Reply to thread

Message

<blockquote data-quote="Tiamati" data-source="post: 874109" data-attributes="member: 56785">I checked and despite i run some sites, MBG only connected to one url for update. It was in clear text and used TLS 1.2. [ATTACH=full]237506[/ATTACH]The url was: The &quot;Console&quot; tab showed that it was inspecting pages and whitelisting them, probably based on its local database. However i can&#039;t confirm that. But, if i&#039;m correct, the requested url would be a way to update the mentioned database. Maybe, if Malwarebytes acts comparing and processing your sites/files/images/scripts with a list locally, it would explain why so many people complain about its impact in performance and loading pages. If you visit a few pages and check the console tab, you&#039;ll see that it does a LOT more process than BTL[ATTACH=full]237504[/ATTACH]However it&#039;s not clear if the database updated by MBG contains a whole list of sites, or only the ones you visit. It seems to be the first option, cause after the update, i loaded a few pages without any further requests from MBG. Despite that, after some digging, and exploring less known pages, MBG requested some info using hashs and TLS 1.3. There is no way i can confirm, but i would assume that MBG works locally with a database of frequently asked pages. But if you access anything that is not usual, it will request it through TLS 1.3 using hashs. That&#039;s good. Maybe someone could help me to confirm that. Maybe [USER=24327]@Fabian Wosar[/USER] Indeed. However we must keep attention with browsers not fully compatible with AV, like Brave. For example, it can&#039;t be protected by kaspersky antipishing protection, but it can use BTL for that. Good to know. Unfortunately, it&#039;s heavy. =[</blockquote>

[QUOTE="Tiamati, post: 874109, member: 56785"] I checked and despite i run some sites, MBG only connected to one url for update. It was in clear text and used [B][COLOR=rgb(226, 80, 65)]TLS 1.2[/COLOR][/B]. [ATTACH type="full"]237506[/ATTACH] The url was: The "Console" tab showed that it was inspecting pages and whitelisting them, probably based on its local database. However i can't confirm that. But, if i'm correct, the requested url would be a way to update the mentioned database. Maybe, if Malwarebytes acts comparing and processing your sites/files/images/scripts with a list locally, it would explain why so many people complain about its impact in performance and loading pages. If you visit a few pages and check the console tab, you'll see that it does a LOT more process than BTL [ATTACH type="full"]237504[/ATTACH] However it's not clear if the database updated by MBG contains a whole list of sites, or only the ones you visit. It seems to be the first option, cause after the update, i loaded a few pages without any further requests from MBG. Despite that, after some digging, and exploring less known pages, MBG requested some info using hashs and TLS 1.3. There is no way i can confirm, but i would assume that MBG works locally with a database of frequently asked pages. But if you access anything that is not usual, it will request it through TLS 1.3 using hashs. That's good. Maybe someone could help me to confirm that. Maybe [USER=24327]@Fabian Wosar[/USER] Indeed. However we must keep attention with browsers not fully compatible with AV, like Brave. For example, it can't be protected by kaspersky antipishing protection, but it can use BTL for that. Good to know. Unfortunately, it's heavy. =[ [/QUOTE]

Verification