Avast’s man in the middle

Re:Avast’s man in the middle by venomsnake on Sunday December 13, 2015 @03:23PM (#10727754)

> The only real problem here is not checking the validity certs. (Which is an incredibly serious problem.)

There are other problems. I am not sure where the third party doctrine will stand, but you are trusting all of your secure connections to a third party with full consent.

If avast get subpoenaed and their software has called home, which any antivirus does - they must collect new samples all the time - this could spell trouble.

[ Parent | on HN ]

Re:Avast’s man in the middle by fidget on Sunday December 13, 2015 @03:29PM (#10727779)

It wouldn't be particuarly hard for avast to operate this system without having the key for the CA leaving your machine.

[ Parent | on HN ]

Re:Avast’s man in the middle by venomsnake on Sunday December 13, 2015 @03:33PM (#10727800)

That won't help when they send part of the plaintext home. Which any antivirus program does from time to time

[ Parent | on HN ]

Re:Avast’s man in the middle by muteh on Sunday December 13, 2015 @03:33PM (#10727797)

It might not be hard for them to do it, but how is the end user meant to know to ask if they do?

[ Parent | on HN ]