Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: REDACTED on December 23, 2017, 03:31:40 PM
-
My question is rather simple, what data or information is sent to Avast if I opt out of the "Avast community" and "Data sharing" in the options and are there any exceptions to this, if so what are they?
Your honesty and frankness in this matter is appreciated.
(https://i.imgur.com/3gj5FQu.png)
-
Really, really suspicious Avast. Going to answer the question?
-
Asked and answered many times. Info is also found in EULA
-
Asked and answered many times. Info is also found in EULA
"Avast community" and "data sharing" is not exactly a privacy definition. I want to know what is sent and stored, specifically. I have looked for the information.
They may collect the information under another definition, perhaps the common "user experience".
I am after a concrete confirmation as to what is sent and what is stored, whether it is shared with the community or not.
-
See section #8 https://www.avast.com/eula-avast-consumer-products
-
See section #8 https://www.avast.com/eula-avast-consumer-products
That does NOT tell me if opting out of the "Avast community" and "Data sharing" disables the collection, does it?
So my original question stands.
Either the data is collected when I opt out, or it's not. I didn't ask if it may be collected.
I want to know whether they collect data when opted out or not. The EULA does not answer that specifically.
-
Referred to Avast for a reply. :)
-
Referred to Avast for a reply. :)
Ah, thank you :D
-
Referred to Avast for a reply. :)
Ah, thank you :D
Save those thanks till Avast replies. :)
-
Just a general question @SweetieBelle
Has any other anti-virus elaborated on data collection other than the tables you posted? i.e explained what happens when certain data collection settings are enabled/disabled?
-
You need to disable:
- Reputation services
- Enable CyberCapture
- Participate in the avast! community
- Participate in data sharing
In order to disable basically all communication with avast! that concerns privacy in any way. Be aware that in doing so, you are disabling a large portion of protection services.
Reputation services communicates with avast! servers about the file age where it gathers and transmits file metadata in order to ID it. CyberCapture submits unknown files to avast! servers for analysis. It was by design only for files from remote locations to avoid submission of local made programs by users themselves (programmers), participation in avast! community is actually a mix of many cloud services that provide protection in avast!, participation in data sharing is actually connected with their internal "partner" that they acquired like 2 years or so ago and they provide aggregated statistical data. Basically what that means is that avast! team tracks what malware was detected on what webpage, the amount of it, from what locations etc. This data is then stripped of personally identifiable elements (like ID strings on detection URL's like www.doman.com/id=437634673487574 to look like www.domain.com only). Then this aggregated statistical data can be sold to external 3rd parties or used internally for external purposes (for example those monthly popups about malware statistics avast! has gathered which are shown to users on desktop in a form of popup).
No one will explain exact specifics of these features, but that's what they are in a nutshell. If you want to shield yourself 100% from privacy data leaks, you'll have to destroy all your computers and phones and isolate yourself from people pretty much entirely.
And it's also a question of trust. Do you trust avast! enough or do you just hope you won't get infected by products bad guys make? It's a bit of a trade off here. You trade some potential privacy issues to get protected from huge privacy issues posed by malware. Antiviruses unfortunately have to operate this way in order to be efficient. No one wants antivirus that's bad at what it's designed for, detecting malware. With the rise of cloud systems, I think malware protection elevated itself significantly.
-
Just to add to what RejZoR posted,
Even when you destroy all of your computers and other smart devices, there will still be a footprint since you've already been online.
True anonymity really isn't possible in today's society.
-
You need to disable:
- Reputation services
- Enable CyberCapture
- Participate in the avast! community
- Participate in data sharing
-snip-
Thanks for the information. Really simply, I am just after an antivirus. I don't need the reputation services and such, any malware scripts will not run on my machine without my permission, hopefully. :-X
I have been on both sides of the divide and no, I don't trust Avast. They may be run by the most honest people today and sold to a marketing company tomorrow. I can't help it not being sold, but I can help not sending my data to be archived and mined in the first place.
I am also building a new pc and want the absolute minimum of bloat.
I also have clients that handle sensitive information and they ask me what software is safe.
Once I have new equipment set up I will be able to record any data Avast sends, I just cannot do it at this juncture and wanted Avast's word on the matter. If they stand up for privacy and user choice then I am sure a lot of users would like to know that.
Just a general question @SweetieBelle
Has any other anti-virus elaborated on data collection other than the tables you posted? i.e explained what happens when certain data collection settings are enabled/disabled?
I looked up a few others and found specific information online in regards to their collection and storage, I haven't had to ask on any other forums. Two of them don't sell products anymore. One has limited their sales in the west and now sells primarily to Korea, but has excellent privacy protections, it only sends the version number for purposes of updates. People are signing up to their forums and website using Google translate just so they can get their hands on the antivirus that collects no data. It's definitely a selling point.
Most of the US based AV providers I would rate as "disgusting". They collected a lot of data and there was no option to opt-out.
All I want is an antivirus, no extra bells and whistles. My privacy is important to me.
I am intentionally not naming other software products.
I use two browser based products which offer script blocking and anti-malware. One simply collects no data and has no function for it, the other only collects data if you choose to create an account and sign in, which I have not done.
-
I don't trust Avast.....
Then you should not install it. Even your OS / WinDefender collect data
All I want is an antivirus, no extra bells and whistles. My privacy is important to me.
Maybe ClamWin AV ? You also need to install Clam Sentinel if you want realtime protection
-
I don't trust Avast.....
Then you should not install it. Even your OS / WinDefender collect data
All I want is an antivirus, no extra bells and whistles. My privacy is important to me.
Maybe ClamWin AV ? You also need to install Clam Sentinel if you want realtime protection
"ClamAV for Windows sends information about the files its scanning back to the cloud. This information is in the form of SHA hashes and file heuristics. Currently, this information is only collected for Windows PE files, or in other terms what most people refer to as executable files. No information is collected for other types of files, like Word, Excel, or PDF. Additionally, in some situations the entire PE file will be uploaded to the Cloud to determine if it is malicious."
-
I did not say it that it dont collect info ... but it has no extra bells and whistles, at least very few and no popup ads ;)
I dont think there is a AV today that dont use some cloud feature?
ClamWin >> http://www.clamwin.com/
Clam Sentinel >> http://clamsentinel.sourceforge.net/
ClamAV (the engine) >> https://www.clamav.net/
ClamAV blog >> http://blog.clamav.net/2011/03/top-5-misconceptions-about-clamav.html
-
I don't trust Avast.....
Then you should not install it. Even your OS / WinDefender collect data
All I want is an antivirus, no extra bells and whistles. My privacy is important to me.
Let me just clarify a little.
If Avast states that turning off data collection and whatnot does disable sending data completely and I can verify that via Wireshark, then I trust them enough to use and recommend the software. I don't like leaving consumer PC's unprotected.
I would like to be able to recommend Avast to clients. I would like to explain to them what each feature does and the potential privacy implications and leave the choice up to them.
I am very well aware of data collected and transmitted by other software packages and I do cut it off as best as possible, even on my phone. In many cases many apps I use simply cannot transmit anything. The security software on my phone cannot transmit a single thing.
It is not a case of accepting all or nothing, it is not black and white as you portray. I do not need to bury my pc. What I need is information, then I can make an educated and balanced decision regarding the matter.
I did not say it that it dont collect info ... but it has no extra bells and whistles, at least very few and no popup ads ;)
I dont think there is a AV today that dont use some cloud feature?
Heh heh heh, the lack of interference is definitely appreciated. I used another AV for a while, it was extremely bloated and asked more questions than a hyperactive 2 year old.
-
I did not say it that it dont collect info ... but it has no extra bells and whistles, at least very few
I dont think there is a AV today that don't use some cloud feature?
Technically, there is very little anywhere that doesn't collect some information.
The difference is usually that one site reports what it collects and is then criticized for collecting the information
while other sites collect the information but don't disclose that fact.
Privacy on the internet is a myth. Even if you're careful, someone can always get access to what you've posted or what you used or,
the sites you frequent. Frankly, if you've used the net for any length of time, you really have no privacy.
-
I did not say it that it dont collect info ... but it has no extra bells and whistles, at least very few
I dont think there is a AV today that don't use some cloud feature?
Technically, there is very little anywhere that doesn't collect some information.
The difference is usually that one site reports what it collects and is then criticized for collecting the information
while other sites collect the information but don't disclose that fact.
Privacy on the internet is a myth. Even if you're careful, someone can always get access to what you've posted or what you used or,
the sites you frequent. Frankly, if you've used the net for any length of time, you really have no privacy.
I just want to minimise the footprint as much as I can.
I have outed some companies on social media for collecting data when they did not declare it. One transmitted quite a lot of personal information gathered from the device (phone/tablet) completely unencrypted, more than enough to steal an identity. It was also stored on the phone in a simple text file.
They were not very happy when I made that public, they instantly renamed the service, within a day. They also added the service to their PC software suite, so it could replace the software on the device if you deleted it.
I outed them again. ;D
If I worked for Avast I would add a privacy feature, even if all it does is disable several components, privacy is marketable.
-
Then Rejzor's answer is pretty accurate and it will minimize the footprint.
-
Then Rejzor's answer is pretty accurate and it will minimize the footprint.
Thank you. Are you able to tell me what it will continue to sent?
Of course I presume version number will be sent for the purposes of updates.
-
You need to disable:
- Reputation services
- Enable CyberCapture
- Participate in the avast! community
- Participate in data sharing
-snip-
Thanks for the information. Really simply, I am just after an antivirus. I don't need the reputation services and such, any malware scripts will not run on my machine without my permission, hopefully. :-X
I think the name "reputation services" doesn't describe the underlying functionality anymore. These services provide not only file reputation (which the local program may then use as part of some heuristic rule to allow the file to run or to block it), but they also provide strict detections (i.e. say "this file is malware").
Simply said, more and more detections are moved online - first because of the size (you wouldn't want to have gigabytes or terabytes of virus definitions on your disk), second because it's faster (when a system or analyst decides that a specific file is malicious, it takes a few seconds to push this information online - and if you encounter this file the next second, it will get detected. If you wait for streaming updates instead, it takes a few more minutes. If you disable even streaming updates and wait for a "big" update of virus definitions, it can be hours later and the definition may be quite useless by then because the particular malware has been replaced with a different one in between).
So by disabling the "reputation services", you significantly reduce the protection - and it's reasonable to assume that this trend will continue (i.e. at some point either disabling these reputation services would basically disable the antivirus protection altogether, or that setting will just disappear from the program and it won't be possible anymore). Not saying it will happen tomorrow, but the day will come I guess.
-
Simply said, more and more detections are moved online - first because of the size (you wouldn't want to have gigabytes or terabytes of virus definitions on your disk), [...]
So by disabling the "reputation services", you significantly reduce the protection - and it's reasonable to assume that this trend will continue (i.e. at some point either disabling these reputation services would basically disable the antivirus protection altogether, or that setting will just disappear from the program and it won't be possible anymore). Not saying it will happen tomorrow, but the day will come I guess.
If the choice is between gigabytes of definitions on my disk, or sending information about the contents of my disk to some server, I choose the first. If an AV only does online detection, I will drop that AV. Have done it before. Will do it again.
-
If an AV only does online detection, I will drop that AV. Have done it before. Will do it again.
What AV does only online detection?
-
I can't remember which one. Years ago I was looking for a ultra light AV for an old PIII laptop with very little memory. Found one. After installation I noticed it didn't have an option to disable the online cloud scanning. So it got uninstalled. I get that that is why it was so light, but that is not an acceptable trade-off for me.
Even today on my main machine I still scan files offline regularly. Precisely because even full installers these days often want online connectivity, and they won't get it.
-
Panda maybe ?
Posted in 2009 and technology has evolved since then
Arguments against cloud-based antivirus
https://www.pandasecurity.com/mediacenter/malware/arguments-against-cloud-based-antivirus/
-
Could be.
I find this thread very interesting because I share most of the OP's concerns. It isn't about cutting yourself off from everything, but about mitigating exposure. A kind of 'need to know' mindset to giving up information. Pick and choose. In the case of AV I am of the firm belief all scanning should be (able to be) done locally. I understand the benefits of moving that to the cloud, but I'm not comfortable with the implications that has.
-
Then I guess it is also quite important if a person chooses to remain "sharing" to find an AV program doesn't sell data to third parties, even after removing personally identifiable information. It can be quite easy to "re-personalise" the data. It doesn't take very much, especially with social media.
Another reason I do not like to transmit the data in the first place is because it ends up in places it shouldn't be, such as on the deep web.
I'd still like to know what is sent when choosing to opt out. The alternative is to block all network traffic from the app and download updates manually, which I don't really want to do unless I have to. If any of the data is sent unencrypted then it must be blocked.
An alternative would be to offer a prompt to ask if a suspicious file (perhaps identified by heuristics) can be sent for analysis. Once again, the user can define what they choose to do. I am perfectly fine with storing the signatures.
There's information regarding the data collected and sent here, AV comparatives - Data transmission in Internet security products (https://www.av-comparatives.org/data-transmission-internet-security-products/).
-
Indeed. This whole idea of anonimized and depersonalized data is pretty dubious. It sounds great. And if it actually worked that way, you might be OK with that. But in reality often the vast majority of depersonalized data can be reconstructed. And since there is value to be had by doing so, it is reasonable to assume some parties wil indeed try to do so, and succeed. The prudent thing to do is to not collect and transmit anything that is non-essential for basic operation of the AV. And what that constitutes depends on what trade-off an end user makes. It is pointless to debate this because it is a personal choice. You might opt for the best protection at a cost of some privacy, and I might choose a bit less protection but in the knowledge some personal information is not out there to be used or abused. And then it is up to me to make sure I have taken precautions for a worst case scenario.
-
I couldn't agree more.
All I am after is the power to choose for myself and the information I require to effectively do so.
I don't know who Avast sells the data to, I don't know what other data has been purchased. I don't know who they are or what their goal is. I know Avast is a business and if someone is going to pay, Avast will do precisely what they detail in the EULA and sell the data they have.
That tells me I need to keep my data to myself. I know the saying very well, "If you are not paying for the product, you are the product". I am looking to purchase an AV product, I don't expect and will not tolerate my data being sold if I am paying for the product.
-
While I support the way how avast! has evolved and improved, I'd also appreciate if they specified more clearly what exactly is being sent to avast! and that presented on a dedicated page. Like "www.avast.com/privacy". The EULA is quite frankly VERY vague in this regard. I've gone through the stuff several times and it didn't really tell me what feature does what, if it can be disabled and what exactly is being transmitted. So, I kinda understand the concerns of this user.
-
And yet there is still no answer from Avast.
Everyone assumes that the software does not transmit private or personal data when sharing is disabled, but they won't confirm or deny.
That's really suspicious and does not engender trust.
-
And yet there is still no answer from Avast.
Sure, Martin and Igor replied, see Reply #19/21.
-
And yet there is still no answer from Avast.
Sure, Martin and Igor replied, see Reply #19/21.
Nobody has confirmed what is sent when sharing is disabled. That's why I wanted Avast to confirm or deny that information (aside from license/version info) is being sent. It's not safe to assume when a company profits on the sale of the data, it's best to ask.
-
You can address them directly (in quoting them) and/or send a PN.
-
You can address them directly (in quoting them) and/or send a PN.
This kind of thing should be public and known. The information should have been available, concise and clear.
That is why I didn't ask question the legal department instead.
I am not the only one that wants to know.
-
You can address them directly (in quoting them) and/or send a PN.
This kind of thing should be public and known. The information should have been available, concise and clear.
That is why I didn't ask question the legal department instead.
I am not the only one that wants to know.
Who are the others ???
-
You can address them directly (in quoting them) and/or send a PN.
This kind of thing should be public and known. The information should have been available, concise and clear.
That is why I didn't ask question the legal department instead.
I am not the only one that wants to know.
Who are the others ???
Others share the concerns and if you also look around online you will find many ask the same thing in many different places. Privacy matters.
-
You can address them directly (in quoting them) and/or send a PN.
This kind of thing should be public and known. The information should have been available, concise and clear.
That is why I didn't ask question the legal department instead.
I am not the only one that wants to know.
Who are the others ???
Others share the concerns and if you also look around online you will find many ask the same thing in many different places. Privacy matters.
Because it matters, you've already received a reply from Avast.
-
You can address them directly (in quoting them) and/or send a PN.
This kind of thing should be public and known. The information should have been available, concise and clear.
That is why I didn't ask question the legal department instead.
I am not the only one that wants to know.
Who are the others ???
Others share the concerns and if you also look around online you will find many ask the same thing in many different places. Privacy matters.
Because it matters, you've already received a reply from Avast.
I asked what data is sent when I disable the aforementioned cloud/data sharing items. There has been no answer, has there? No.
-
@SweetieBelle: Where have you found that list on image in first post?
-
@SweetieBelle: Where have you found that list on image in first post?
PDF.doc >> https://www.av-comparatives.org/data-transmission-internet-security-products/
-
@SweetieBelle: Where have you found that list on image in first post?
PDF.doc >> https://www.av-comparatives.org/data-transmission-internet-security-products/
That's what got me asking questions. The file is quite dated (2014) and many of the products have been updated and changed extensively since that time. For example, AhnLab's offering has a completely new engine. It's too bad there's no update to the file.
I have asked quite a few companies offering AV products so far. All but one still appear to transmit personally identifying information after opting out, sometimes in plaintext. (Avast not included because they have not answered)
The general rule is simply that you cannot opt out.
Emsisoft was very forthcoming, explained exactly what was sent, how the back end of various features work, how they protect the data and so on. Their EULA is very clear that they do not sell, rent or pass on any data that they do collect.
If you opt out, the product will still work, you will still get updates, but the program hashes will not be sent so you will have to define which programs are trusted or not yourself. This is expected.
The URL filtering is based on a predefined local list, as opposed to scanning each page or sending the URL to a remote server.
My findings have been rather disturbing in general and privacy has not been preserved for the majority of AV products. I know this is consistent with most applications and even windows of course, however being able to control ones data is a selling point. Not everybody will lock these products down, but the option should be there.
Windows 10 has come under fire for near useless privacy controls. There is still a lot of data transmitted, even unencrypted. (Typically that occurs when multiple encrypted transmissions have failed). It can even bypass hosts file imposed restrictions.
Products that are expected to be trustworthy should be scrutinised.
Deceptive and untoward conduct, or misconduct if you will, can have national security implications. People trust this software due to preconceived beliefs held in regard to antivirus and firewall programs.
Russia accused of spying on U.S. officials using Kaspersky software (https://www.cbsnews.com/videos/russia-accused-of-spying-on-us-officials-using-kaspersky-software/)
OCTOBER 11, 2017, 7:38 PM According to multiple reports, Israeli spies tipped off the NSA that Russia was spying on them, using antivirus software made by the Russian company Kaspersky Lab. Frank Cilluffo, Director of the Center for Cyber and Homeland Security at George Washington University and former senior homeland security official to former President George W. Bush, joins CBSN to discuss what these allegations mean.
-
The URL filtering is based on a predefined local list, as opposed to scanning each page or sending the URL to a remote server.
I would like to know if for instance Avast does this locally with their list of URLs that trigger a popup. Most days I get a popup trying to scare me into buying their VPN or some other paid extra. Exactly when I visit a site. Obviously this is triggered by that visit. It's too precise. Is this a local list or does Avast transmit every URL visited to themselves? Or maybe statistics about hits on the list. Aggregated or otherwise.
This when all the mentioned options known to transmit information have been disabled. So reputation services, Avast community, data sharing, cybercapture.
If a dev or PR person could weigh in, that'd be swell.
-
(...)
Have you got any answers from Avast by PM or the topic is going to be buried?
-
(...)
Have you got any answers from Avast by PM or the topic is going to be buried?
They have not replied to me in PM. They are now the only ones I have asked that have flat out not replied.