Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky in the Middle – what could possibly go wrong?

palant.de

Post reply on HN
Print view View original

21–30 of 45 posts

Re: Kaspersky in the Middle – what could possibly go wrong?

#21

Post by ziddoap »

beaverden wrote: post #19
zaarn wrote: post #5

Earlier quoted context omitted.

If you use Windows, use Windows Defender. It doesn't MitM your connections and has a comparable detection rates for 0days and common malware to all other modern AVs. Microsoft has put a lot of work into making Defender as secure as possible (you can even run it inside a VM so any exploit of defender is just trapped inside a HyperV VM instead of your system). There is no point in installing any other AV vendor; they a…

I disagree with the point you made about 0days and detection rates. Defender has less false positives, but almost never catch the files that actually matter, like important 0days or antiemulation and anti-unpack files. They are pretty slow with crafting generic detections. While I understand that data from well known tests may support your point, as an employee for 2+ years at a security vendor I can say with certain…

So presumably you have a product in mind which did catch all of these things, and are willing to point people in the proper direction?

Re: Kaspersky in the Middle – what could possibly go wrong?

#22

Post by hs86 »

mosselman wrote: post #3

Which other AntiVirus vendors do this? How can you opt-out and is there a point to installing anti-virus software to begin with?

Some time ago I tried Bitdefender on Windows and it immediately MitMed itself so that it could append green check marks after every search result on Google to signal me that that site is 'safe'.

There was no browser extension from Bitdefender involved and it applied to all installed browsers. Maybe browsers and Microsoft should actively fight this??

There is also AdGuard for Windows/Mac/Android which does this in order to block ads without the involvement of a browser extension. While this sounds like a bad alternative to uBlock Origin, it could be a necessary workaround in the future if Google succeeds with their Manifest V3 'conspiracy' against ad blockers. On Android it is also a better alternative to DNS/hosts based ad blockers because it won't leave blank ad placeholders in Chrome.

Re: Kaspersky in the Middle – what could possibly go wrong?

#23

Post by davrosthedalek »

klingonopera wrote: post #18
davrosthedalek wrote: post #6

Earlier quoted context omitted.

Or be protected from bank fraud. Not that the AV will stop it, but having no AV gives the banks a reason to reject the claim. At least with DB in Germany. But they accept Windows Defender!

German banks and technology are terrible! They're now using an app for authentication, that you can only get from Google's PlayStore or Apple's App Store. Germany, the country of data protection, and yet their banks force you to use Google/Apple. Oh sure, I can use terminals or pay money for a hardware device whose manufacturer has an exclusive contract with the bank, but this is absurd considering all they'd have to…

True. I guess they have to go through Apple's app store anyway, but they could offer the APK on their website.

On the other hand, I can set up a recurring payment, for free, from one account to a different account, at a different bank. In the US, my bank sends a check. Per snail-mail.

(Also: photoTAN is great. Could please all banks do that if they need an app anyway?)

Re: Kaspersky in the Middle – what could possibly go wrong?

#24

Post by _wolfie_ »

joobus wrote: post #15
mosselman wrote: post #3

Which other AntiVirus vendors do this? How can you opt-out and is there a point to installing anti-virus software to begin with?

I know Avast hijacks https traffic.

Yeah. And it even shows popup stating "Your browsing is insecure, update to avast premium" or something like that. Funny thing is, it happens (the popup) way more often when in internet banking or on porn sites. Kinda creepy.

Re: Kaspersky in the Middle – what could possibly go wrong?

#25

Post by [deleted] »

klingonopera wrote: post #18
davrosthedalek wrote: post #6

Earlier quoted context omitted.

Or be protected from bank fraud. Not that the AV will stop it, but having no AV gives the banks a reason to reject the claim. At least with DB in Germany. But they accept Windows Defender!

German banks and technology are terrible! They're now using an app for authentication, that you can only get from Google's PlayStore or Apple's App Store. Germany, the country of data protection, and yet their banks force you to use Google/Apple. Oh sure, I can use terminals or pay money for a hardware device whose manufacturer has an exclusive contract with the bank, but this is absurd considering all they'd have to…

[deleted]

Re: Kaspersky in the Middle – what could possibly go wrong?

#26

Post by TheDong »

FloayYerBoat wrote: post #8
mkl wrote: post #7

Earlier quoted context omitted.

Also, Microsoft has an incentive to eliminate viruses and malware completely - to make their OS safer. Third party AV companies rely on continuing threats to stay in business. I'm not saying AV companies hold back or help malware out, I'm saying Microsoft has good reason to throw huge resources at the problem as a whole.

...and to build on your comment: Incentive to not slow down the performance of the OS while protecting it.

I disagree that this incentive differs for Windows Defender vs other AVs.

All AV software has the desire to not negatively impact performance because if it's horribly slow people will uninstall it / quit paying for it.

The parent comment is pointing out that companies which primarily produce AV products benefit from the continued existence and fear of malware (to a degree at least). This is different for MS, as the eradication of Windows viruses will help Windows, which should be large enough a benefit to override any perverse incentives Windows Defender would otherwise have.

I know what you're trying to say is "also, Windows Defender isn't as slow", which happens to be true, but I think that's simply an emergent effect of other factors, such as AV companies feeling the need to "do more" to add value (whereas Windows Defender is funded by MS, so it has less incentive to "stand out").

Re: Kaspersky in the Middle – what could possibly go wrong?

#27

Post by sproketboy »

zaarn wrote: post #5
mosselman wrote: post #3

Which other AntiVirus vendors do this? How can you opt-out and is there a point to installing anti-virus software to begin with?

If you use Windows, use Windows Defender. It doesn't MitM your connections and has a comparable detection rates for 0days and common malware to all other modern AVs. Microsoft has put a lot of work into making Defender as secure as possible (you can even run it inside a VM so any exploit of defender is just trapped inside a HyperV VM instead of your system). There is no point in installing any other AV vendor; they a…

And we should listen to a Microsoft shill because? ....

Re: Kaspersky in the Middle – what could possibly go wrong?

#28

Post by cat199 »

mkl wrote: post #7
zaarn wrote: post #5

Earlier quoted context omitted.

If you use Windows, use Windows Defender. It doesn't MitM your connections and has a comparable detection rates for 0days and common malware to all other modern AVs. Microsoft has put a lot of work into making Defender as secure as possible (you can even run it inside a VM so any exploit of defender is just trapped inside a HyperV VM instead of your system). There is no point in installing any other AV vendor; they a…

Also, Microsoft has an incentive to eliminate viruses and malware completely - to make their OS safer. Third party AV companies rely on continuing threats to stay in business. I'm not saying AV companies hold back or help malware out, I'm saying Microsoft has good reason to throw huge resources at the problem as a whole.

> Third party AV companies rely on continuing threats to stay in business.

i'm pretty neutral on this topic, but doesn't this point by extension mean they have a more direct interest in discovering security flaws and publishing them rather than burying them under the rug if they haven't been seen in the wild?

Re: Kaspersky in the Middle – what could possibly go wrong?

#29

Post by mercules »

mosselman wrote: post #3

Which other AntiVirus vendors do this? How can you opt-out and is there a point to installing anti-virus software to begin with?

Most AntiVirus vendors have something that resembles this in at some portion of their solution. It is often found in the web-protection side, which can easily be disabled if necessary.

Re: Kaspersky in the Middle – what could possibly go wrong?

#30

Post by zamalek »

mosselman wrote: post #3

Which other AntiVirus vendors do this? How can you opt-out and is there a point to installing anti-virus software to begin with?

A few years back ESET MitM traffic (this can be disabled, but was the default), I'm not sure what the situation is now as I since switched to Defender precisely because of the MitM "feature."
Post reply on HN