Serious Discussion Bitdefender Encrypted Web Scan

[Divine_Barakah]

This was the reason why I stopped using BD. The issue is not universal as some users did not report the same behaviour.

https://www.reddit.com/r/BitDefender/s/8bP3X5VWRV

Now if one chooses to disable Encrypted Web scan, is the effect on protection negligible?

 

[Zero Knowledge]

Yet if you work in the private/public sector you have many edge devices decrypting traffic and breaking SSL and TLS. That boat of caring has long sailed my friend.

 

[Nunzio_77]

I have never had any problems of this type using Bitdefender, whether paid or free.

 

[Divine_Barakah]

I have never had any problems of this type using Bitdefender, whether paid or free.

Neither has my sister. BD is working flawlessly on her laptop. That's why I said the issue is not universal.

 

[Wrecker4923]

is the effect on protection negligible?

Haha, the inverse question is: why have it if it doesn’t help you with anything? Regardless, it's a layer that contributes to the 99.xx% effectiveness of real-world protection.

The first layer is TrafficLight. If that misses, then it’s the web traffic inspection. Without the web traffic inspection, then it’s going to be file read/write/execution, just like MD. If you go on the BD forums when people complain “TrafficLight didn’t catch it,” the answer is often that BD blocks it anyway (at the traffic inspection).

I’ve never had such problems with BD or Avast regarding the web traffic inspection either—it’s pretty non-intrusive until you start thinking, oh… it sees all my encrypted traffic, including my password that isn’t additionally encrypted.

 

[Divine_Barakah]

Haha, the inverse question is: why have it if it doesn’t help you with anything? Regardless, it's a layer that contributes to the 99.xx% effectiveness of real-world protection.

The first layer is TrafficLight. If that misses, then it’s the web traffic inspection. Without the web traffic inspection, then it’s going to be file read/write/execution, just like MD. If you go on the BD forums when people protest "TrafficLight didn't catch it," the answer often is, BD blocks it (at the traffic inspection) anyway.

I’ve never had such problems with BD or Avast regarding the web traffic inspection either—it’s pretty non-intrusive until you start thinking, oh… it sees all my encrypted traffic, including my password that isn’t additionally encrypted.

You're right I should have made my question clearer. Now the question would BDTL make up for the disabled encrypted Web scan?

 

[Parkinsond]

Now if one chooses to disable Encrypted Web scan, is the effect on protection negligible?

I have web guard component removed from Avast.
No it will not cause significant harm; just waiting for the malware to land on my drive to be detected.

 

[Parkinsond]

You're right I should have made my question clearer. Now the question would BDTL make up for the disabled encrypted Web scan?

It should not be equal to encrypted traffic scan; it just compare the domain against a predefined blacklist.

 

[Wrecker4923]

Now the question would BDTL make up for the disabled encrypted Web scan?

Although I won't argue for MT members, I'd argue that for a typical user (as in this post), leaving all the protection modules may be better in some cases. Reading encrypted traffic seems common enough for 3rd-party AV anyway. As I mentioned in the prior comment, I did see an intercept at the web inspection, but not at TrafficLight. Whether or not that incident would have been caught at the file level is unknown, but presumably so.

 

[Parkinsond]

Although I won't argue for MT members, I'd argue that for a typical user (as in this post), leaving all the protection modules may be better in some cases. Reading encrypted traffic seems common enough for 3rd-party AV anyway. As I mentioned in the prior comment, I did see an intercept at the web inspection, but not at TrafficLight. Whether or not that incident would have been caught at the file level is unknown, but presumably so.

Encypted traffic scan comes at a cost of tampering with websites certificates (which is considered by some as an additional vulnerability) and taxing performance (cpu usage) only to block few downloads of malicious files that can be blocked as soon as they are downloaded (the same fingerprint exposing it before download will expose it after download before execution).

I prefer the way MD works without encrypted traffic scan, and I modify any 3rd party AV to work the same way.

3rd party AVs need to add extra layers and methods to justify paying for, rather than additional security.

 

[Nunzio_77]

Encypted traffic scan comes at a cost of tampering with websites certificates (which is considered by some as an additional vulnerability) and taxing performance (cpu usage) only to block few downloads of malicious files that can be blocked as soon as they are downloaded (the same fingerprint exposing it before download will expose it after download before execution).

I prefer the way MD works without encrypted traffic scan, and I modify any 3rd party AV to work the same way.

3rd party AVs need to add extra layers and methods to justify paying for, rather than additional security.

So if it's like you say, Panda Dome Free is also good even without web protection enabled?
Like AV Free, they claim it's very light on PC resources, perhaps more so than MD.

 

[Parkinsond]

So if it's like you say, Panda Dome Free is also good even without web protection enabled?
Like AV Free, they claim it's very light on PC resources, perhaps more so than MD.

Panda dome can skip detection of malicious file after being downloaded; MD and Avast will not.

 

[Wrecker4923]

that can be blocked as soon as they are downloaded (the same fingerprint exposing it before download will expose it after download before execution).

Although I hope what you say is true, again, by the post I mentioned, from VT perspectives, ESET caught the clickfix activity executed from PowerShell via either the URL or web inspection, but didn’t pick up the malicious .dll file.

Regardless, though, the numbers you see in AV-Comparatives’ real-world reports come from the default configurations with all the default modules enabled. How do consumers test whether disabling a module would give the same result? Just like medicine, it’s more repeatable to stick with the studied dosage, etc.

 

[Parkinsond]

ESET caught the clickfix activity executed from PowerShell via either the URL or web inspection, but didn’t pick up the malicious .dll file

Clickfix can be easily avoided just by reading a couple of lines online explaining its existence.
The one who fall for clickfix severely lacks common, basic knowledge.
For me, the only job of AV is to detect tampered installer downloaded from a compromised official website; the rest I can take care of without any AV.

 

[DDE_Server]

The post that comes after I renewed my Bitdefender individual premium for another one year yesterday lol

Actually, Bitdefender is one of the set-and-forget solutions. iam using it for 5 devices since 2019 and cannot not to renew it . i like the new AI scam protections, and it is VPN is good also, but value for money. They offered me a 50% discount from 129 to 51 USD for Auto renew and i cannot resist it lol

 

[DDE_Server]

Clickfix can be easily avoided just by reading a couple of lines online explaining its existence.
The one who fall for clickfix severely lacks common, basic knowledge.
For me, the only job of AV is to detect tampered installer downloaded from a compromised official website; the rest I can take care of without any AV.

This is hard also sometimes for AV as the private key may be leaked and a malicious installer can be placed on the official website with valid hashes lol like it has done before in Ccleaner

 

[Wrecker4923]

If you aren't annoyed by the quirks in BD, I don't see why it wouldn't be a good choice.

 

[Parkinsond]

This is hard also sometimes for AV as the private key may be leaked and a malicious installer can be placed on the official website with valid hashes lol like it has done before in Ccleaner

So no need for AV for me