4 ms·

I'm not a security expert, but always had a feeling that browsers mostly just need to sandbox websites, so websites cannot do any critical operations that would

I'm not a security expert, but always had a feeling that browsers mostly just need to sandbox websites, so websites cannot do any critical operations that would require AV supervision. "Soft" vulnerabilies like files downloaded and executed are critical outside of the browser, and that's where AV makes sense to me. But I don't want an invasive plugin telling me "this link is safe" with a green, flashing icon. So I've always been trying to just switch off all browser-related features of my AV, but are there AVs that are less aggressive in this matter by nature?

Animats 10y ago
browsers mostly just need to sandbox websites, so websites cannot do any critical operations that would require AV supervision. That's the way it ought to work. But it's so tempting to launch stuff from the browser, from Adobe Reader to Flash to Microsoft's "protocol types" which launch apps. The proper role of antivirus programs is as a "guard". When you download a file, a program looks at it and decides if it should be allowed in. This at least gets rid of all those attack .zip files that show up in email attachments. It also has a well-defined interface with the application.
- mschuster91 10y ago
  > But it's so tempting to launch stuff from the browser, from Adobe Reader to Flash to Microsoft's "protocol types" which launch apps. The latter (MS protocol types) is not at all MS specific. Let's list some well known examples: - Apple's itms "protocol", itms:xxx opens either iTunes or the App Store, also on OS X (this is how "Download from Mac App store" works) - MS Communicator/Skype for Business (one of them is the successor of the other, I always forget which one) uses this to start conferences after you installed the respective app - Spotify does something even worse, the client appears to launch a http server, and e.g. when you log in to facebook on your browser, it supplies the used port to their oauth redirector - which in turn gives the auth token to Spotify via calling http://localhost:xxx/yyy http://localhost:xxx/yyy. - all major mail programs use the "mailto" protocol; the OS loads the user-defined MUA with options for pre-fill (body, subject, recipient(s))
  - majewsky 10y ago
    > MS Communicator/Skype for Business (one of them is the successor of the other, I always forget which one) "Skype for Business" is the successor for Lync, at least in our org. I haven't heard of Communicator before, though.
    - mschuster91 10y ago
      It's a Lync client, according to Wikipedia. One of the customers of my company uses it. The amount of different apps and solutions for teleconferences is just astounding. One might think that there is a common standard or something... but no, I have at least four distinct communication apps on my Mac. m(
Klathmon 10y ago
>are there AVs that are less aggressive in this matter by nature? Yes, if you are on windows, just use Windows Defender (AKA Microsoft Security Essentials). You'll read how it doesn't detect as much as the others and it doesn't have any fancy features, but all that means is that it won't have a ton of false positives (i've only ever had one false positive with it ever), it won't try to upsell you to a premium service, it can be disabled/turned-off with one click, and most importantly it won't weaken the security of your whole system.

Animats 10y ago

browsers mostly just need to sandbox websites, so websites cannot do any critical operations that would require AV supervision. That's the way it ought to work. But it's so tempting to launch stuff from the browser, from Adobe Reader to Flash to Microsoft's "protocol types" which launch apps. The proper role of antivirus programs is as a "guard". When you download a file, a program looks at it and decides if it should be allowed in. This at least gets rid of all those attack .zip files that show up in email attachments. It also has a well-defined interface with the application.

mschuster91 10y ago
> But it's so tempting to launch stuff from the browser, from Adobe Reader to Flash to Microsoft's "protocol types" which launch apps. The latter (MS protocol types) is not at all MS specific. Let's list some well known examples: - Apple's itms "protocol", itms:xxx opens either iTunes or the App Store, also on OS X (this is how "Download from Mac App store" works) - MS Communicator/Skype for Business (one of them is the successor of the other, I always forget which one) uses this to start conferences after you installed the respective app - Spotify does something even worse, the client appears to launch a http server, and e.g. when you log in to facebook on your browser, it supplies the used port to their oauth redirector - which in turn gives the auth token to Spotify via calling http://localhost:xxx/yyy http://localhost:xxx/yyy. - all major mail programs use the "mailto" protocol; the OS loads the user-defined MUA with options for pre-fill (body, subject, recipient(s))
- majewsky 10y ago
  > MS Communicator/Skype for Business (one of them is the successor of the other, I always forget which one) "Skype for Business" is the successor for Lync, at least in our org. I haven't heard of Communicator before, though.
  - mschuster91 10y ago
    It's a Lync client, according to Wikipedia. One of the customers of my company uses it. The amount of different apps and solutions for teleconferences is just astounding. One might think that there is a common standard or something... but no, I have at least four distinct communication apps on my Mac. m(

Klathmon 10y ago

>are there AVs that are less aggressive in this matter by nature? Yes, if you are on windows, just use Windows Defender (AKA Microsoft Security Essentials). You'll read how it doesn't detect as much as the others and it doesn't have any fancy features, but all that means is that it won't have a ton of false positives (i've only ever had one false positive with it ever), it won't try to upsell you to a premium service, it can be disabled/turned-off with one click, and most importantly it won't weaken the security of your whole system.