Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Avoid Non-Microsoft Antivirus Software

robert.ocallahan.org

Post reply on HN
Print view View original

271–280 of 388 posts

Re: Avoid Non-Microsoft Antivirus Software

#271

Post by Broken_Hippo »

aszantu wrote: post #9

Granny won't believe me :( she feels safer because of some popup that tells her she's safe.

This is pretty common.

It isn't just the popup, though. "make sure you have anti-virus installed or else!" was the mantra drilled into people's heads 20 years back. This was the environment some folks learned to use the internet with. Perhaps she's seen her fair share of infections as well.

My mother is fairly similar in that regard, though she always blamed by brother and father for the infections. Since dad died and my brother isn't home, she may be easier to talk into change now.

Re: Avoid Non-Microsoft Antivirus Software

#272

Post by freehunter »

arpa wrote: post #248
neko_koneko wrote: post #76

Ok, disclaimer first: I've previously worked at Kaspersky Lab (incident response division). Now, I want to say that many of the incidents that we have investigated, would have been prevented by anti-virus software (in many cases AV software was deliberately disabled by user). And I'm talking about incidents that resulted in million-dollar thefts - not just cases of some user getting cryptolocker on their home compute…

Just to play the devils' advocate, I do think that the attitude of "never use AV products" could work in corporate environment, provided the administrators are competent and draconian enough to counter-weight the absolute incompetence of users (because, frankly, the largest attack surface is the incompetence of the user): use security policies of the domain to only allow whitelisted applications to be run; restrict i…

I work as a security consultant for a major tech company and my clients are almost always Fortune 500 (with some Fortune 100 companies, and at least one top-10 company). When they hire us, we get to learn everything about their security infrastructure.

The trend is clear: AV is out, Carbon Black (or Crowdstrike, etc) is in. This is especially prominent in the financial industry. My wife works at a tiny local bank and they're doing trials of Carbon Black.

AV is terrible software, the chemotherapy of the security world. It only exists because it's slightly better than the alternative, and if you don't have an active disease, it acts as a disease of its own. You're glad its there when it saves your life, but you curse its name every day. Application whitelisting tools don't interfere with the day-to-day workings of your computer, but don't let the bad stuff in. You're only allowed to run the software you need to run, and nothing else.

It's not set-it-and-forget-it like AV, but it's a damn sight more effective and less annoying to the users.

Re: Avoid Non-Microsoft Antivirus Software

#273

Post by chopin »

rocqua wrote: post #236
bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

How does that work with chromes certificate pinning for google? Do they do some runtime modification (e.g. DLL-injection) to disable the check?

It does not work with certificates installed by the user.

Re: Avoid Non-Microsoft Antivirus Software

#274

Post by krisgenre »

bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

Ya!

I only recently noticed this when Google chrome started marking even gmail.com as insecure on my dad's laptop.

Turned out that the Bitdefender license had expired and somehow this made certificate validation to fail?

Re: Avoid Non-Microsoft Antivirus Software

#275

Post by tim333 »

floatboth wrote: post #220
NameNickHN wrote: post #112

Earlier quoted context omitted.

Any AV software is better than having none but that's not the point of the article. It specifically recommends Microsoft's AV and to stay clear of all the others. I'm sure it's hard on all the AV vendors out there but with Microsoft Essentials and Windows Defender I don't see the need for a third party AV.

Forget even Windows Defender. The one and only "AV" a normal user will ever need is… Google Safe Browsing. Seriously. Anything you download is already checked with Google, why waste CPU cycles on checking it again locally?

I'd also recommend uBlock Origin or similar. The number of fake download links you see otherwise is scary.

Re: Avoid Non-Microsoft Antivirus Software

#277

Post by voltagex_ »

ThisIs_MyName wrote: post #270
rocqua wrote: post #236

Earlier quoted context omitted.

How does that work with chromes certificate pinning for google? Do they do some runtime modification (e.g. DLL-injection) to disable the check?

Cert pinning ignores root certs. This is by design :( >The Chromium browser disables pinning for certificate chains with private root certificates to enable various corporate content inspection scanners and web debugging tools (such as mitmproxy or Fiddler). The RFC 7469 standard recommends disabling pinning violation reports for "user-defined" root certificates, where it is "acceptable" for the browser to disable pi…

The alternative would be no Chrome and/or Firefox at my workplace, and many others.

Re: Avoid Non-Microsoft Antivirus Software

#278

Post by ComodoHacker »

majewsky wrote: post #209
ComodoHacker wrote: post #91

Earlier quoted context omitted.

>The blocking of attacks reasoning is kind of bullshit >I have yet to see evidence that AV software is doing a better job of catching those I wouldn't be so one-sided. Imagine a fresh new variety of ransomware starts spreading. No one can catch it at 0-day, but good AV can catch it at 1-st day (OK, 1-st week) and neither Google nor uBlock or the likes can't.

Do you have any evidence for these claims? What's the concrete mechanism that allows AVs to observe and react to threats earlier than Google? (Since you allow up to 1 week of reaction time, I'll assume that you're not referring to heuristic detection methods.)

With cloud reputation service all AV user base (provided sufficiently large) turn into global sensor network, along with honeypots vendors maintain separately. This allows (at the cost of users' privacy) to detect new emerging threats within hours, then acquire samples, analyze them and deploy new signatures within days.

Google can of course react equally fast. But "signal delay" may be much higher, as users report only URLs they can immediately link to their troubles, e.g. malware that crash browser.

And second, what Google can do now is to block only one attack vector, namely web page.

Thinking rationally, chances are high that Google is seriously considering to enter the AV business. They are in highly advantageous position to do it successfully, with their user base, resources and AI tech.

Re: Avoid Non-Microsoft Antivirus Software

#279

Post by illys »

kofejnik wrote: post #225
illys wrote: post #176

Earlier quoted context omitted.

Actually, I still have a problem when all my "actual searches" becomes someone else's "most valuable property". Of course there are some other less intrusive search engines (DuckDuckGo, maybe Qwant), but unfortunately they still are less efficient than Google for fine or rare searches.

you are not paying for search service; ergo, your searches are the product and your search results are but a byproduct of that product

I agree with ysavir: I do not mind being exposed to ads related to my current search - I understand it is the price to pay for a free service... I mind my searches being stored and attached to my (not event anonymous) profile in a database.

And the "not even anonymous" is not an option: to be able to have a fully functioning phone, I hardly can escape declaring my full details to Google.

And this is clearly an "evil" choice of Google: I never created a Linux, Debian, Ubuntu or Mint account to keep my desktop computer up-to-date and featured by additional apps.

Post reply on HN