AVG can sell your browsing and search history to advertisers

http://www.wired.co.uk/news/archive/2015-09/17/avg-privacy-policy-browser-search-data

by SimplyUseless • 11 years ago

260 130 11 years ago

wired.co.uk

TAM_cmlx2• 11 years ago

As a possible note of interest, I had to disable AVG in order to read this article.

blumkvist• 11 years ago

How come?

TAM_cmlx2• 11 years ago

Original link was to slashdot, I think. AVG said "Could be a Trojan Horse Host" and then gave me a cheerful green bar and said, "Threat has been successfully removed."

tux3• 11 years ago

The same thing happened with the AVG slashdot article. I wouldn't be surprised if it was deliberate...

beedogs• 11 years ago

Why on earth are you running AVG in the first place?

outside1234• 11 years ago

If you aren't paying, you are the product.

tzmudzin• 11 years ago

So how much did you pay for your GPL software? Or for posting your comment? Do you expect to pay with your privacy for those?

For sure there's no free lunch, but I believe you're making it too easy for AVG. An antivirus is a piece of software one normally trusts. It's a shame if this trust is misused. And let's not deceive ourselves that users will attempt to understand fully the technical stuff behind the data privacy statement they put out. While trivial for an IT person, the jargon will not be understood by non-techies.

throwaway13337• 11 years ago

We are almost certainly the product on HN - eyeballs of engineers interested in startups to advertise startup jobs to if not to subtly control the conversation in this area.

This isn't an awful thing but it's absoultely true that we both are the product here.

foolrush2• 11 years ago

Indeed.

The “If you aren't paying you are the product” is an anachronistic and ignorant trope leveraged in fanfolk wars. It excuses those things that are paid for and are further monetised. Take for example your music purchases and a “You might like...” suggestion list; you have paid for the system, purchased music, and surprisingly your purchases are being tracked and further monetisation is attempted. Vast troves of interaction data is accumulated and analysed ad infinitum[1].

Free lunches _do_ exist as well, as anyone with a good friend or child will attest to.

The slogans of hypercapitalism are rampant, none of which do justice to the complexities of context.

[1] Yes Apple is included in this, as we know from the extensive market research revealed via the Samsung lawsuit and the fact that Ping no longer exists.

federico3• 11 years ago

This might be a good example:

http://www.enricozini.org/2015/free-as-in-facebook/

SG-• 11 years ago

His comment is very relevant when it comes to for-profit corporations.

skarap• 11 years ago

Unfortunately it doesn't work in the reverse direction. Nobody will stop AVG (or any other company) from selling their paying customers too for additional profit.

DinkyG• 11 years ago

Just finished uninstalling AVG...

g0v2• 11 years ago

I recently switched from Bitdefender to AVG, and like you just uninstalled AVG.

I'm not sure where to go from here.

pdonis5• 11 years ago

I'm not sure where to go from here.

Linux.

newjersey• 11 years ago

(Assuming you're using Windows)

Are you using a recent version of Windows (8, 8.1, or 10)?

Do you have automatic updates enabled?

Do you have standard Windows features such as User Access Control enabled?

Do you use the computer with a standard user account as opposed to an administrator (root access) user account?

If the answers to all these questions are yes, I'd say you don't need an antivirus solution. Don't listen to the scaremongers. Microsoft has got you covered.

notatoad• 11 years ago

stop. don't use an antivirus. back up your data, and use a tool like acronis to take an image of your system state. If you get a virus, re-image.

if you keep your OS and browser up to date, and don't open random sketchy EXEs, you'll be fine.

zo1• 11 years ago

"I'm not sure where to go from here."

No where. I've been antivirus-free for the better part of a decade. 0 infections of malware of any kind.

Have a look at this link, it explains things a whole lot better than I could:

http://www.cnet.com/how-to/i-dont-use-anti-virus-software-am...

vacri3• 11 years ago

If you're on Windows 7, use Microsoft Security Essentials. It does the job, and isn't nagware.

jaskerr• 11 years ago

Why did you switch from Bitdefender? I'm forced to "sysadmin" my family's Windows systems ... and last I looked, Bitdefender seemed to do a good job. Was I wrong to recommend?

dang• 11 years ago

Url changed from http://slashdot.org/story/299691, which points to http://news.softpedia.com/news/avg-proudly-announces-it-will..., neither of which are very informative.

I found the Wired article by using the 'web' link we added last week to search on the title (which I had to modify a bit). If anyone can suggest a better URL, we'll change it again.

ryanschneider• 11 years ago

Personally, I think if they a) are very upfront about this (clearly stated during install) and b) offer a paid alternative then I'd be fine with this. There's actually some synergy if they do things right: you were most likely infected by a site you visited (most likely a malicious ad), so if they also use this data to track sources (which isn't clear) then it could even make for a better product.

Of course if they aren't being clear about the data-for-product swap then I'm not in favor.

rhizome• 11 years ago

Personally, I think if they a) are very upfront about this (clearly stated during install) and b) offer a paid alternative then I'd be fine with this.

To be sure, you don't really know if you'd be fine with this because it's never been tried, and probably won't, because no company dealing user information out the back door has ever given any indication that they are open to giving up even a shred of this business line.

belorn• 11 years ago

It used to be that government would go after those for deceived people for money. Bait-and-switch is one of the oldest form of fraud there is and its fairly easy to do with 40 pages "policy" written in legalize.

grrowl• 11 years ago

Well, the government isn't being effective against the true criminals here (the virus developers), and anti-virus isn't free, and government isn't subsidising AV software. Something's gotta give.

jupiter23• 11 years ago

The irony... a product that is suppose to protect you from malware becomes the very tool that engages in illegal and unconstitutional data-mining.

There used to be a distinction between services offered on the web and apps running on the desktop (spyware, illegal). Windows 10 changed all that (along with lots of help from mobile OSes). It's (constitutional) criminal behavior (eula or not) and should be classified as such.

pixl97• 11 years ago

There used to be a distinction between services offered on the web and apps running on the desktop (spyware, illegal). Windows 10 changed all that

I don't think you've paid much attention, but that had changed long before Windows 10. This is just Microsofts big foray into that dark market. For years other companies have done the same thing.

jupiter23• 11 years ago

"I don't think you've paid much attention, but that had changed long before Windows 10."

You basically repeated everything I just said. You see... I do pay attention. Along with "lots of help from mobile OSes", Microsoft's big push into embedding spyware into a Desktop OS has completely changed the game. It has given applications - running on user local machines - license to install spyware (which is still considered illegal under the law).

ams61102• 11 years ago

Unconstitutional?

jupiter23• 11 years ago

https://en.wikipedia.org/wiki/Right_to_privacy

Granted this is a complicated issue but we shouldn't be so quick to disregard privacy rights we have fought (and died) so long for. When backdoors and spyware are embedded into a person's home computer and/or personal property (from a car to a mobile OS), we have also allowed illegal search and seizure.

forcer2• 11 years ago

AVG has a long history of doing scammy things. Starting from pushing toolbars heavily, flagging software that is harmless but poses competition etc. They will never change. Unfortunately, most of the public is not knowledgeable enough to understand this. In Czech Republic many people see this company as a national pride. I have been dealing with that company for a while and certainly do not agree with my fellow countrymen.

x0x03• 11 years ago

The thing that befuddles me is if someone came up to you on the street and handed you $100, you'd most likely refuse until you could figure out what the catch is. If someone offered you free movies or music on the internet, you'd either assume they were stolen or there was a catch. But when people download software that was both complex to build and intricate and expensive to maintain, they assume that there isn't a catch. I don't understand.

forcer2• 11 years ago

I agree but one would expect that AV vendors have enough opportunities to make money without sacrificing their users and their reputation. Look at how many products AVG has. I think they should do just fine by converting free users to paid subscriptions. Couple of years ago most of their revenue came from toolbars. Since then they have converted their business model to push more for premium upsell. They do it well, I don't have problem with such a business model. Free users serve them well as free marketing force, they don't have to abuse them.

cm21872• 11 years ago

linux is free. What is the catch?

vacri3• 11 years ago

The internet is full of free stuff - you even access the web through a free bit of software.

marcosdumay• 11 years ago

If people could give $100 and not lose them, there would be people trying to give you a bill at every corner. Mostly for good reasons.

Aqwis• 11 years ago

Between this and JetBrains' unpopular licensing changes, this has been a bad week for Czech software companies.

The only thing that could top it would be allegations that Bohemia Interactive are selling military simulators to North Korea. :)

lemevi• 11 years ago

I love IntelliJ IDEA and it's forks so I wasn't really that upset about any of those licensing changes, well other than requiring an internet connection. You know sometimes I'm going to want to do work when I don't have internet on, like on the train to work or while waiting for my daughter to finish her music lessons.

I am glad that they reversed those decisions.

signal11• 11 years ago

Isn't ESET (NOD32) Czech too? They are pretty decent and I quite like their "gets out of your way" UX.

Kenji2• 11 years ago

Who the hell uses an anti-virus in 2015? Those things slow down your PC by like 20% for almost no benefit at all. Just don't open suspicious executables (e.g. from torrents), keep your OS and tools up to date and lock your browser down when it comes to plugins and JS execution.

tdicola• 11 years ago

I'm not sure why you're being downvoted, it's very good advice for someone who is computer literate enough to not run things they don't trust. Keep your OS and software up to date, uninstall Flash, disable crap that automatically previews files, and stick to doing most of your computing in a good web browser.

tacone• 11 years ago

Maybe because you don't need to actually open an executable file to get infected. Even displaying an image in your web browser may do: https://en.wikipedia.org/wiki/Arbitrary_code_execution

Asbostos• 11 years ago

Exactly. It's amazing how many people don't realize that this is all you need to do. Antivirus is only for people who don't follow those two rules.

Well JS is fine as long as the browser is up to date. Normal people aren't going to be hit by zero-days.

mtgx3• 11 years ago

Normal people aren't going to be hit by zero-days.

Normal people still use IE. There are definitely plenty of IE zero-days out there that have hit normal people. Mozilla also announced a month ago that an exploit using a FF zero-day was running in the wild.

Kenji2• 11 years ago

Well, a couple of years ago I was hit by a drive-by virus. Just opening a website in (up to date) Firefox literally opened .exe files on my PC and infected the entire OS. I burnt my hands once - not again. This might be an anecdote to you but boy that scarred me - the idea that clicking a link could compromise my entire system like that.

Even then - an antivirus program is unlikely to stop such an intrusion. It's just utterly ineffective, and I got viruses before despite having an anti-virus. Also, my anti-virus always deleted my hacktools and own programs which was a nuisance. Hence I don't use it anymore.

Too• 11 years ago

I think 20% is a pessimistic number, I've seen cases of over 50%. A friends computer (quite decent, i5 8gb) was slow to the point of not being usable at all, opening word would take like 30 sec of disk thrashing. He was on the verge of throwing it out when I took a look at it and uninstalled his antivirus, it became like brand new again.

weavie• 11 years ago

Non-technical partners.

My wife constantly gets all sorts of crap on her machine. I have tried to explain to her the difference between popups that says she has a virus on her computer and OS alerts, but it just goes right over her head.

ionised2• 11 years ago

Those things slow down your PC by like 20%

Citation needed.

ndesaulniers• 11 years ago

A few Mozilla execs have left and gone there.

* Gary Kovacs: Former Mozilla CEO: https://www.linkedin.com/in/garykovacs

* Harvey Anderson: Former Mozilla Chief Legal Counsel: https://www.linkedin.com/in/harveyanderson

* Todd Simpson: Former Mozilla CIO: https://www.linkedin.com/in/tgsimpson

* Rick Fant: Former Mozilla VP of Marketplace: https://www.linkedin.com/in/rickfant

hvis• 11 years ago

It would be a lot more suspicious if you showed the reverse flow of personnel.

The above just indicates that some people might start to prefer, over time, a cushier job at a less-scrupulous corporation.

redml• 11 years ago

they lost that sweet google deal and im guessing they're getting less from their deal with yahoo

bedhead• 11 years ago

There is no shortage of scammy software companies like AVG, but what always cracked me up about AVG was their logo. Do you think it's a coincidence that it bears a strong resemblance to the Windows logo?? Why might that be, hmmmm? Maybe so a bunch of unsophisticated users get the impression it's a real product somehow related to Microsoft?

The company is a joke like all the other toolbar companies. I wrote to a number of financial journalists at the WSJ a few years ago begging them to write an expose on these firms and Google's compliance in allowing them to exist. No one ever wrote me back.

Stratoscope2• 11 years ago

I hate antivirus software with a passion. I've wasted too many weeks of my life hacking around bugs that antivirus programs introduced into my customers' systems.

A couple I've dealt with in the last six months:

McAfee Antivirus causes applications built with Unity 4 to fail when they call WWW.LoadFromCacheOrDownload() on a large asset bundle. This API call downloads a temp file and then renames the file to move it into the cache. But McAfee also opens the file for a virus scan. For a large file, the virus scan may not complete before Unity tries to rename the file, so the rename fails and you never get the asset bundle.

For one client I fixed this by patching Unity's .exe file to add a retry loop on the rename call. Unity 5 also works around this issue with the same retry loop.

AVG Antivirus causes updates to fail for applications that use wyUpdate. wyUpdate calls the CreateMutex() function in the Windows API to make sure another updater instance isn't already running. Bizarrely, when AVG is installed, CreateMutex() returns the wrong value, so wyUpdate thinks another instance is running and bails out. No updates for you!

Going back a few years, I tried NOD32 after some friends recommended it. It seemed fine, except the Alt+Tab key no longer worked. It was a known bug, unfixed for some time.

About 5-6 years ago, McAfee had a known bug - unfixed for nearly a year - than under some circumstances it would erase the entire hard drive. This was the ultimate in virus protection!

userbinator• 11 years ago

False positives are the other dark side of AV; here's AVG detecting completely innocuous "Hello World" programs as potential threats:

http://www.cplusplus.com/forum/beginner/67634/

https://groups.google.com/d/topic/mingwusers/kFrCqECTY_Y

Along the same lines, it's rather common that keygens/cracks/patches are detected as false positives too:

http://underlore.com/anti-virus-community-creates-false-posi...

kbenson• 11 years ago

Maybe the Ken Thompson Hack[1] is alive in the wild, or AVG just believes it is. ;)

1: Reflections on Trusting Trust: https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html

PhasmaFelis• 11 years ago

I think "detected as false positives" is too mildly put. It implies that it's an honest if bumbling mistake, rather than deliberate and malicious FUD.

dspillett2• 11 years ago

it's rather common that keygens/cracks/patches are detected as false positives

That is unavoidable if the scanning engine is trying to apply heuristics to pick up on attacks (or variants thereof) that are not in its database yet, especially with cracks and other patches: changing the behaviour of executables the way they do is by its nature similar to what viruses and worms are attempting to do.

hvo• 11 years ago

+1 for your comment. I really can't stand antivirus software.Sometimes no antivirus is better than antivirus software.It is another area of software development that is broken and crying for a fix.Who is ready to up this challenge?

tim333• 11 years ago

The best fix would seem to be more secure OSs like iOS and Chromebooks.

mccracken2• 11 years ago

I'm interested, how did you figure out that's what was happening (just the first example)?

Stratoscope2• 11 years ago

For the issue with McAfee interfering with file move calls, Unity was logging an error message that said something like "Cannot move file into cache." That was a good clue that a file move operation was failing.

So I ran the app under the amazing API Monitor [1] and enabled logging for MoveFileA(), MoveFileW(), MoveFileExA(), MoveFileExW(), and similar "move file" APIs. It showed a failure on a MoveFileExW() call with the address of the call.

We'd found that Unity 5 didn't have the same problem (but we weren't ready to migrate to Unity 5 yet), so I also ran a Unity 5 test app under API Monitor and found the same failure on MoveFileExW(), along with several retries on the call until it succeeded. This told me just what I needed to patch the call for the Unity 4 app.

For the issue with AVG and wyUpdate, since wyUpdate is open source I just ran it under the debugger, and as luck would have it, the failing mutex.WaitOne() call was near the beginning of Program::Main() in the C# code [2].

(I mentioned WinMain() and CreateMutex() previously - I was writing that from memory and double-checked it now.)

[1] http://www.rohitab.com/apimonitor

[2] https://github.com/geary/wyupdate/blob/master/Program.cs#L40

joe_the_user• 11 years ago

Years ago, I would have ended a similar rant with "what we need is designs that just don't do things like autorun and view-attachments-by-default"

But now, the "attack surface" has expanded inexorably to the point where the alternative to AV appears to be... none.

So this just seems to be the modern Internet, where the average user is more or less at the behest of rackets not much better than the rackets that control botnets if they aren't actually infected by them.

I've heard some botnets patch the system and expel other intruders. Yes, now, "everything is free... infection and protection equally".

Is there an alternative?

ant6n2• 11 years ago

Don't use Windows

Springtime• 11 years ago

Around 2008 or so I seem to remember Kaspersky writing metadata to every file on the OS when scanning, requiring more frequent (and longer) drive defragging. Nowadays I just use Defender on Windows 8, EMET and browser common sense. Occasionally firing up a sandbox for testing programs. Having NoScript enabled alone helps a great deal in preventing many exploits.

silveira• 11 years ago

Antivirus was one of the main original reasons I left Windows and started to lean to Free Software. In one hand I had the virus, in the other I had the antivirus, both options were terrible.

nadams• 11 years ago

When AVG was first launched it was a great AV product. Now, like most services have gone the evil direction. It became pretty obvious they went downhill after directing people who want the free version to buy their other products.

I've been uninstalling AVG and replacing it with Microsoft Security Essentials. I know a lot people will be upset over that because [their favorite AV] catches X% more viruses and malware than MSE. But you know what - MSE is light, made by the same company who made the OS, and catches most of the common viruses.

mattmanser• 11 years ago

Last time I looked MSE had fallen way behind everyone else. I could be completely wrong now.

imglorp• 11 years ago

This may be an unpopular theory, but I believe an insecure system was in MS's best interest. This would explain their weak tools and poor security.

zero-rated• 11 years ago

Hasn't most free software been doing this all along? I assumed they already were.

tempestn• 11 years ago

AVG is clearly circling the drain at this point and doing anything and everything to squeeze out as much revenue as possible before the music stops. Another example is AVG Secure Search, which is effectively malware snuck in with AVG installs. I recently spent a good many hours trying to get it off of my wife's computer, since it doesn't have an uninstaller and the removal tool they provide on their website doesn't work (or at least didn't on her machine). In fact, in researching the issue I came across multiple cases where it not only didn't work, it also deleted people's bookmarks. The program also appears to use common malware techniques to prevent manual removal. And of course, this kind of thing has been going on for years, and the company gives no impression of caring. It really seems like they're now using their experience with malware to... create malware.

hakzer• 11 years ago

And PCI compliance still requires antivirus ;(. What a crock.

sokoloff• 11 years ago

Or a compensating control.

kuyan• 11 years ago

Is there any "good" antivirus? I personally don't use any antivirus software, but I usually install Microsoft Security Essentials for not-quite-tech-savvy family members.

ddmf• 11 years ago

Went to look at the story with my AVG 'protected' laptop and couldn't view it because the website may be a trojan!

AVG can sell your browsing and search history to advertisers

Related Stories