I have Malwarebytes Anti-Exploit on my system. Is it safe to use it with Tor?
Alright this was going to be a comment but no one has really addressed this and it's a pet peeve of mine, so...
Generally speaking anti-virus protects you from known threats, they provide signature based, heuristic and now even sandboxed execution to try to uncover "malicious" behaviour in applications. These aren't difficult to bypass and infact there is a market in simple commercial products that can take a bit of known malware and transform it and pack it such that it will be "Fully Undetectable". (As an aside, if you want to actually improve resistance to exploitation on Windows, consider Microsofts own product "EMET" which is, in all honesty, probably better designed and engineered.)
So, the possible security issues aside, issue two is that files that it scans could potentially be fed back to the antivirus company. You are the product, their threat intelligence comes from watching their users get attacked then retroactively trying to fix it, from their EULA:
So they may be watching everything you are doing on Tor Browser and recording it and sharing it with Third Parties. But who are these third parties?
Governmental; Law Enforcement
We may disclose PII to government agencies, law enforcement officials, and private parties as we, in our sole discretion, believe necessary: (1) to satisfy or comply with any applicable law, regulation or legal process; (2) to respond to lawful requests, including subpoenas, warrants or court orders; (3) to protect our property, rights and safety and the rights, property and safety of third parties or the public in general; and (4) to prevent or stop activity we consider to be illegal or unethical.
So they'll sell you out to governmental agencies and law enforcement if they don't like the cut of your jib.
As a hypothetical, lets say I am some government or law enforcment agency. I want to catch you out so I embed some content into a webpage that matches a signature in a bunch of virus products, then your antivirus captures it when you visit it or I trick you into visiting it (spear-phishing). It then logs it, submits it to them and we collect who received our payload from the AV vendor. Dox'd.
Also note that, for example Trend Micro have a "Memorandum of Understanding" with the UKs National Crime Agency, about which Trend Micro say:
The NCA will not only be able to draw on the expertise of Trend Micro’s global, 1,200-strong TrendLabs team, but the power of the cloud-based Smart Protection Network, which analyses over 15TB of threat data, identifying and blocking more than 250 million threats each day.
This is likely equivalent to the "threat data" that Malwarebytes outlines in their EULA.
Is it safe to use anti-virus with Tor Browser? Only if the anti-virus vendor thinks what you're doing is "ethical" (apparently they've no sense of irony...).
1Answers like this should never be hidden as comments. Sep 17, 2016 at 1:26