Avast Scandal: Why We Stopped Recommending Avast and AVG | Hacker News Reader

Avast Scandal: Why We Stopped Recommending Avast and AVG

safetydetectives.com

215 pointsdownrightmike114 comments

> Avast and AVG no longer pose a threat to user privacy, meaning both products are 100% safe to use. Since closing down its data-aggregating subsidary, Jumpshot, Avast has undergone significant changes to ensure user privacy isn’t compromised. The company has earned certifications from data privacy advisors like TrustArc and works closely with other privacy experts, so you can rely on Avast and AVG to responsibly manage your data.

This looks to me like the kind of language that gets included in an article after lawyers start threatening lawsuits.

Something tells me the author didn’t really want to lead this article with a blurb about how the products are 100% safe to use.

Yeah. "The company has earned certifications from data privacy advisors like TrustArc" feels like a reference who emails back "I can confirm Bob worked for us from August of 2010 to July of 2012." Trustarc is about box-checking compliance.

Also "works closely with other privacy experts"...like who?

Let me open up MS Paint and get a certificate printed out, then I will be a Privacy Expert too.

I think that's supposed to be a quote from reader mail, to which the OP is a response.

To me this sounds like they couldn't get juicy deals and a referral program like they do for all the other fishy AVs

I mean.. take a look at their home page: https://www.safetydetectives.com/

Oh wow. Yeah, that place is pretty fucking bad:

    Quick summary of the best antivirus software for 2023:

      1. Norton — Best overall antivirus in 2023.
      2. Bitdefender — Best for lightweight scanning (with heaps of extra features).
      3. TotalAV — Best for ease of use (recommended for beginners).
      4. McAfee — Best for web protection (with a great family plan).
      5. Intego — Best for protecting your Mac.

Clearly "best" is defined as "who gives us the most kick backs".

That's the same story with all product comparison sites. It's obvious that in most cases, they've never actually used the product for more than some hours if at all. The description of the products are just a rewritten version of the manufacturer sales material.

The only way to get somewhat reliable recommendations was to append reddit to the search terms.

Yea affiliate deals r abhorrent. And I wasn’t even aware of how high stakes it can be until this article:

https://www.fastcompany.com/3065928/sleepopolis-casper-blogg...

That's a great article, thanks for the link

Looking at the fortunes of the Casper place in the time since, Wikipedia has it:

https://en.wikipedia.org/wiki/Casper_Sleep

    On February 6, 2020, it went public at $12 per share, translating to a market value
    of $476 million ...

    On March 31, 2020, its stock dropped to $4.12 per share, translating to a market
    value of $163 million ...

    In April 2020, Casper announced the winding down of its European operations and laid
    off 21% of its staff ...

    In November 2021, Casper announced that it had entered into a definitive agreement
    to be acquired ...

    The transaction completed in January 2022 and Casper's stock was delisted from the
    New York Stock Exchange.

Disappeared with barely a whimper it seems like.

Love it. And now that I think about it, I have stopped noticing the incessant Casper ads scattered around SF

There is plenty of astroturfing on Reddit.

Absolutely. That has also gotten worse over time.

The internet in general has just become one giant billboard / sales grift over the past decade and it’s really sad to see. I hate how much of the American economy is based on ads and marketing, just trying to force feed us pushes to buy buy buy until we’re broke and/or dead. There are better ways to live than this.

Which is why they don't like Defender. "We tested Defender against 1000 viruses, and it detected less than Norton", never says how much less.

Also it's not a VPN apparently.

> recommended for beginners

This is fabulous. They even draw a "learning path" from beginner to expert (sorry, who?). It looks almost natural for inexperienced users.

This whole "home antivirus" business reminds me of SoftRAM. It's just a few steps away from being a scam.

lol this list is crazy

wasn't ESET always ahead of those?

Try and move the pointer out of the page and a "Time-limited deal" for Norton pops up. This website is trash.

best windows AV/Malware and Defender is not on the list. How serious can you take such a site/resource.

If you've used Avast or AVG in the past decade, they sold your click data for every thing you clicked on and every site you went to. I hadn't heard about this at all until today. Submitting for exposure.

The trouble is that people don't care, I explained it to both AVG and Avast users, the response I got varied from disbelief to asking me where is my tinfoil-hat. Ignorance is bliss

That doesn't sound like they don't care as much as they don't believe you.

Which echoes the responses I get when I bring up these issues. I think lots of people find the concept so outrageous that they think it couldn't possibly be true.

I think it is not wanting to believe.

My friends family use Avast on all devices at home. It blocks ads and give parental control, also security from various viruses, phishing, malware... Data tracking is fine for them.

But... They pay around 35$/month for this.

To me, the browser/email signature bloatware was more offensive than selling my privacy.

Wow I have used AVG for like 13 years and never even heard these allegations before although I'm plenty online. I saw the AVG email signature and disabled the web/email part of AVG. I should have realized that a company which does that will do other underhanded acts.

I mean, it's standard practice for me to disable all the parts of the AV that are "let us infect^H^H^H^H^H^H protect your other programs" because, well, it's effectively infecting the other programs from their perspective.

I stopped using them and Avast about 15 years now. They started to get dodgy and Window defender was more than good enough.

> they sold your click data for every thing you clicked on and every site you went to

It’s like Batman said. You either die a hero, or you live long enough to see yourself become the villain.

Or you start as a villain and just play a hero until you get found out.

No shit moment right there. The second I saw they had their own toolbar I was 100% done, as it was totally, mind numbingly obvious they'd gone to the dark side. Anyone surprised by this is daft.

And Windows 11 took their place, waiting for the report in another 10 years...

I stopped using avast years ago when I first encountered the phrase: 'if it is free, then you are the product'.

Also, avast, avg, etc are just another source of vulnerabilities themselves.

Everyone really should be taught in school to ask: 'how do they profit off of me?'.

In security space companies can profit from selling corporate products backed by a threat-detecting network of free personal users. The sooner they can see new malware, the sooner they can make and distribute its signature, the safer it is for their corporate clients, so everyone wins.

…is this meant to be sarcasm, or what?

Fool me twice...

It says in the article that once Avast was exposed they moved the Spyware from the toolbar to the main program and claimed everything is ok now, so in this case it's fool me thrice...

Message from our lawyers.

No, message from Norton who own AVG now.

You mean Gen Digital?

I wish the past twenty years hadn't been a futile effort of me and many others trying to convince people that they should care about privacy and their personal data even if they were 'nobody' or 'not doing anything wrong' or 'anonymously collected' or even if they thought 'there is nothing we can do about it', all the while coming across as paranoid or up to no good. Meanwhile I was right but fat good that does because the time to have done something impactful would have been 20 or so years ago and with a critical mass effort.

There has to be a term for humanity's tendency towards shrugging things off as unimportant until it becomes too late to do anything about it, and then getting really pissed off that nobody warned them enough.

The term "Cassandra Syndrome" or "Cassandra Complex" is used to describe situations where individuals or groups make valid warnings or predictions about future disasters or problems, but are ignored or not taken seriously until it's too late.

It's difficult to argue against "free". The originally open spirit of the internet has been corrupted by companies who offer their services for "free", while in actuality it's done in exchange for the gold mine that is user data. Even if this is clarified, it's buried in the fine legalese of the T&S. And even if people read it, most will choose to make this exchange because they're already used to things being "free" online, because of the value of the service, and because it's never clarified how much their data is actually worth. The reality is that user data is exchanged in perpetuity on the data broker market, and the value extracted from it far exceeds the value of the service itself. Even paid services will harvest user data just because the profits from selling it exceed what they can realistically charge customers. All companies using this model should be paying users to use their service instead.

This is an insidious and downright evil business model, fueled primarily by advertising.

For at least the last decade, at least for consumers, any type of anti-virus such as Norton, Avast, AVG had more downside that upside. Avoiding running under an admin account and using Windows Defender was better than installing any third-party anti-virus solution.

That is not entirely true, for ransomware your permissions are enough for them to encrypt your files. Windows defender is getting there, but I am not sure it is quite there.

I'm with the grandparent here, but want to chime in that backups are also important. If all my files got encrypted, I'd only be out a couple of days time.

Smart ransomware will wait weeks or months before revealing itself. So you'll have been backing up a lot of encrypted documents, and your last clean backup may be quite old. It may be totally gone if you're rotating quickly.

But I essentially agree that Windows Defender is about as good as it gets. It's not perfect protection, but neither is any other product.

MS Defender is not any different from any other AV products and it definitely has its share of issues; one of the reasons to get some other AV is just to get rid of Defender.

MS Defender has issues but it never did any of the bad things third party AVs do. In fact it does none of the things this very article highlights.

So yes, MS Defender is very different from any other AD products.

It still sends lots and lots of data home. The only difference is we don't know, if Microsoft is selling them. They surely are not selling them openly, but I would not be that surprised to find out they use it for other purposes as well. But they openly do tracking and show you ads in windows anyway ..

If they don't need to sell it because they would be the ones to otherwise buy it, is that better?

A tiny bit I think, as it stays with one (BIG) party, than circulates around.

Still, I would fine them into oblivion for this and the fact that this is accepted behavior that apparently gets not fined, is hard to accept.

Ms makes Windows. By using the OS you already trust them with your data. Why bother with a 3rd party here?

If you don’t trust MS Defender, you should be using Linux instead.

If this is legal we need better laws.

If it is illegal then the laws need better enforcement.

it is illegal and it is being enforced

https://www.techradar.com/news/avast-hit-with-multimillion-e...

Being enforced after it is too late to do anything about it. The people that did it made their money and the data is long ago sold.

How do you suggest it be enforced prior to it happening?

Make it so that if you get caught doing something like this, then there is no company to reform its image. Fine it 150% proportional to the value of all its assets, then judge every CEO and boardmember in charge during the events ineligible to work in that industry ever again.

Then we will see if it another company finds that it is worth it to make a few million in profit selling customer data.

The history of law counsels against draconian punishment. There is a sweet spot between lenience, where crime is not deterred, and sadism, where crime is worth expending any and all effort for all even tangentially involved to cover up.

It’s tempting to give into Prohibitionist methods, so we see these proposals come up continuously. But proportionality has a purpose.

You make a great point. I suppose the trick is finding something that hurts enough to make it not worth it to try, but isn't draconian.

> Avast and AVG no longer pose a threat to user privacy, meaning both products are 100% safe to use.

They are still proprietary. They definitely do pose a threat.

Avast also made money by tricking users into installing Google Chrome for years using dark patterns: https://imgur.com/gallery/WWZxj

Do you even need these anymore? Why are people still using 3rd party anti-virus software?

Because they're not part of the HN bubble and genuinely do need an additional program to stop them downloading random infected crap from MediaFire banner ads.

The amount of people who would open funnycat.jpg.exe is much larger than you think. No way are they reading Windows Defender popups with complicated words like "executable", they're gonna click okay and it's up to 3rd party virus protectors to stop that stuff with scary flashy warning popups.

> No way are they reading Windows Defender popups with complicated words like "executable", they're gonna click okay

Indeed. https://i.imgur.com/M4RNUHl.png from https://www.usenix.org/conference/enigma2016/conference-prog...

I use BitDefender, not because I'm an idiot as you implied, but simply because according to my research it's more efficient and catches more threats than Windows Defender.

When Win 95 and 98 was a thing antivirus programs were broadly recommended to normal users. I guess the habit lingers?

It is basically this. Windows has long since had an integrated firewall and system protection measures, including a file scanner. And back in the 95/98 days, browsers we're happy to let you execute virtually native code that could wreak all sorts of havoc (ActiveX, Flash, etc.)

Nowadays anti viruses are kind of like big intimidating security signs. They make the owner feel a sense of comfort while offering a bare minimum of value in terms of real security.

> They make the owner feel a sense of comfort while offering a bare minimum of value in terms of real security.

If only they provided a bare minimum value, because it's worse than that. Anti-viruses make the system horribly insecure, with their poorly written C/C++ programs running everything needlessly as root and parsing every data within its reach [1]. If that's not enough, they even tamper with browsers and interfere with genuine efforts to improve security [2].

Anti-viruses are scams that decrease security, with the possible exception of ClamAV. The whole concept is bad too. Installing some magic software can never make security threats go away.

[1]: https://ia801306.us.archive.org/26/items/SyScanArchiveInfoco...

[2]: https://robert.ocallahan.org/2017/01/disable-your-antivirus-...

Look, Lambda people subscribe to VPNs because YouTubers convinced them it’s the only way to be safe online, even if that’s an absurd claim. Antivirus companies have a similar business model.

Having an actual virus was less tax on the system than having Avast and AVG.

The real money was in hedge funds using this data to beat the market. People got filthy rich this way.

Was this covered in the news?

Joseph Cox at Vice covered it fairly extensively. Hedge funds are still doing it today, just with different data vendors.

Antivirus software is universally a scam so not a surprise at all.

AVG and Norton merged last year. Funny how these guys out in a disclaimer up the top that AVG is perfectly fine now.

Great way to completely discredit your website.

It's now called Gen Digital.

Just a reminder, nothing is really free.

I recommend if you find a product or service to be too cheap that you think through why that could possibly be.

Except Free Software ofc

this is exactly not the meaning of "free software"

In English this has become a detriment, this label. If you have no idea why people would spend tens of years executing excellent software for highly technical niches, then I am not sure what to tell you.

It is ironic to the largest degrees, the nature and culture of these foul trustless anti-virus windoze mobsters, is the cause for an utterance of "that other software is free"

Not all Free Software is free, but all free Free Software is really free. There are no "hidden fees" in free Free Software, like there are with freeware. That was my point.

I don't really know what you mean by the rest of your comment.

The D programming language is really free.

> why that could possibly be

Because it's fun.

Touché!

There's clamAV which is open source: https://www.clamav.net/

Keeping exchange virus free with a Linux scanner at the mx.

The problem is that selling data is so lucrative that even stuff you pay for will do it if they can get away with it.

We need real laws, with teeth, that put people in jail and/or liquidate their businesses and all shareholder value for selling data and neglecting to properly secure data. It should be stronger than HIPAA to the point where a CEO wouldn't even think of cutting a NetSec department budget if the company was collecting PII.

Why not enact laws against collecting the data in the first place?

I mean, if it's illegal to sell it then they will trade it for barter. If it's illegal to trade it then they will "accidentally" let it leak to a partner. We can't afford to give temptation to an amoral personified corporation, because any valuable data they've collected and stored will simply burn a hole in their pockets until they scratch that itch.

So prevent it from being collected in the first place. Restrict what data can be collected, and who can collect it. Reward minimalist orgs that collect as little data as possible to have an MVP.

I betcha these proposals are equally as unrealistic. Because who can resist collecting data? That's what all our software and hardware is designed for now. The whole market for this stuff is oriented for telemetry at the expense of any other feature or functionality.

> I betcha these proposals are equally as unrealistic. Because who can resist collecting data? That's what all our software and hardware is designed for now. The whole market for this stuff is oriented for telemetry at the expense of any other feature or functionality.

At one point the financial markets were completely unregulated, the airwaves could be taken over by anyone with a bigger transmitter, medicines were made of everything except the things they purported to contain, bakeries made cakes with lead coloring in the icing, and milk was sold with more formaldehyde in it than milk.

Just because it is difficult to start doing doesn't mean we can't change how we operate.

Debian?

Debian is free for the consumer, the producers put the effort in. The end user is expected to fill bug reports in, may e that can be seen as not free entirey as some effort is expected at the consumer end perhaps?

Bug reporting and other volunteering are always welcome. But there is no problem if a user doesn't do it. Saying it is expected sounds like an exaggeration to me.

Blender?

I can explain how Microsoft makes money off its anti-virus if you'd like. It's only free for regular users but as soon as you need enterprise security measures (e.g. tracking exposure across your org, isolating parts of your network etc) it costs money.

So the built in anti-virus is in fact "free" because it makes selling the enterprise version easier.

i have not been using antivirus programs on any of my computers for at least 15 years. it's one of those things that sounds good but in reality is beyond useless.

I've stopped using those tools probably around 2008, there where red flags everywhere: in the options, the ui behavior, and in many articles for many years.

I will not read this because I don't understand how a serious person or entity could recommend them in this era.

So, it's been known for more than two years that Avast and AVG were stealing and selling personal information. What have safetydetectives been doing for all that time?

Too busy rearranging affiliate links on their website to notice or care? This site appears to be utter trash. Pretty much like 90% of the mattress review websites that suspiciously rank mattresses based on the kickback, I mean affiliate bonus, each mattress company gives them.

I rolled my eyes hard when they said something like “based on user feedback”, I’m sorry, is this not your entire point in existing? Monitoring the situation? Why are you having to rely on users telling you about this, repeatedly? Also what kind of user who actually cares about this kind of stuff is also reading/trusting/communicating with this site?

https://www.safetydetectives.com/disclosure/

"This list also takes into account user satisfaction post-purchase and our commercial agreements with service providers."

this is so funny, they recommend Norton everywhere

Norton and Avast merged last year:

https://blog.avast.com/avast-nortonlifelock-merge

Last time I used antivirus was on Windows XP when I was 12 years old.

Same here. I scan PC with Malwarebytes Antimalware once a year and thats it. If you are not a torrent collector or brainless email attachments clicker, you'll ve fine.

What about mcafee? I have that crap on my Windows PC.

The words 'crap' and 'MacAfee' are much more related than you want to know...

I have deleted it. Mostly I just log in to Windows to use office or play games so I am not going to miss it.

Its a joke because John McAffee paid prostitutes to poop in his mouth (true story).

ooof... I knew about the drugs and his paranoia, never about this. RIP to the really troubled man.

Used a Pentium 4 machine one time, and it was completely unusable while the preinstalled Norton was running.

I've used Avast. I tried AVX once before Avast aquired it, and found it rendered internet access unusable with no fixes found. I still use Avast, even though it is owned now by the evil Norton empire. Yes, I used to use Norton way back in the dark ages, and paid the required annual subscription fee, and I found one day when I tried to do some work that 75% of my cpu cycles were in-use by Norton anti virus. On that day, I went shopping for alternatives. My next one was not Avast, but something else...I forget....and it lasted until I found it chewing up all my cpu cycles, and that's when I went to Avast, ever mindful that I was dealing with a product from an ex-Soviet contry.

Dude, I'm from that country and I'm slightly offended. I also happen to know one of the co-founders of Avast and the way I see it is the whole company of boy scouts got corrupted by the insatiable greed of private equity. A concept that the land of the free blessed us with.

I get your point but private equity is a squarely European concept lol.

source? does not seem like it based on https://en.wikipedia.org/wiki/History_of_private_equity_and_...

Kaspersky was the best out of all of em. Its been almost ten years since I ran an AV though.

Right, ex-soviet would not raise confidence.

Neither would USA. Google Street View collecting WiFi data, Snowden, spying on their allies like chancellor Merkel's phone, electing a president who has character traits of a 3 year old, I guess the list could go on and on.

By the way Avast was Czech. And Czechoslovakia is known for the Prague Spring. Even if that ended in defeat, they were never part of the Soviet Union.

> with a product from an ex-Soviet contry

Just in case you don’t know: the Czech Republic is not a post-Soviet country, i.e. it was never part of the Soviet Union. It’s an ex Eastern bloc country, at this point one of the most developed and modern eastern countries. Our wages could be a little higher and our politicians a little less populist, but otherwise we’re a legit, safe, democratic country.

Reply on news.ycombinator.com