The browser doesn't accept all this so BD has to re-encrypt the traffic to your browser, and to prevent certificate warnings, it has to install it's own Root CA in your browser first, so the browser will accept the certificate issued by Bitdefender and view it as legitimate. So BD negotiates the SSL/TLS connection and thus has control over what protocols and ciphers are used for the SSL traffic that passes through your WiFi, router, ISP, internet exchange point etc.īecause BD's SSL module doesn't support TLS 1.2 etc, they can't be used for that traffic.
So BD is doing the Man in the Middle locally on your PC, but because it is a MitM, the server is communicating with BD, not the browser. So I am thinking that web/http scanners don't add much (in fact they usually slow down browsing) when using a lot of SSL tools/connections and it is better to focus on SSL communication and the other security layers?Ĭlick to expand.Normally it's like this(Forgive my Paint skills ): I know that the AV can always subsequently block files from drivebys when they are on the PC. General browsing - use HTTP links (turn off VPNs etc.) allowing AV http scanner to check for driveby downloads etc. Banking, shopping or anywhere personal information is exchanged, or if privacy is required - always use HTTPS links and also a VPN if in a public place via OpenVPN with VPNs) and if it is then seen by the scanner. I am assuming so, though I am unclear where it is decrypted (E.G. Does it also bypass them with the use of VPNs, proxies, HTTPS everywhere addons etc.
I guess it is clear that they cannot scan the traffic content over an HTTPS connection (and is not port 80). Can anybody please clarify if HTTP shields/scanners in AVs (such as Webguard in Avira) provide any value over HTTPS streams?
0 kommentar(er)
