4 ms·
I don't use Avast myself (for obvious reasons), but how do they get around HTTPS encryption? Do they install a self-signed root certificate into the OS/browser?
by jannes 7y ago
I don't use Avast myself (for obvious reasons), but how do they get around HTTPS encryption? Do they install a self-signed root certificate into the OS/browser? Wouldn't that be easily detectable?
- RL_Quine 7y agoIf you’re injecting into the browser you don’t need to worry about SSL- that’s handled for you.
- stordoff 7y agoThey can instruct the browser to log/leak HTTPS keys: https://textslashplain.com/2019/08/11/spying-on-https/ https://textslashplain.com/2019/08/11/spying-on-https/ NB this article also notes the selling of data - from the article it cites: > Jumpshot is the data arm of Avast[...] This suite of products, in order to function, must collect and analyze every URL visited by every browser of every machine on which its installed. [...] Because Avast has to see and process all these URLs anyway (in order to serve their function of providing web security), they anonymize, aggregate, and remove any personally-identifiable information from the browser URL visits and then provide them to Jumpshot, who then makes estimates about broad web usage behavior. In my opinion, this is both an ethical way to gather crucial data about what’s happening on the web[...]
- tomaskafka 7y agoThey aren't "making estimates about broad usage behavior", they just sell the raw clickstream. Amd lie.