A case against using Avast

[jseverson]

Vice recently came out with an article called Leaked Documents Expose the Secretive Market for Your Web Browsing Data:

An antivirus program used by hundreds of millions of people around the world is selling highly sensitive web browsing data to many of the world's biggest companies, a joint investigation by Motherboard and PCMag has found. Our report relies on leaked user data, contracts, and other company documents that show the sale of this data is both highly sensitive and is in many cases supposed to remain confidential between the company selling the data and the clients purchasing it.

The documents, from a subsidiary of the antivirus giant Avast called Jumpshot, shine new light on the secretive sale and supply chain of peoples' internet browsing histories. They show that the Avast antivirus program installed on a person's computer collects data, and that Jumpshot repackages it into various different products that are then sold to many of the largest companies in the world. Some past, present, and potential clients include Google, Yelp, Microsoft, McKinsey, Pepsi, Sephora, Home Depot, Condé Nast, Intuit, and many others. Some clients paid millions of dollars for products that include a so-called "All Clicks Feed," which can track user behavior, clicks, and movement across websites in highly precise detail.

[...]

Although the data does not include personal information such as users' names, it still contains a wealth of specific browsing data, and experts say it could be possible to deanonymize certain users.

[...]

"It's very granular, and it's great data for these companies, because it's down to the device level with a timestamp," the source said, referring to the specificity and sensitivity of the data being sold. Motherboard granted the source anonymity to speak more candidly about Jumpshot's processes.

[...]

But Jumpshot's data may not be totally anonymous. The internal product handbook says that device IDs do not change for each user, "unless a user completely uninstalls and reinstalls the security software." Numerous articles and academic studies have shown how it is possible to unmask people using so-called anonymized data. In 2006, New York Times reporters were able to identify a specific person from a cache of supposedly anonymous search data that AOL publicly released. Although the tested data was more focused on social media links, which Jumpshot redacts somewhat, a 2017 study from Stanford University found it was possible to identify people from anonymous web browsing data.

What this means for Avast users is that there is a profile of you out there, which likely shows that you're engaged in crypto, that can be traced back to your personal identity. Even assuming that the profile is only ever going to be used for marketing, data leaks/hacks could easily expose you to bad actors. All of this could lead to you losing money, one way or another. If you care about this at all, I recommend you uninstall Avast and all its other products now.

This also serves as a reminder to only install absolute essentials on your computer, especially if you're using it to handle crypto. Windows Defender should be more than good enough as an anti-virus (even if Microsoft is spying on you, at least there would only be one company doing so lol) for as long as you observe due diligence. Better yet, you could give Linux a try -- dual booting is easy and you won't have to abandon your set up completely.

[1714021555]

1714021555

[1714021555]

1714021555

[1714021555]

1714021555

[mk4]

These antiviruses have always been quite shady, especially the notorious McAfee antivirus. With that said, the only antivirus/antimalware software I used back in the day was the default Windows Defender, and Malwarebytes for the occasional malware scan. These things became completely unnecessary the moment I tried using Linux operating systems though. Though things could break once in a while especially if you love tinkering stuff, the peace of mind that comes with it for having a more secure and privacy-respecting OS is totally worth it.

[coupable]

When you go to the doctor, and he finds that you are fine and just obsessed by being ill for unknown reasons, then he failed to convince you that you are fine and don't need a medical treatment as long you keep doing healthy things. The doctor will prescript a regular medicine for you just to make you feel better and to let go your bad obsessions.
This is what actually happening with ordinary users of the computer, especially those windows users who are convinced that installing an Anti-Virus is mandatory to avoid malwares like taking medicines to prevent possible deseases.
In fact, this is not true and the doctor may prescript a fake medicine that can damage entirely your health. An antivirus has nothing to do if you are not using the pc with extreme caution, and it may lead to be a source of damage more than to let you safe.
Personally, i stopped using those antivirus since a long time [except for malwarebytes in specific cases] after realising that i can be safe if i know what to do with my computer especially if he has an internet connection. I didn't face any trouble .

[UserU]

These antiviruses have always been quite shady, especially the notorious McAfee antivirus. With that said, the only antivirus/antimalware software I used back in the day was the default Windows Defender, and Malwarebytes for the occasional malware scan. These things became completely unnecessary the moment I tried using Linux operating systems though. Though things could break once in a while especially if you love tinkering stuff, the peace of mind that comes with it for having a more secure and privacy-respecting OS is totally worth it.

The same can't be said for companies relying on them for protection since they're dealing with loads of sensitive data.

But you know humans, the brand itself isn't the problem but the people or the management are. If some employee goes rogue and start snooping around the data then the whole name takes a hit. Just like the ESEA (video game service) mining scandal.

[d.kevin29]

It's been probably more than a decade since I learned not to use an antivirus software anymore. With AdBlocker and enough care when clicking on a link or when downloading/installing anything, you can stay away from the threats of online malware.

Internet is a creepy place. I always double or triple-check any link or file before opening them, just to make sure nothing is about to happen..

[Lucius]

Avast exists as a free option for Windows, Android, MAC, iOS - it would be really foolish to believe that someone gives a product like this for free. I think most of the so-called freeware programs actually collect data that they then sell to interested parties, it's not something we didn't know before.

If someone uninstalls Avast and installs another AV program, it's no guarantee that it doesn't do the same thing as Avast. Spying is an integral part of today's society, so even when using Linux, you can't be sure that your device is not spying on you via some secret chip on the motherboard and sending that information to some secret agency.

Just by the way, all modern Huawei smartphones have pre-installed Avast.

It is a well-known fact that one of the biggest spy scandal in recent times has been discovered when the Americans discovered that Chinese-made servers have one secret spy chip that does dirty work for the Chinese. From the largest US companies through the Department of Defense, all have for years been spied on, and all that without a clue.

[Kakmakr]

A lot of people believe that FREE software come at a price and this shows you how companies like this, fund FREE software like this. When you talk to them, they would say the FREE package is just the stripped down version of their full retail package and that it gives them an opportunity to sell you the full retail version with more options.

You never think of all the nasty things that are happening after you install the FREE version, because you are too happy to use the AV for free. I paid for a full retail version of McAfee and also Kaspersky and so far I am happy with the result, but I still think most of these Anti-virus companies are up to no good behind the scene. <Lots of people seem to think that a lot of them are paying people to write some of these viruses to create a market for their products.>  

Imagine how a profile of your visits to Crypto currency wallets in your browser history would help them to target the online wallets you are visiting.    <Specifically saved passwords!> 

[hd49728]

Using free antivirus softwares has somewhat risks for users. People have to deeply consider about the balance between risks and beneficiaries by using free-antivirus softwares. I understand that in some locations of the world, people don't have too much money, so owning a personal computer is a challenge, then spending money for AV-softwares is much more challenging and somewhat out-of-control.

Anyway, if people have enough money to invest in crypto, they have to think of spending money for good security tool, including the reputable and paid-AV softwares. They will get lot of beneficiaries back in the long run.

[secone]

Im linux user, I have moved from Windows to Linux for 3 months, and now im loove with linux, everything is smooth and im never see any dangerous activity, if you love decentralization, and you love crypto, also doing some finance activity better you use linux, in my office all people using linux too. its more secure than windows even you using paid antivirus

[joniboini]

its more secure than windows even you using paid antivirus

One of the drawbacks of Linux is probably its gaming and design capabilities. For those who're not aware of their privacy & security risk, the 'inconvenience' also provides some challenges. On top of that, news like this does not come into headline every often.

Anyway, if people have enough money to invest in crypto, they have to think of spending money for good security tool, including the reputable and paid-AV softwares.

Paid-AV software doesn't mean free from 'spyware'.

[Lucius]

I paid for a full retail version of McAfee and also Kaspersky and so far I am happy with the result, but I still think most of these Anti-virus companies are up to no good behind the scene.

Free or full version, I don't think it really affects the way they handle user data, it doesn't explicitly state that the data of users who have a paid version will not be passed on to third parties. Also when installing such programs the user is always ask to share some data with the company in order to improve products and combat virus/malware, and there is always an option to turn it off.

Im linux user, I have moved from Windows to Linux for 3 months, and now im loove with linux, everything is smooth and im never see any dangerous activity...

I think people rely too much on the fact that using Linux OS means absolute security, the fact that you don't see "any dangerous activity" does not mean that it does not occur in the background without any indication of it. Linux is not immune to viruses/malware, but there are far fewer such threats than on Windows OS. And as I mentioned in a previous post, not only software or OS spies on you, hardware may also do it - and this is something only a few can discover.

Check this article : For $2 you can put a HIDDEN SPY CHIP on any PC hardware

[hatshepsut93]

Windows defender is all you need, but the most important thing is to not rely on the antivirus in the first place, it can't protect you against zero-day malware and other threats, so you should just learn to never install untrusted software, and if you do need to do this, then do this in a separate environment - i.e. get a dedicated computer for pirating software and games, and another for your work, finance, personal stuff.

People often recommend Linux, but I don't believe its a silver bullet, unless we talk about something like Qubes OS - you'd still better have different environments for potentially risky and sensitive stuff, even if both run on Linux.

[malevolent]

A case could be made not just against Avast, but against AVs in general. They can often allow for privilege escalation:

https://www.google.com/search?&q=antivirus+privilege+escalation

One of the drawbacks of Linux is probably its gaming and design capabilities. For those who're not aware of their privacy & security risk, the 'inconvenience' also provides some challenges. On top of that, news like this does not come into headline every often.

As far as gaming goes, nowadays with Lutris/Proton/DXVK/etc. most games, AAA games included, run fine. For design it's not as good but that depends on your needs.

[Shimmiry]

Windows defender is all you need, but the most important thing is to not rely on the antivirus in the first place,

Windows defender was indeed a great feature / anti-virus and anti-malware program made by Microsoft. I have been using it for years and I haven't found any issues to my computer and laptops. But not having any anti-virus is like letting your body be infected by viruses also hence it is better to be safe than sorry.

People often recommend Linux, but I don't believe its a silver bullet,

Linux was the best OS for now as it really was that secured and safe for a lot of users, both beginners and professionals. What makes it a silver bullet is that those who know a lot of security measures makes the best out of Linux, and therefore beginners would found installing Linux unnecessary. The main point is, having knowledge and continuously learning especially on having Linux your OS is the best anti-threat we could all have.

These antiviruses have always been quite shady

It is indeed shady, and they are in fact fake. Why? There are viruses/threats they found lurking on your PC while there's not. Most antivirus often makes their own virus and upload it to your computer just to look that they are working as an antivirus just fine.

[Artemis3]

Windows defender is all you need, but the most important thing is to not rely on the antivirus in the first place, it can't protect you against zero-day malware and other threats, so you should just learn to never install untrusted software, and if you do need to do this, then do this in a separate environment - i.e. get a dedicated computer for pirating software and games, and another for your work, finance, personal stuff.

People often recommend Linux, but I don't believe its a silver bullet, unless we talk about something like Qubes OS - you'd still better have different environments for potentially risky and sensitive stuff, even if both run on Linux.

Windows 10 collects your data, it is one of the reasons of its existence (vs the older versions). Microsoft knows every single file name you have, they can also retrieve them (download) if they feel compelled to. I believe they also get the generated thumbnails, there is documentation on the bucket load of info Microsoft themselves collect from you on various sites online.

Linux is far safer by default than Windows ever will, its probably in their model anyway to be easy to break for various reasons (and their separate department development model leaves no choice). And that is before you start adding software, which will simply diversify the number of companies that get your private data.

Datamining is exactly what Microsoft wanted to get into with Windows 10, there is no coincidence Windows 10 increased that data collecting following the trend of similar Google products.

With Free and Open Source software like Linux you have the code and can audit it yourself, or pay others to do so. Are you scared of spying? Check the code, compile it yourself; invite others to do their independent reviews, report anything you find.

Your mentioning of Quebes seem to be ignoring the recent security flaws of speculative execution in most modern CPUs; virtualization is NOT a silver bullet. If you want a "safer" system then get something like the Pinebook pro or some architecture without these flaws.

In Windows installing from untrusted sources is "normal", people are used to find things in web pages, download and install, as opposed to using an official repository like most Linux distros have been doing for decades. You would need to break couple of decades culture of bad habits from windows users, such as running with administrator privileges. And even if they were disciplined to run as a limited user, they will happily execute dubious programs downloaded or brought in that can escalate with or without permission anyway. That's how the infamous Stuxnet invaded an air-gaped facility in Iran, the idiots were using Windows scada terminals and some bored operator probably wanted to play games or see pictures on his usb stick to pass the time...

Yes today Avast made the news, Avast is not the only one, most windows programs do this including windows itself. This is also true of closed source proprietary apps, you could attempt to sniff your network but many do this encrypted to "normal looking" sites.

Without the source code, you can never tell for sure your program or operating system isn't doing something behind your back. You simply can do nothing buy blindly trust in them, like you would trust your government will never ruin the fiat coin of your country.

It makes a GIGANTIC ton difference to use Linux vs Windows, even at default settings. I don't care if you replace Linux with similar FOSS OS such as Freebsd, or Windows with similarly closed proprietary software such as OSX. The same goes to all user programs. Do not excuse laziness over learning "something not Windows" by justifying yourself with "any 2$ chip can sniff you anyway so why bother"? If we bring here every possible single vector of attack, we would never end. The point is to reduce them, not increase them. You increase them many fold by telling people to not bother with Linux. Yes it matters, yes it makes a difference.

To anyone reading this still on Windows: Linux is free and open source, try it. Nobody is forcing you a subscription or referral program. There are thousands of distros you can try, test as many as you want until you find one that you like. Many can be tried without installing, you can even disconnect your hard drive if you are scared to accidentally lose your data, just let it boot from the usb stick or optical disc.

See for yourself, make the difference and tell others. Linux is to Windows what Bitcoin is to Ripple.

[UserU]

It is indeed shady, and they are in fact fake. Why? There are viruses/threats they found lurking on your PC while there's not. Most antivirus often makes their own virus and upload it to your computer just to look that they are working as an antivirus just fine.

The mid-2000s were the golden age of rogue anti-viruses. I used to be so fascinated by how they operated by mimicking Windows XP security UI.

[malevolent]

Your mentioning of Quebes seem to be ignoring the recent security flaws of speculative execution in most modern CPUs; virtualization is NOT a silver bullet. If you want a "safer" system then get something like the Pinebook pro or some architecture without these flaws.

Or get an AMD CPU, they're less vulnerable than Intel to these attacks while still having very good performance.

[TheBeardedBaby]

If you want to keep your data private don't use any of windows/mac/Android. You can't disable their data leaching even if you choose all disable options.
Avast is no different.
You can't really stay private anymore if you don't have a certain knowledge/skills.
Even NordVPN got hacked and leaked sensitive data.
There's already a record of your fingerprints, face, voice, all your gps movement data, and conversation (close to your phone/pc).

[psycodad]

I see Windows Defender being recommended occasionally here and there.
Make sure you understand that Windows Defender sends links i.e. in email messages that it thinks look suspicious to the cloud for analysis. That means a potentially suspicious looking link that your friend mailed you in private will be fetched and analyzed from an Amazon IP* before you have a chance to click it in the first place.

I am not saying that it is a bad tool - not at all. But it is a true nightmare wrt/ privacy.

*Using the competition in an attempt to confuse the bad guys, smart eh? (Nope, it isn't bc the bad guys are well aware of this)