Avast WEBforum

Other => General Topics => Topic started by: EdAgee on March 24, 2020, 10:54:23 AM

Title: Avast and DigiCert Collaboration
Post by: EdAgee on March 24, 2020, 10:54:23 AM: Could somebody please point me to documentation regarding the collaboration between Avast and DigiCert?

Thank you.
Title: Re: Avast and DigiCert Collaboration
Post by: Asyn on March 24, 2020, 11:15:40 AM: Hi, not sure what you mean, DigiCert is a CA.
Title: Re: Avast and DigiCert Collaboration
Post by: EdAgee on March 24, 2020, 12:38:08 PM: Yes, and there is a file, data_3, located here:

. . . AppData\Roaming\AVAST Software\Avast\Cache\Cache

And that file contains a lot of frequently updated information about these 5 certificates:

DigiCert Assured ID Root CA - - - DigiCert Assured ID Root CA
DigiCert Global Root CA - - - DigiCert Global Root CA
DigiCert Global Root G2 - - - DigiCert Global Root G2
DigiCert Global Root G3 - - - DigiCert Global Root G3
DigiCert High Assurance EV Root CA - - - DigiCert High Assurance EV Root CA

Other information caused me to think there was some sort of collaboration between the two companies, but if I am wrong I would certainly adjust my direction of thought on the matter.

Oh yes, and thank you for your attention to my line of enquiry.
Title: Re: Avast and DigiCert Collaboration
Post by: Asyn on March 24, 2020, 12:44:25 PM: You're welcome. (https://en.wikipedia.org/wiki/Certificate_authority)
Title: Re: Avast and DigiCert Collaboration
Post by: EdAgee on March 24, 2020, 12:56:28 PM: Thank you for the link, but what is Avast's purpose in maintaining updates on those 5 certificates?
Title: Re: Avast and DigiCert Collaboration
Post by: Asyn on March 24, 2020, 01:09:04 PM: All Avast files are signed by DigiCert, nothing to worry about.
Title: Re: Avast and DigiCert Collaboration
Post by: EdAgee on March 24, 2020, 01:19:12 PM: So my use of the vocabulary "collaboration" is correct, yes?

And I didn't mean to come across as worried.

I am just wondering how this could be after what I thought were some problems between Avast and DigiCert. And then the DigiCert purchase of Symantec in 2017.

Do you know when the collaboration started between DigiCert and Avast?
Title: Re: Avast and DigiCert Collaboration
Post by: Asyn on March 24, 2020, 01:30:21 PM: Quote from: EdAgee on March 24, 2020, 01:19:12 PM
So my use of the vocabulary "collaboration" is correct, yes?
Nope, it's a paid piece of service.
Title: Re: Avast and DigiCert Collaboration
Post by: EdAgee on March 24, 2020, 01:37:25 PM: Please just take that question of mine as an aside. That definition is not an important point.

But I would like to know where I can find any information about when Avast started using the DigiCert products?

After a number of hours searching the Net I was not able to find anything.

In fact, the information that Avast is using DigiCert products also did not turn up on the Net.

If anyone can point me to any documentation on any of this I would be very appreciative.
Title: Re: Avast and DigiCert Collaboration
Post by: Asyn on March 24, 2020, 02:51:00 PM: Quote from: EdAgee on March 24, 2020, 01:37:25 PM
But I would like to know where I can find any information about when Avast started using the DigiCert...
I'm not aware of any such info, but definitely as long as I can remember...
Title: Re: Avast and DigiCert Collaboration
Post by: EdAgee on March 24, 2020, 03:27:27 PM: I have about three hours of research notes and the information that Avast is using DigiCert products did not show up in any of the many, many leads I checked.

But it is now out there, because I suspect the bots have picked up on this thread, and my own team on my site now knows about this, so this information isn't going away. But our online meetings on my site are strictly confidential, so nothing gets leaked from there.

Also, during my research I found that there have been some folks in this business that have doubts about DigiCert products. There have been such discussions on this site, too.

For that reason the Avast customers probably should have already been informed of what we now have in this thread.

And that is just for starters.

By the way, now I am worried. I wasn't before.

By the way, this all started because of that other thread and that signature code showing up in a regular Gmail account. If any of the employees had gone to the trouble to address that issue in that thread I might never have started down this DigiCert road I have gotten on. I waited for a fair number of business days for an answer to arrive in that thread, so it isn't like I was pushing really hard. And I still haven't gone into that at Google, except informally. Also in confidence.

Did you know the following, Asyn?

Quote
August 2017 was relatively slow on the M&A front. Symantec sold its website security business to DigiCert for $1 billion, plus a stake in the larger entity.

A lot of money at stake if somebody slips up.
Title: Re: Avast and DigiCert Collaboration
Post by: Asyn on March 24, 2020, 03:37:39 PM: Quote from: EdAgee on March 24, 2020, 03:27:27 PM
Did you know the following, Asyn?
Quote
Symantec sold its website security business to DigiCert for $1 billion, plus a stake in the larger entity.
Yep.
Title: Re: Avast and DigiCert Collaboration
Post by: EdAgee on March 28, 2020, 06:33:50 AM: First of all let me thank CraigB for recommending in your recent correspondence that I continue my research and on that note I have a question for Asyn which is stepping away for the moment from the questions thus far answered that related to the Avast use of DigiCert products:

Is Avast inserting a security certificate of its own when I see the Avast Web/Mail Shield Shield Self-signed Root?
Title: Re: Avast and DigiCert Collaboration
Post by: Asyn on March 28, 2020, 07:11:35 AM: Quote from: EdAgee on March 28, 2020, 06:33:50 AM
Is Avast inserting a security certificate of its own when I see the Avast Web/Mail Shield Shield Self-signed Root?
Yes, it's needed for HTTPS scanning. (https://support.avast.com/en-ww/article/190/)
Title: Re: Avast and DigiCert Collaboration
Post by: EdAgee on March 28, 2020, 07:20:26 AM: Quote from: Asyn on March 28, 2020, 07:11:35 AM
Quote from: EdAgee on March 28, 2020, 06:33:50 AM
Is Avast inserting a security certificate of its own when I see the Avast Web/Mail Shield Shield Self-signed Root?
Yes, it's needed for HTTPS scanning. (https://support.avast.com/en-ww/article/190/)

Thank you.
Title: Re: Avast and DigiCert Collaboration
Post by: Asyn on March 28, 2020, 07:33:24 AM: Quote from: EdAgee on March 28, 2020, 07:20:26 AM
Quote from: Asyn on March 28, 2020, 07:11:35 AM
Quote from: EdAgee on March 28, 2020, 06:33:50 AM
Is Avast inserting a security certificate of its own when I see the Avast Web/Mail Shield Shield Self-signed Root?
Yes, it's needed for HTTPS scanning. (https://support.avast.com/en-ww/article/190/)
Thank you.
You're welcome.
Title: Re: Avast and DigiCert Collaboration
Post by: EdAgee on March 28, 2020, 08:12:02 AM: Please excuse me, because I wasn't intending to carry that last line of questioning any further, but the following on that page you sent me is having me wondering what I am missing.

In answer to: "What is HTTPS scanning in Avast Antivirus?"
Quote
HTTPS scanning decrypts and scans encrypted traffic to detect potential mawlare (malware) contained on sites using HTTPS connections.

But in answer to: "Is the HTTPS connection still secure when Avast scans it?"
Quote
When the Web Shield in Avast Antivirus scans the HTTPS connection, the data being scanned remains encrypted and secure.

I am obviously missing something because I see a contradiction. Can you please help me?

And you better ask the company to fix that spelling on that page.
Title: Re: Avast and DigiCert Collaboration
Post by: Asyn on March 28, 2020, 08:17:56 AM: It's quite complicated to explain in detail and I've no time for a tutorial, sorry.
Title: Re: Avast and DigiCert Collaboration
Post by: EdAgee on March 28, 2020, 08:45:10 AM: Excuse me, but you placed that page before all reading this thread and that page is for all customers and so this ...

decrypts and scans encrypted traffic / remains encrypted

... seems like it should be explained. Maybe we are to assume that "data" and "traffic" are two different things?

Anyway, if you have no time for explaining that, then please tell us where we go to receive the explanation we need.

"We" represents the company's customers.

I believe serving the company's customers is a part of your group's purpose for being, yes?
Title: Re: Avast and DigiCert Collaboration
Post by: Asyn on March 28, 2020, 09:03:33 AM: Wait for one of the devs and/or submit a ticket: https://support.avast.com/contact (paid versions)
Title: Re: Avast and DigiCert Collaboration
Post by: EdAgee on March 28, 2020, 09:10:44 AM: Okay, but I presume you'll be handling that spelling glitch at your end, yes?
Title: Re: Avast and DigiCert Collaboration
Post by: bob3160 on March 31, 2020, 04:33:38 PM: Quote from: EdAgee on March 28, 2020, 09:10:44 AM
Okay, but I presume you'll be handling that spelling glitch at your end, yes?
Asyn is a product use just like you. He doesn't work for Avast.
Title: Re: Avast and DigiCert Collaboration
Post by: EdAgee on March 31, 2020, 09:37:57 PM: Quote from: bob3160 on March 31, 2020, 04:33:38 PM
Quote from: EdAgee on March 28, 2020, 09:10:44 AM
Okay, but I presume you'll be handling that spelling glitch at your end, yes?
Asyn is a product use just like you. He doesn't work for Avast.

Please excuse me for the presumption that a member of the group the company allowed to be formed with the title of Avast Überevangelist would be more inclined to see embarrassments removed from official company documentation than a regular member like myself.

Well, I guess I am now making another assumption, aren't I?

Maybe none of you view a company in this business not being able to properly spell 'malware' as an embarrassment.

I suspect some of the company's competitors might find that amusing and that we may be seeing this little bit of amusement posted on one of their sites. No problem though, right?

Like I asked, please excuse me for my errors.