SafeZone browser installed itself

[REDACTED]

Read the EULA. It clearly says that avast can (and will do so if they think it is needed) install updates.

I do not see where it says that in the EULA.

What i do see in the EULA is this:

3. Upgrades and updates

Upgrades and updates of the Software shall be provided to you by AVAST during the term of the license indicated in the Documentation or other transaction materials made available to you at the time you purchase the Software. You will not be entitled to receive any feature or content updates or upgrades of the Software unless you renew the Service Period or purchase a new subscription.

This quote is from the EULA available here:
https://www.avast.com/eula-avast-consumer-products

Can you post the exact quote of what you see in the EULA making you believe they have the right to silently auto install options ?

[REDACTED]

And as I have said in several posts,
I also very much dislike the way avast has rolled out this update to the users of the free version.
But that doesn't change anything about the fact they had the right to do so and that the users did gave them permission for it.

Respectfully, Eddy, this is absolutely not accurate.  You need to go ask a lawyer. I did.....one General and one IP Council in a fairly large ($1B +) IT company.
They absolutely hands down said the EULA (as written) does not allow for previously un-installed software to be loaded.
It does give permissions for updates to existing.
It also does allow Avast to not have any responsibility if they mess up your machine.
So, the question becomes does Avast feel SafeZone is just some update ?

......but whether you agree, have a law degree, or not.......the bottom line (and relevant points here), as you/Bob & all the others said "how" Avast did this is wrong.
Also, these type silent/forced efforts are clearly "policy" at Avast.....just look at history (GrimeFighter, SafeZone, Program Versions, ie. NG) that all have introduced risk or have base problems on people's PC with the install and forced/auto boots.  This is not the action of a security company whom has the best interests in protecting their customers but rather a marketing company that is playing the #s game they can win more new customers by pushing/forcing software than ones they lose by these tactics.

For me, I am switching over to another A/V......and yes there are ones out there that do not do this.
I am also recommending to my friends in IT that have broached the subject to move as well.
In do a rough count this is over 1500 paid licenses to Avast and counting.....maybe a drop in the bucket to Avast but that is also six IT managers who have friends in the tech biz.....word travels fast.
I'm testing (so are they) the best alternative.
You just cannot risk using a companies product that will at their discretion install new software on your PC.....WAY too high risk the impacts.

To me the guidance for Avast to retract is simple........
Provide a sticky and clear definition of their "pushware" and opt-in/out policy.
Update the current installer to act like they state is does in the blog.....which currently is not true.
https://blog.avast.com/what-is-safezone-browser
Uninstall SafeZone
to uninstall SafeZone browser, or any other Avast component, then please go to your Control panel > Programs & Features > Double click on Avast > Select Modify > Uncheck the box next to the component you want to remove > Next > Finish.

[bob3160]

You just cannot risk using a companies product that will at their discretion install new software on your PC.....WAY too high risk the impacts.

Especially when it comes to browsers! Looking at the history:

Avastium by Avast - broken:
- http://www.techworld.com.au/article/593500/researcher-finds-serious-flaw-chromium-based-avast-safezone-browser/
Why the heck should I believe installing a browser fork produced by some AV vendor is a good idea? I'll just use a VM or something like Sandboxie, instead of believing that AV vendors know how to write web browsers. Thanks but no, thanks.

"After Ormandy reported the flaw on Dec. 18, Avast deployed a temporary fix that broke the attack chain. The company provided a complete fix Wednesday as part of Avast version 2016.11.1.2253."

[Skakara]

"After Ormandy reported the flaw on Dec. 18, Avast deployed a temporary fix that broke the attack chain. The company provided a complete fix Wednesday as part of Avast version 2016.11.1.2253."

And that proves that nothing like that is never going to happen again?

Let me also remind that the security hole could be exploited even if user never even opened the SafeZone browser! Here's the proof of Avast incredible stupidity regarding security:

According to the Google researcher, Avast opens a Web accessible RPC service on the local computer that listens on port 27275. A malicious website opened in any browser can therefore send commands to this service by forcing the browser to make requests to http://localhost:27275/command.
...
Avast has removed what Ormandy calls a "critical security check" that prevents non-Web-related URL schemes from being opened from the command line. This protection, which exists in the original Chromium, was not present in Avastium, making it possible for an attacker to ultimately construct a payload that can read local files.

If they do this kind of idiotic stuff, who knows what else. I vaguely remember reading that Ormandy is not going to "audit" these browser forks anymore.. of course he's not the only one that could do it but still..

[bob3160]

"After Ormandy reported the flaw on Dec. 18, Avast deployed a temporary fix that broke the attack chain. The company provided a complete fix Wednesday as part of Avast version 2016.11.1.2253."

And that proves that nothing like that is never going to happen again?

Let me also remind that the security hole could be exploited even if user never even opened the SafeZone browser! Here's the proof of Avast incredible stupidity regarding security:

According to the Google researcher, Avast opens a Web accessible RPC service on the local computer that listens on port 27275. A malicious website opened in any browser can therefore send commands to this service by forcing the browser to make requests to http://localhost:27275/command.
...
Avast has removed what Ormandy calls a "critical security check" that prevents non-Web-related URL schemes from being opened from the command line. This protection, which exists in the original Chromium, was not present in Avastium, making it possible for an attacker to ultimately construct a payload that can read local files.

If they do this kind of idiotic stuff, who knows what else. I vaguely remember reading that Ormandy is not going to "audit" these browser forks anymore.. of course he's not the only one that could do it but still..

The vulnerability was patched and isn't anything still within the 2016 release.

[Skakara]

That one patched.. but like I said, who knows what other horrible holes there are, or are going to be. Just because there's no public info about a security flaw, doesn't prove that there really isn't one (recently there has been few news about even 10 year old holes (in other products) that have not been found). And the real beef in this thing is how Avast made that browser, and subsequently users whole system vulnerable.

[Skakara]

The silence from Avast regarding this issue is deafening, even if the response has been overwhelmingly negative, and even from some of the Avast Apologists.

[bob3160]

That one patched.. but like I said, who knows what other horrible holes there are, or are going to be. Just because there's no public info about a security flaw, doesn't prove that there really isn't one (recently there has been few news about even 10 year old holes (in other products) that have not been found). And the real beef in this thing is how Avast made that browser, and subsequently users whole system vulnerable.

Now your using assumptions and that's never a good thing to use by anyone.

[Skakara]

You can draw power to assumptions from the fact how they made that browser, and subsequently users whole system vulnerable. It undermines the trust considerably for those who really understand how stupid their mistakes were.

[bob3160]

Since I've entered the Publishers Clearing House Sweepstakes, I can assume that I'll soon be getting $7000.00 per week.

[bob3160]

Since I've entered the Publishers Clearing House Sweepstakes, I can assume that I'll soon be getting $7000.00 per week.

The power of assumption can then be used from this example in the following way:
Based on my upcoming increased income, you can now assume that I'll be paying back the money that I owe you.

[REDACTED]

Well... Now it's pretty simple. Live with it or uninstall the browser.

If you already have it installed on your system, talking and writing about that doesn't change anything. It already happened.
If you don't have it, well... Be happy! I have it, I don't need it, I don't really like this but at least it's not something very bad, it didn't broke anything and so on.

One fact I know for a long time now: Doing good while forcing it, it's not doing good.
If you want to make users happy, let them know a new feature is available for them to install. For free. Some don't care, some will be happy. At least nobody will be upset.

[bob3160]

Well... Now it's pretty simple. Live with it or uninstall the browser.

If you already have it installed on your system, talking and writing about that doesn't change anything. It already happened.
If you don't have it, well... Be happy! I have it, I don't need it, I don't really like this but at least it's not something very bad, it didn't broke anything and so on.

One fact I know for a long time now: Doing good while forcing it, it's not doing good.
If you want to make users happy, let them know a new feature is available for them to install. For free. Some don't care, some will be happy. At least nobody will be upset.

Couldn't agree more.
A pre announcement and an option to refuse would have made this a welcome addition.

[stibi]

.. and many people here wait for that, Bob.

It's interesting that no one from the Avast team want's to write here in the last days.

[REDACTED]

The power of assumption can then be used from this example in the following way:
Based on my upcoming increased income, you can now assume that I'll be paying back the money that I owe you.

OK...that is funny.