software

#149

Post by technion »

mavhc wrote: post #82
technion wrote: post #26

Earlier quoted context omitted.

An extraordinary amount of Cryptolocker outbreaks were due to .docx files containing macros. Yes, it has a default behaviour of "prompt to execute macros", but it happily shows the advice in the malicious document to "please click yes at this prompt to get a free iPhone", at which point the majority of users click "yes".

.docx files can't contain macros

Correction: It's .doc files I've seen the majority of this behaviour in.

Re: Avoid Non-Microsoft Antivirus Software

#150

Post by bad_user »

bjd2385 wrote: post #92
tomaskafka wrote: post #90

Earlier quoted context omitted.

Yes. Also, let's finally start a public discussion about AV companies making money by selling data (they do, either all of them or most). Of course that being able to peek into https traffic gets them more data (specific urls, not just whole sites).

_Everyone_ is collecting our data nowadays. Who's left to sell it to?

Not true. Google collects your searches. They don't sell your searches, they sell whatever they infer from your searches (your compiled and quite vague profile and I know, because I interacted with their AdSense platform), because they'd be stupid to sell your actual searches, since that's their most valuable property.

Does anybody else know your search history? Besides the NSA, whom I assume have access to all US-hosted data, no. And not even Google knows my most sensitive searches, because my private mode is a Tor Browser connecting to DuckDuckGo, answering for my porn needs mostly.

And I trust Google to keep my data safe more than I trust shady AV companies, because Google has hired a lot of security researchers, at their size all eyes are watching them and their behavior has been acceptable compared with that of others like Facebook.

Information security is all about compartmentalization ;-)

Post reply on HN