News for hackers. Stuff that matters.

A comment on Avoid Non-Microsoft Antivirus Software. Parent comment

Re:Avoid Non-Microsoft Antivirus Software by billpg on Thursday January 26, 2017 @04:32AM (#13489955)
Don't most browsers have hooks for AV (and other plugins) to get into web traffic without having to mess with TLS?
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by bad_user on Thursday January 26, 2017 @04:46AM (#13490019)
No, I don't think so and if it does, please tell me which browser does it so I can keep away from it, because that defeats the purpose of TLS.

Either way, Bitdefender installs their own root certificate and generates their own for google.com. I've got proof if you want.

[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by gtirloni on Thursday January 26, 2017 @05:05AM (#13490108)
I don't think it defeats the purpose of TLS.

From Wikipedia: "TLS and SSL are cryptographic protocols that provide communications security over a computer network". Your host is not "the network" and it's expected to be your trusted asset.

If the AV software can't be trusted, that's another issue not addressed by TLS.

[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by icebraining on Thursday January 26, 2017 @07:46AM (#13490862)
No, I don't think so and if it does, please tell me which browser does it so I can keep away from it, because that defeats the purpose of TLS.

AVs generally run with complete permissions, and can do everything up to and including injecting their own code inside your browser's running process. Providing them with an API doesn't weaken the security, it just reduces the chances they'll screw the browser up.

[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by tokenizerrr on Thursday January 26, 2017 @05:01AM (#13490088)
Chrome, Firefox. Probably more. https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NS...
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by hsivonen on Thursday January 26, 2017 @05:32AM (#13490230)
That's for the Wireshark debugging use case.
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by tokenizerrr on Thursday January 26, 2017 @06:23AM (#13490476)
Indeed it is, yet it can be used for other things as well. Such as an AV that would want to MITM everything without supplying its own CA.
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by hsivonen on Thursday January 26, 2017 @06:54AM (#13490600)
Is some AV product using it for that?
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by mercurialuser on Thursday January 26, 2017 @07:22AM (#13490730)
Trend micro officescan, their enterprise offering, has plugins for Firefox.

Well, it had a plugin that got disabled by following Firefox updates.

[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by slrz on Thursday January 26, 2017 @08:58PM (#13497130)
And that is using the NSS key dump files?
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by mosselman on Thursday January 26, 2017 @07:54AM (#13490903)
I have bitdefender and I was wondering how I can check if it does it on my pc and mac and how I can disable it (if possible). Could you help me in the right direction?
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by hrez on Thursday January 26, 2017 @05:21PM (#13495817)
Open https://www.google.com/ and see what cert you've got. If it's "bitdefender something" instead of google then uncheck "Scan SSL" in bitdefender and google how to remove root cert from trusted root cert store assuming former doesn't do it for you.
[ Parent | on HN ]