Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Don't most browsers have hooks for AV (and other plugins) to get into web traffic without having to mess with TLS?


No, I don't think so and if it does, please tell me which browser does it so I can keep away from it, because that defeats the purpose of TLS.

Either way, Bitdefender installs their own root certificate and generates their own for google.com. I've got proof if you want.


I don't think it defeats the purpose of TLS.

From Wikipedia: "TLS and SSL are cryptographic protocols that provide communications security over a computer network". Your host is not "the network" and it's expected to be your trusted asset.

If the AV software can't be trusted, that's another issue not addressed by TLS.


No, I don't think so and if it does, please tell me which browser does it so I can keep away from it, because that defeats the purpose of TLS.

AVs generally run with complete permissions, and can do everything up to and including injecting their own code inside your browser's running process. Providing them with an API doesn't weaken the security, it just reduces the chances they'll screw the browser up.



That's for the Wireshark debugging use case.


Indeed it is, yet it can be used for other things as well. Such as an AV that would want to MITM everything without supplying its own CA.


Is some AV product using it for that?


Trend micro officescan, their enterprise offering, has plugins for Firefox.

Well, it had a plugin that got disabled by following Firefox updates.


And that is using the NSS key dump files?


I have bitdefender and I was wondering how I can check if it does it on my pc and mac and how I can disable it (if possible). Could you help me in the right direction?


Open https://www.google.com/ and see what cert you've got. If it's "bitdefender something" instead of google then uncheck "Scan SSL" in bitdefender and google how to remove root cert from trusted root cert store assuming former doesn't do it for you.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: