4 ms·

I still don’t know if I’ve disabled HTTPS interception in ESET Internet Security. I went in Settings > Internet Protection > Web Access Protection > Web Protoco

I still don’t know if I’ve disabled HTTPS interception in ESET Internet Security. I went in Settings > Internet Protection > Web Access Protection > Web Protocols, and then disabled HTTPS checking, but I’m not sure if that’s it or if there’s more.

cesarb 10y ago
If you're using Firefox or Chrome, go to a site with an EV certificate (for instance https://twitter.com/ https://twitter.com/), and check if it shows the EV bar. These two browsers only accept EV certificates from a few hardcoded CAs, so if it's still being intercepted, it won't show as EV. Another option is to check the certificate for any website; for instance, the one for this site should chain to "COMODO RSA Certification Authority", and for me shows the SHA1 signature BB:DD:64:6F:EB:11:0C:D5:EC:CF:57:D1:F7:52:AA:99:50:1B:44:FD.
- lisivka 10y ago
  No EV bar at twitter site in Firefox in my case, nor at google.com, Facebook, etc., but thawte.com is displayed properly (Thawte, Inc. (US)). :-/
  - SimeVidas 10y ago
    Same here. I think we’re fine. The certificate chains don’t show anything suspicious.
tonyztan 10y ago
You can manually inspect the website certificate in your browser. If it is issued by a CA that looks like it is from your antivirus, then you haven't. Also, you can go to https://twitter.com/ https://twitter.com/ and see if the EV indicators show up ("Twitter, Inc. [US]" in green).
tracker1 10y ago
I generally disable all "web access protection" or similar. then again, on windows, I find that Windows Defender (since 10 includes the MS AV product) is good enough. I do use ublock origin and ghostery in my browsers though. Most of the web interceptor products break things in very interesting ways (as do ublock and ghostery), the difference being it's far easier to tweak a browser plugin. These AV companies should be browser plugins not a local reverse proxy.

cesarb 10y ago

If you're using Firefox or Chrome, go to a site with an EV certificate (for instance https://twitter.com/ https://twitter.com/), and check if it shows the EV bar. These two browsers only accept EV certificates from a few hardcoded CAs, so if it's still being intercepted, it won't show as EV. Another option is to check the certificate for any website; for instance, the one for this site should chain to "COMODO RSA Certification Authority", and for me shows the SHA1 signature BB:DD:64:6F:EB:11:0C:D5:EC:CF:57:D1:F7:52:AA:99:50:1B:44:FD.

lisivka 10y ago
No EV bar at twitter site in Firefox in my case, nor at google.com, Facebook, etc., but thawte.com is displayed properly (Thawte, Inc. (US)). :-/
- SimeVidas 10y ago
  Same here. I think we’re fine. The certificate chains don’t show anything suspicious.

tonyztan 10y ago

You can manually inspect the website certificate in your browser. If it is issued by a CA that looks like it is from your antivirus, then you haven't. Also, you can go to https://twitter.com/ https://twitter.com/ and see if the EV indicators show up ("Twitter, Inc. [US]" in green).

tracker1 10y ago

I generally disable all "web access protection" or similar. then again, on windows, I find that Windows Defender (since 10 includes the MS AV product) is good enough. I do use ublock origin and ghostery in my browsers though. Most of the web interceptor products break things in very interesting ways (as do ublock and ghostery), the difference being it's far easier to tweak a browser plugin. These AV companies should be browser plugins not a local reverse proxy.