Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
I'm unsure where else in SA to ask, but this thread seems like it has people who know what they're doing?

What is the Goon consensus on the best antivirus for a local machine? I've been using MSE but anytime my laptop is near idle it spins everything up, which spins the fans on, which is loud, annoying, etc. I can get McAfee for free through my ISP (Cox): is it as terrible as YouTube parody videos suggest? I had a horrible experience with BitDefender a couple years ago. After uninstalling it, it leaves a pre-boot checker, which fails because it's not installed. Basically, I had to re-image two laptops because of this.

Thoughts, comments, and you-don't-really-know-what-you're-talking-about replies welcome.

Adbot
ADBOT LOVES YOU

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

Install Windows posted:

Have you tried running a full scan in MSE anytime recently? It may be trying to scan things it hasn't already checked while the computer's idle.

That's a very good idea. I'll try that before going down the rathole of finding an AV program to replace MSE. Thank you.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
Do you have Chrome set to automatically enable syncing extensions? If so, it may be a malicious extension that is causing the issue.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

The number of false positives from this approach should be amusing.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

psydude posted:

Well, some researchers uncovered a pretty easily exploited (and in hindsight, very obvious) weakness in thumb drive firmware. So be prepared for even more restrictions on USB drives (and devices in general).

Does Bluetooth have a physical connection protocol? Should it? Should the USB spec just be re-written? I don't have anywhere near enough domain knowledge to venture an opinion, but am curious what others think.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
BitDefender is okay so long as you never uninstall it. It's de-install process leaves something on the boot sector that will stop Windows from booting. I've had to reformat two different computers due to this.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

Stanley Pain posted:

I see someone here who doesn't actually work for a "big company". ;)

I received a document the other day in Word 2003 format. 2003? Really? WTF are you doing with Office 2003? This is the same type of company that would be paying Microsoft maintenance for the last 11 years, too.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
Old programs don't faze me. I've replaced systems which themselves had replaced punchcard systems 30 years ago. What surprises me are companies who don't take relatively easy productivity and security upgrades. People who save and old format for compatibility reasons makes sense; people who can't use newer formats because they're stuck in 2002 make me sad.

Edit: VVV Two good counter-points below.

Ynglaur fucked around with this message at 17:45 on Aug 20, 2014

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
What do knowledgable goons consider to be good AV software for individuals? I know my company prefers McAfee because it's easier to manage centrally, but central administration is not a big concern for a small family.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

Nintendo Kid posted:

Yeah, W3Schools has always had weird usage rates compared to other sources. If I remember right, they had IE going below 50% several years ahead of when the majority of other stat sources did, which kinda indicates to me they might have an unrepresentative sample.

Or that their sample doesn't include stolen copies of Windows, or something. I remember somebody pointed out a while back that the huge usage of Windows XP in China is driven by the fact that the vast majority of installations are unlicensed.

Edit: Good point below. I'll stop talking out of my rear end now.

Ynglaur fucked around with this message at 10:34 on Sep 10, 2014

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
Any thoughts on Norton's product suite compared to ESET? Is there any meaningful difference for the average home user?

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
Thanks for the responses everyone.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
In-laws just dropped off their laptop claiming it has a virus. What's the latest way to safely figure this out without spending any money? My current thinking is:
- Turn off wireless via hardware
- Safe boot (its Vista)
- Create a USB with another computer with Malwarebytes portable, and some other portable AV.

I think it has Norton on it from 3-4 years ago when I helped them buy it.

Thank you in advance for any advice.figure

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

uncurable mlady posted:

We take security very seriously around here. *fills USB ports with hot glue*

For a few years, the US Army was soldering them shut. Too many soldiers were mixing classified and unclassified USB sticks, or attaching personal USB devices onto classified computers. People and computer viruses sometimes feels like people and STDs: "Nah, it can't be me. I'm clean. He/she is the dirty whore!"

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
Hurray! People at my work whom I've never met are spamming "Here is your fax" and "Here your document is" emails with ZIP files. Surely everyone is just deleting them, right? Right?

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
Honestly, the last few Dells I've had have been quite good, both personal and professional. I'll always gravitate towards Clevo / Sager, though.

Lenovo is obviously in damage control mode, though. More companies need to learn from BP. Don't cover things up: just come out, tell the truth, and fix the problem. The long-term damage to stock price is generally less the sooner and more honest companies are when it comes to problems. See also: politicians. Americans in particular love comeback stories, but hate snakes.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

pr0zac posted:

Wait... are you comparing the Lenovo fiasco with the BP Deepwater Horizon oil spill?

In terms of their initial response to a bad thing, yes. In terms of the impact of the bad thing, no.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
Just curious: could Lenovo run afoul of various hacking laws for this? They basically provided "unauthorized access to a computer system," which seems to be a charge used by some districts attorney in the US.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
Since we're on a short side-bar discussing crypto, can someone point me to a good description of the differences between PGP and AES? My Google-fu is failing me, and the Wikipedia articles aren't helping.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

Space Gopher posted:

smart and helpful :words: about AES and PGP
Thank you!

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

One of the Ars posters had a great retort. "Oh, so this means that Oracle is assuming all liability for their software? That's great!"

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
Does someone have a good idea of what additional things Malwarebytes Anti-Exploit does over the main Malwarebytes Anti-Malware product? My work just rolled out both, so I'm wondering if there's a good reason to have both at home.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
I've used Lastpass for years and love it, even though they just got bought by LogMeIn. It's $24/year for premium--which for me just means I can use the Windows Phone app (yes, they even have an app for that platform)--or free if you don't need mobile or 2-factor authentication.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

Forever_Peace posted:

Well keepass is free to sync between devices while lastpass is not, which made up my mind right quick.

But lastpass is otherwise pretty cool I guess.

Then again KeePass relies on you having something like Dropbox available everywhere, which isn't always possible. I can install Dropbox or personal OneDrive on my work laptop, but I can install the LastPass plugin.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

Tapedump posted:

Wait, um, website or cell phone?

I'm not sure where/how else you would need it.

You can have iOS with PassDrop (and the Dropbox app to make syncing manually not suck, and be 3 miles down in a coal mine with your passwords in your pocket.

I thought we were talking about KeePass? My point re: Dropbox is that if you want, say, a password manager on your work laptop, it needs to be something you can install. If you can't install Dropbox, or something similar, your passwords won't be in sync. KeePass is great, but it relies on you running your own infrastructure.

Also, read the full blogs from LastPass before jumping to panicked conclusions.
1. In the first link, if there was a database breach, that's why they use a minimum of 5000 iterations of PBKDF2-SHA256 and salt it.
2. In the second link, the defect permitted the individuals encrypted database to be breached (albeit only if you used a feature that allowed sharing of login credentials, which doesn't seem like a great idea in most use cases). Again, PBKDF2-SHA256, etc.
3. They identified network traffic from a machine that they couldn't immediately explain. The amount of data was only enough for a few users' databases.

I'm not trying to white knight (too much), but you can think through the following scenarios:
1. A nation-state is after me. My login information is as good as compromised.
2. Attacks that try to cast a wide net are more likely to target Lastpass, because there's a lot of valuable data there. How much do I trust PBKDF2-SHA256, etc.?
3. Attacks try to target me specifically. I'd personally trust Lastpass' infrastructure over my own. (The biggest threat remains a keylogger, of course.)

Just my 2 cents, of course.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

Tapedump posted:

Yeah, um, PassDrop is an iOS client for Keepass databases...

It can sync your KP DB using Dropbox or just keep an cached version for coal mine use.

Thanks. Windows Phone user, so I have used iOS in a few years.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
OSI Bean Dip - To be fair, you're basically asking him/her to prove a negative* and are asking him/her to provide counter-evidence to your claim. You might be right, but it's a lousy way to go about arguing for yourself.

* How do you know there isn't a thing you can't see?

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

Nintendo Kid posted:

As it turns out, all you can really do with the speakers built into computers for transferring data is to very very slowly (on the order of a few dozen bytes per minute) transfer data, assuming you even had a BIOS/EFI embedded malware listening and sending through the speaker. Some university research crew performed experiments using consumer hardware and got at most 300 baud transfer in ideal scenarios, since speakers aren't all that hot at being microphones - and in situations where they simulated conditions being worse like say a laptop across the room from a desktop it dropped down to about 30-40 successfully transferred bytes per minutes. So in ideal conditions, like 99 megabytes could be transferred over a month, in normal conditions, you could transfer like 1.75 megabytes.

So the thing he was claiming about it spreading by sound is right out, because at best it could put out tiny updates to what's already there, and there's no practical way for it to infect anew. If he even had any malware actually going on, it'd have been because some expert had broken in and brought the stuff onto the systems by way of physical access.

Basically this, though it could be bad. #badbios was never proven to even exist. The lone researcher whom it infected never managed to infect anybody's machines but his own. Is it possible somebody was targeting only him because of ~reasons~? Sure. Is it likely? Not really.

Pushing even a few bytes over an otherwise air-gapped device can be a big deal, however. Such a BIOS-inhabiting device could, for example, parse keyboard inputs looking for likely userid and password combinations, and send those over the air. Still, applications for using speakers to transmit data probably have more applications in corporate espionage or nation-states spying on one another than on "I'm going to get Jim's bank account."

For the truly paranoid, of course, as alluded above there really isn't anything a normal person a can do about the Evil Maid vector of attack. Once someone has physical access to the hardware, all bets are off.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

Mr Chips posted:

ahh, but was it ever proven not to exist?
:smuggo:

drat. I just lost an argument on the Internet.

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?

Prosthetic_Mind posted:

And you're the doctor who treats the symptoms instead of the disease.

So, we're all in agreement. The solution is to find and kill people who make malware. While we're at it, let's eliminate greed, fear, and perhaps poo poo-stirring. Meeting adjourned?

Adbot
ADBOT LOVES YOU

Ynglaur
Oct 9, 2013

The Malta Conference, anyone?
Oh cool! She had stopped blogging for awhile, so I thought she had fallen off the face of the earth or angered Put in or something.

  • Locked thread