4 ms·

Many antivirus applications install a local certificate authority so they can MITM HTTPS. From my experience most fail to check the original CA meaning anyone

• vbezhenar 7y ago
  They should generate that certificate along with private key on your local machine, so it does not allow anyone else to intercept your traffic. Even seemingly harmless applications can do that. For example Blizzard Battle.net Launcher (used for all games) does that.
  • tempay 7y ago
    The issue is that you must check the external connection, i.e. <-2-> in: User <-1-> antivirus <-2-> Site If not a hostile actor can inject themselves in a way which is completely invisible to the user: User <-1-> antivirus <-2-> Hostile <-3-> Site Actually checking <-2-> is tricky but many antivirus tools don't even try.[1] [1] https://news.ycombinator.com/item?id=10727431 https://news.ycombinator.com/item?id=10727431
    • vbezhenar 7y ago
      Well, if antivirus does MITM and does not check website certificate properly, it's seriously broken. I expected that any MITM proxy properly validates server certificate.