Avast, the cybersecurity software company, is facing a $16.5 million fine after it was caught storing and selling customer information without their consent. The Federal Trade Commission (FTC) announced the fine on Thursday and said that it’s banning Avast from selling user data for advertising purposes.
Five years ago, I posted on Reddit about how Avast had installed a browser without my consent and set it as default while I was out of town and away from my computer. That post has had comments added to it several times a year ever since, meaning that they’re still trying that nonsense. They stole my data without my consent by importing all of my browser data, and now it’s come out that they blatantly sold it without my consent as well.
I said it then, and I say it now: If you install something without my knowledge or consent, you’re a virus, plain and simple.
This is fucking garbage.
When a company gets caught with their hand in the cookie jar, it’s not a punishment to put one of the cookies back.
Fines should be ten TIMES what the company made from their misbehaviour, not ten percent.
Cost of doing business
Jesus christ right!! I’m curious how much they made off that data.
That’s horrifying. I remember using the avast private browser when I was younger as to not get tracked by Google chrome, but i was just getting tracked by avast instead. :(
It’s capitalism. You get to choose who steals your personal data.
And people still think they can trust password managers lmao
Yeah, those. Thanks for the example.
So is your problem with using a password manager at all, or just the companies/sources of them?
Any company trying to get my data, really, and my passwords are the most sensitive of my data. Even if I coded one myself, and kept it completely local, my passwords are all in one place if that device gets compromised.
I can remember my passwords, so why take the gamble?
Well, you do you, but I’m happier with complex unique password locked behind a 2FA open source self hosted encrypted vault than I am remembering a few passwords shared amongst services. I have 400+ entries in it, and if I get hit by a bus, my wife has access to it with her yubikey.
Because by not using a password manager I guarantee you are duplicating passwords between services. This means the second a service you use is compromised, every single service you use with that same email/password combination is compromised. Even if every one of your passwords had a slight deviation malicious actors know people do this and will likely be able to write a program that attempts those deviations on other services. You’re effectively leaving your security up to weakest link in services you sign up for, and security is more often implemented poorly than implemented well.
By using a password manager you generate a 20+ character long password that is unique to each service you use. These passwords being random and unique to each service protects you from rainbow tables and other hash table based attacks. In the event Bitwarden or another password manager you use is breached anything they get will be worthless as long as your master password is not compromised (which should only ever exist in your head) due to the data being encrypted at rest.
It is a similar concept to using a secure, trusted middleman for processing payments instead of giving your credit card to every single site that asks for it.
Just curious, how do you know they’re secure? Like how do you know it’s only local and not being uploaded somewhere? I’m not about to tear through the code of open source password manager apps to make sure it’s “safe” when I can keep track of them myself, but yes, I do see your point about that not being as safe as them being completely randomly generated for each account
The great thing about open source is that anyone can read the code. Even if you don’t read every line yourself there are others who will. In popular projects it’s pretty much a guarantee any suspicious or malicious changes get caught almost immediately due to the visibility of everything.
As for local-only I trust Bitwarden and their encryption schemes enough that I use their cloud sync, but you can always self host it in a Docker container with no Internet access if you’re concerned about it.
