Reply to thread

Message

<blockquote data-quote="SeriousHoax" data-source="post: 1033005" data-attributes="member: 78686">Just keep in mind that Kaspersky (also ESET) have many signatures that are tied to their web protection engine only and won&#039;t get detected by their file based protection signatures. So if there&#039;s a malicious script that the browser run to attempt something malicious, they may not get detected by Kaspersky &amp; ESET when HTTPS scanning is off. Some other AV products which don&#039;t have MITMing for HTTPS scanning but have file based signatures for those scripts may detect them on browser cache or some other ways, but Kaspersky and ESET won&#039;t. That&#039;s because they don&#039;t expect you to turn off HTTPS scanning. Their product wasn&#039;t designed to be used without it. They separate the file based and web based signatures to improve performance (Kaspersky analyst told me).Also weirdly, I have seen Kaspersky not detecting some known malicious site and malware CnC server without HTTPS scanning. They were detected on Virustotal and Opentip, but not on their product when HTTPS scanning is off.Avast and Bitdefender don&#039;t have separate signatures for file and web based protection, it seems. I can not guarantee with 100% certainty but haven&#039;t been able to find something to prove otherwise. HTTPS scanning can be turned off in Avast without losing too much of the protection, I think. In Bitdefender, disabling &quot;Encrypted web scan&quot; completely disable filtering of HTTPS traffic, so web protection becomes almost useless.So, only turn off Kaspersky&#039;s HTTPS scanning if you are comfortable with losing a certain amount of protection.Edit: HTTPS scanning can be replaced by Web scanning/Web shield/Web protection, etc. but the reasoning and explanation will remain the same.</blockquote>

[QUOTE="SeriousHoax, post: 1033005, member: 78686"] Just keep in mind that Kaspersky (also ESET) have many signatures that are tied to their web protection engine only and won't get detected by their file based protection signatures. So if there's a malicious script that the browser run to attempt something malicious, they may not get detected by Kaspersky & ESET when HTTPS scanning is off. Some other AV products which don't have MITMing for HTTPS scanning but have file based signatures for those scripts may detect them on browser cache or some other ways, but Kaspersky and ESET won't. That's because they don't expect you to turn off HTTPS scanning. Their product wasn't designed to be used without it. They separate the file based and web based signatures to improve performance (Kaspersky analyst told me). Also weirdly, I have seen Kaspersky not detecting some known malicious site and malware CnC server without HTTPS scanning. They were detected on Virustotal and Opentip, but not on their product when HTTPS scanning is off. Avast and Bitdefender don't have separate signatures for file and web based protection, it seems. I can not guarantee with 100% certainty but haven't been able to find something to prove otherwise. HTTPS scanning can be turned off in Avast without losing too much of the protection, I think. In Bitdefender, disabling "Encrypted web scan" completely disable filtering of HTTPS traffic, so web protection becomes almost useless. So, only turn off Kaspersky's HTTPS scanning if you are comfortable with losing a certain amount of protection. Edit: HTTPS scanning can be replaced by Web scanning/Web shield/Web protection, etc. but the reasoning and explanation will remain the same. [/QUOTE]

Verification