Author Topic: Avast support SSL Email scan ?  (Read 9538 times)

0 Members and 1 Guest are viewing this topic.

armagedon

  • Guest
Re: Avast support SSL Email scan ?
« Reply #15 on: June 07, 2005, 11:02:01 PM »
i second that. The way it think it works, is that the Email client send the message to Stunnel which decrypt the message (using libssl32.dll) and pass it on to Avast for scanning. There is no reason why can't Avast do that instead.

I have a small free EMail checker "PopPepper" which i setup again after and with a tiny dll plugin is now able the handle SSl easely.

I bet it'll be in next Avast update. 8)

sded

  • Guest
Re: Avast support SSL Email scan ?
« Reply #16 on: June 07, 2005, 11:11:32 PM »
Actual use of Stunnel/OpenSSL by avast! is probably forbidden by the GPL or other open source license, since avast! is for profit.  Implementing an SSL extension can be done (AVG does it, I think much more awkwardly than using Stunnel and OpenSSL), but it is still a problem because of the mail client structure.  The mail client needs to use the SSL transparently in order to allow scanning, so the localhost:dummy port structure ends up being used, with the client turning off encryption so it can be done.  To make it simple,  mail clients should allow for the use of an antivirus plug in (like used for Outlook and The Bat") with an API for a plugin that virus scans the mail and still allows the email client to do the encryption or decryption and communicate with the SSL/TLS server.  In other words, encryption still should be an email client function, with the virus scanner plugin enabled either before encryption (outbound) or after decryption (inbound).  The other issue is the usual cryptographic problem-not just anyone can homebrew a secure system, and using open source like Stunnel/OpenSSL gives users confidence that the system is secure, through peer review and the open source nature of the programs.  The alternative is to license commercial SSL products that are trusted.  I don't think adding SSL support to the av scanners is really a good way to go-better Thunderbird have a check mark for "virusscan" that works even if you select SSL or TLS and tells avast! the rules to implement the plugin.  Lacking that, I much prefer the external approach used by avast! to the integrated and awkward approach used by AVG for ease of setup and use.
« Last Edit: June 07, 2005, 11:14:52 PM by sded »