5

I have a multiplatform client plugin that has its own trust store (ie this client app does not trust the OS trust store) that is used to talk to a webservice over TLS.

Clients that have Avast Antivirus complained about getting connection errors. Studying the Avast I identified that the origin of the problem is HTTPS monitoring: Avast does a MITM attack to be able to scan the connection, using a new cert generated by a local CA that the software controls for this. It only applies to connections that leave a browser (ie if I load the plugin from another software it works fine, looks like Avast does not interfere with that), but in the browser case the connection will fail because we do not trust the system trustore where the CA certificate is injected.

Well, while I dont like at all Avast implementation for this, and think it is very abusive and maybe even dangerous, I don´t se from their docs and public info that they would whitelist me (only would do it for banks) and I do understand I´m quite an exception case (most things that connect out from a browser trust the system truststore). And I don´t like the idea of having to guide each user that faces this how to whitelist manually our site on their avast config (its on our FAQ already, but anyway, most wont read it).

So I need to workaround this, and I would not like to do that by trusting the system store, neither dropping current security level. I think I could add some windows specific code to find something that looks like Avast MITM CA and trust it, but looks ugly and probably insecure, since each instalation has its own CA (I hope at least) and therefore I only could identify it by name (who knows when it will change?), anyway that is not really a good way to identify a certificate to trust.

Does anyone has any different idea on how to workaround this?

1

Allowing a user to add trusted roots to your app might be an option. This should be easier than guiding them through whitelisting your app with Avast, because you'll be able to design the user interface to help the user complete this task.

This also has the advantage that your product will be compatible with corporate networks where they often MITM connections on the outbound proxy to allow traffic inspection.

  • I would probably just allow the user to trust the OS store, most wont be confortable abd nake wise decisions on trusting or not specific certificates. But thanks for poiting out the corporate use scenario. Maybe I would/shoukd rather detect such situation and briefly explain to the user, allowing him to decide to add each cert directly. – CristianTM Jun 15 '16 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.