Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 917754" data-attributes="member: 83059">Well it increases your protection against some threats and exposes you to others. For example if there&#039;s any flaws in how your AV inspects SSL certificates versus your browser, you could be more vulnerable to those issues. It would also allow drive-by attacks if there&#039;s exploitable certificate parsing bugs in your AV.It&#039;s absolutely a trade off, whether you expect to encounter more HTTPs malware served from neutral/good reputation hostnames, or if the privacy of having a system wide service be able to intercept end-to-end encrypted services slightly before it reaches the intended client service is acceptable.This was back in 2015-2017, but several AVs had known weaknesses when HTTPS scanning were enabled: <a href="https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-vulnerable-to-the-FREAK-attack-and-other-ways-Antivirus-software-lowers-your-HTTPS-security.html" target="_blank">How Kaspersky makes you vulnerable to the FREAK attack and other ways Antivirus software lowers your HTTPS security&nbsp; - Hanno&#039;s blog</a>And that&#039;s what scares me a bit about SSL inspection. Some of these AV implementations used to be worse than the browser.</blockquote>

[QUOTE="MacDefender, post: 917754, member: 83059"] Well it increases your protection against some threats and exposes you to others. For example if there's any flaws in how your AV inspects SSL certificates versus your browser, you could be more vulnerable to those issues. It would also allow drive-by attacks if there's exploitable certificate parsing bugs in your AV. It's absolutely a trade off, whether you expect to encounter more HTTPs malware served from neutral/good reputation hostnames, or if the privacy of having a system wide service be able to intercept end-to-end encrypted services slightly before it reaches the intended client service is acceptable. This was back in 2015-2017, but several AVs had known weaknesses when HTTPS scanning were enabled: [URL="https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-vulnerable-to-the-FREAK-attack-and-other-ways-Antivirus-software-lowers-your-HTTPS-security.html"]How Kaspersky makes you vulnerable to the FREAK attack and other ways Antivirus software lowers your HTTPS security - Hanno's blog[/URL] And that's what scares me a bit about SSL inspection. Some of these AV implementations used to be worse than the browser. [/QUOTE]

Verification