Advice Request I've officially changed my stance on HTTPS scanning

[monkeylove]

I've been using either Avast Free or Kaspersky Security Cloud Free with Adguard for Desktop, and with scanning on for both, and visit dozens of sites when I search for text, applications, videos, and pictures. I sometimes see sites that are blocked by either the security program or Adguard because they contain malware, etc.

 

[amirr]

Most websites nowadays are under HTTPs and that includes malicious websites.

Is your choice if you wanna be secured on malicious HTTPs websites or not, Kaspersky won't fail to protect you with or without HTTPs scanning anyway.

What you said was regarding disabling those settings I mentioned in the screenshot, right? I mean this screenshot:

 

[HarborFront]

I disabled HTTPS scanning in KIS but enabled in Adguard for Windows

 

[Moonhorse]

I rather use adguard over antivirus that is injecting into https

 

[Local Host]

Yes they are. The traffic is sent via SYSTEM or other low-level processes.

AppCrash dumps and system memory dumps, along with logs, have always been automatically uploaded to Microsoft.

You are the big expert here, and yet you don't even know about what Microsoft has documented for well over a decade ?

It is documented by Microsoft yes, but nothing is automatically sent, I'm sorry you constantly miss the Window that asks if you wanna send your crash logs to Microsoft to help solve the issue, cause I clearly haven't.

 

[ForgottenSeer 92963]

I have always disabled HTTPS scanning, even when browsers had no low rights containers. Since he Microsoft Nozzle and Sozzle javascript sanitizing studies (yes those projects really had those names) and the Chrome browser introduction with its internal sandbox and tthe need to stop bad stuff as early as possible also became less relevant IMO.

Also HTTPS scanning often was combined with injecting DLL in the browser. These modules were often so badly designed and tested that they contained serious security risks. It was so bad that Google even threathened to block DLL injection in its browser.

The AV-community turned that threat into an opportunity for Google to snoop on us (and launched the Google ID gossip). This made Google return on its tracks, because it had to deal with bad PR issues concerning the loss of privacy when using Chrome.

Chrome in its turn started project Zero (to find and prevent Zero days in the wild) and positioned Tavis Ormandy as the lead speaker to make security companies and programs ridiculous because of the bugs/vulnabilities/security holes those so called security vendors had in their own software. Anyone ever questioned why a company would waist time of a top notch researcher into debugging software from another company? The only feasible answer could be to create awareness and real world proof of Google's take on this matter.

The hilareous (or ashamingly sad depending on your take on it) twitter posts of Tavis Ormandy made clear to me that "NO MAN IN HIS RIGHT MIND SHOULD EVER PUNCH A HOLE IN A SECURITY MECHANISM USING THE EXCUSE OF INCREASED SECURITY".

To the OP and all agreeing with him: I am glad you have made the right choice.

 

[harlan4096]

I would say/bet that part of the Windows telemetry is hard-coded and can't be disabled by 3rd party tools nor by the own Windows settings...

 

[Local Host]

There is no prompt for file uploads except by Microsoft Defender on Windows 10.

All WER, BSOD default dumps as well as all telemetry are automatically uploaded. That includes both Kernel and User Mode dumps\telemetry. 3rd parties can program file uploads and telemetry that is far more extensive than Microsoft's defaults. It has been that way since, like, forever.

Try harder expert.

There is a prompt, you confusing crash logs with general telemetry is not helping your case, and honestly I don't have time to waste on this nonsense.

 

[SeriousHoax]

Avast uses a different method for HTTPS inspection, without injecting fake certificates into the browser. This doesn't seem to break HTTPS on the browser level, and even preferred by browser vendors over the widely used by AV vendor's MITM method. Privacy is still violated if that's your main concern because Avast sees and scans everything loaded by the browser, but this method is better and even faster in my experience. I mean, page loads faster for me with Avast than with Kaspersky/ESET/Bitdefender when they do HTTPS scanning.

Given the shortcomings of using a MITM proxy, it appears that Avast has moved on to a newer technique, using the SSLKeyLogFile to leak the secret keys HTTPS negotiates on each connection to encrypt the traffic. Firefox and Chromium support this feature, and it enables decryption of TLS traffic without using the MITM certificate generation technique. While browser vendors are wary of any sort of interception of HTTPS traffic, this approach is generally preferable to MITM proxies.

Spying on HTTPS

When I launched Chrome on Thursday, I saw something unexpected: While most users probably would have no idea what to make of this, I happened to know what it means– Chrome is warning me that …

textslashplain.com

 

[Deletedmessiah]

Avast uses a different method for HTTPS inspection, without injecting fake certificates into the browser. This doesn't seem to break HTTPS on the browser level, and even preferred by browser vendors over the widely used by AV vendor's MITM method. Privacy is still violated if that's your main concern because Avast sees and scans everything loaded by the browser, but this method is better and even faster in my experience. I mean, page loads faster for me with Avast than with Kaspersky/ESET/Bitdefender when they do HTTPS scanning.

Spying on HTTPS

When I launched Chrome on Thursday, I saw something unexpected: While most users probably would have no idea what to make of this, I happened to know what it means– Chrome is warning me that …

textslashplain.com

Hope Adguard will use this if they haven't already.

 

[Local Host]

Hope Adguard will use this if they haven't already.

They don't, not yet anyway.

Can't say for any plans of implementing this, surely that method is not all flowers, we'll see in the future.