Seems Like Only 2 Anti virus Do Not Leak Your Private Data

Avira and Eset does not look that bad, if you disable the cloud features...

 

@TheWindBringeth
Thanks for the explanation. But (if I properly understand how VPN works) shouldn't the VPN still securing the connection between user's local system and AV server? We all know that most AVs don't use some sort of secure connection, so intercepting and stealing user's PII shouldn't be too hard. So the VPN can reduce the amount of parties who can see the user's PII, can't it?

 

VPN will only secure connection from your system to VPN server. Connection from VPN server to AV server will still be unencrypted.

 

Oh, I don't know that. I thought it will still secure the connection until the data is delivered to the end recipient after re-routing. Thanks for pointing that out.

EDIT: Lol yeah, derpy derpy derp. I should have aware that VPN can't be magically become an SSL for connections which are never been secured since the first place.

 

Well Webroot SecureAnywhere is a full Cloud Anti-Malware and this info is from Mike Malloy Webroot EVP Products and Strategy: https://community.webroot.com/t5/We...s-Data-Transmission-study-comments/m-p/106512 and already mentioned in the other thread: https://www.wilderssecurity.com/threads/av-comparatives-data-transmission-in-internet-security-products.363276/page-4#post-2369069

Also all Communication is Encrypted from the WSA Client to the Cloud and back!

Thanks,

TH

 

Cloud is used for selling your private data. I don't see the necessity of having a constant connection with your AV company. It should ONLY ask if it was scanning a file that is suspicious and not in the database. Why would they need everything ? To sell it of course.

 

Proof ?
Serious AV vendors have a threat research division that constantly work on improving their product, and the data the product send back may help them with that. And the cloud in some products is able to detect and block threats on execution even before a sig for that sample has been pushed out to all customers. Unless the user is very "smart" and have disabled that of course.

If people are going to use an AV then use the product as it is meant to be used, or don't use an AV at all if you are so worried about what they "may" do with the data.

All the theories and worst case scenario thinking that is all what Wilders is about these days.

 

I recall, some time ago, coming across discussions which indicated that was happening with some cloud AV programs. I personally don't know where things stand, especially right now. I glanced at the report in question again. I don't see client<->server connection security addressed in the results table. That's an important subject.

Do you use cloud AV? With cloud features enabled? Have you examined your network traffic? Do you know whether it is strongly encrypted?

At the time I was trying to focus on how use of a VPN could affect (just) what the AV server/company receives and can work with. The "use of a VPN may protect against third-party sniffing at some locations, but may also expose you to third-party VPN provider sniffing" aspect didn't seem very relevant to me... on the basis that it wouldn't affect what the cloud AV server/company receives from the client. Put another way, I'm thinking that we would want to consider "exposure of information to cloud AV company" and "exposure of information to other parties" separately.

It was still a mistake to simply "ignore" the aspect in question though, my bad.

 

Is that a genuine question or are you highlighting the critical points? If it was the former, I have been not using AV for quite some time (applied to both real-time and on-demand, cloud and traditional) except for testing purpose. I personally think it doesn't matter if the AV has a cloud feature or not, the AV can still collect PII and transmit it nonetheless. As for examining network traffics, I don't think my knowledge level is qualified enough to do that by myself, and even if it is easier than what I think, I'm too lazy to try it out lol.

Yes. If we focus on the AV vendors collecting PII, then of course securing the traffic wouldn't be relevant. Not to mention controversies which follow right behind it. I was just thinking if VPN can encrypt the traffic between the local machines and AV servers to make up for the lack of network security infrastructure of most AV vendors, in which hqsec pointed out my mistake and said that the VPN will only secure the connection up until it reaches the VPN server and after that it backs to unencrypted. Users' PII still can be intercepted anyway.

 

It was a genuine question, to you and anyone else who sees it. I didn't know, or remember, that you aren't actually using (cloud) AV software. I tend not to persist who is doing what information, and normally I have Show Signatures turned off so I miss those "My System:" blurbs that some people include.

 

Suspected it for a long time. Not paying for any AV products these days as I have switched to Linux. Still.... I do use Chrome because there isn't much better choice out there.

 

The tin hat wearers have and will always be with us.

 

but fortinet creates a big VPN connection hole in your machine, for remote connections...

 

Here is the issue...Avira actually looks very fast, catches a lot of things however when you take a closer look at their EULA, it states that any one of their partners (and there are many) will have access to your information and they "strongly suggest" that you read their Privacy rules. So I have to read them all...and there will be at least one I'm sure that I do not like!!! So I can't be bothered. I never name countries of software or call them out, however as I look around the whole Antivirus and Malware scene is looking rather grim. Just when you think you found the right product, something always deters you away from it. Whether it be country, Eula, data collection, speed, or how many things they catch...some say they are located "here" but then end up having CEO's that are shady or have subsidiaries in suspect countries. I recently moved away from strong paid offerings to the slower paid Norton because well...they have my data already. I am at the point of looking at where every piece of software on my system is made. I also look at where my hardware is made. It is paranoia sure, however there is a reason millions or billions of cyber criminals are preying off of the uneducated masses daily.

Anything new out there? With a decent EULA, doesn't collect your word documents lol doesn't take your computer name and is semi speedy. I looked at Panda...again lots of offices in "many countries".