4 ms·
Don't most browsers have hooks for AV (and other plugins) to get into web traffic without having to mess with TLS?
by billpg 10y ago
Don't most browsers have hooks for AV (and other plugins) to get into web traffic without having to mess with TLS?
- bad_user 10y agoNo, I don't think so and if it does, please tell me which browser does it so I can keep away from it, because that defeats the purpose of TLS. Either way, Bitdefender installs their own root certificate and generates their own for google.com. I've got proof if you want.
- tokenizerrr 10y agoChrome, Firefox. Probably more. https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NS...
- hsivonen 10y agoThat's for the Wireshark debugging use case.
- tokenizerrr 10y agoIndeed it is, yet it can be used for other things as well. Such as an AV that would want to MITM everything without supplying its own CA.
- hsivonen 10y agoIs some AV product using it for that?
- mercurialuser 10y agoTrend micro officescan, their enterprise offering, has plugins for Firefox. Well, it had a plugin that got disabled by following Firefox updates.
- slrz 10y agoAnd that is using the NSS key dump files?
- gtirloni 10y agoI don't think it defeats the purpose of TLS. From Wikipedia: "TLS and SSL are cryptographic protocols that provide communications security over a computer network". Your host is not "the network" and it's expected to be your trusted asset. If the AV software can't be trusted, that's another issue not addressed by TLS.
- icebraining 10y agoNo, I don't think so and if it does, please tell me which browser does it so I can keep away from it, because that defeats the purpose of TLS. AVs generally run with complete permissions, and can do everything up to and including injecting their own code inside your browser's running process. Providing them with an API doesn't weaken the security, it just reduces the chances they'll screw the browser up.
- mosselman 10y agoI have bitdefender and I was wondering how I can check if it does it on my pc and mac and how I can disable it (if possible). Could you help me in the right direction?
- hrez 10y agoOpen https://www.google.com/ https://www.google.com/ and see what cert you've got. If it's "bitdefender something" instead of google then uncheck "Scan SSL" in bitdefender and google how to remove root cert from trusted root cert store assuming former doesn't do it for you.