Hacker News Reader

Comment by SimeVidas | Hacker News Reader

I still don’t know if I’ve disabled HTTPS interception in ESET Internet Security. I went in Settings > Internet Protection > Web Access Protection > Web Protocols, and then disabled HTTPS checking, but I’m not sure if that’s it or if there’s more.

View on HN

If you're using Firefox or Chrome, go to a site with an EV certificate (for instance https://twitter.com/), and check if it shows the EV bar. These two browsers only accept EV certificates from a few hardcoded CAs, so if it's still being intercepted, it won't show as EV.

Another option is to check the certificate for any website; for instance, the one for this site should chain to "COMODO RSA Certification Authority", and for me shows the SHA1 signature BB:DD:64:6F:EB:11:0C:D5:EC:CF:57:D1:F7:52:AA:99:50:1B:44:FD.

No EV bar at twitter site in Firefox in my case, nor at google.com, Facebook, etc., but thawte.com is displayed properly (Thawte, Inc. (US)). :-/

Same here. I think we’re fine. The certificate chains don’t show anything suspicious.

You can manually inspect the website certificate in your browser. If it is issued by a CA that looks like it is from your antivirus, then you haven't. Also, you can go to https://twitter.com/ and see if the EV indicators show up ("Twitter, Inc. [US]" in green).

I generally disable all "web access protection" or similar. then again, on windows, I find that Windows Defender (since 10 includes the MS AV product) is good enough. I do use ublock origin and ghostery in my browsers though.

Most of the web interceptor products break things in very interesting ways (as do ublock and ghostery), the difference being it's far easier to tweak a browser plugin. These AV companies should be browser plugins not a local reverse proxy.

Reply on news.ycombinator.com