Quote:
Antivirus software is something that can help people be safer and more private on the Internet. But its protections can cut both ways. A case in point: for almost four years, AV products from Kaspersky Lab injected a unique identifier into the HTML of every website a user visited, making it possible for sites to identify people even when using incognito mode or when they switched between Chrome, Firefox, or Edge.
The identifier, as reported Thursday by c't Magazine, was part of a blob of JavaScript Kaspersky products injected into every page a user visited. The JavaScript, presented below this paragraph, was designed to, among other things, present a green icon that corresponded to safe links returned in search results.
c't reporter Ronald Eikenberg found something unsettling about the JavaScript injected by the Kaspersky AV product installed on his test computer?the tag 9344FDA7-AFDF-4BA0-A915-4D7EEB9A6615 was unique to his machine, and it was injected into every single page he visited. It didn't matter if he used Chrome, Firefox, Edge, or Opera or whether he turned on incognito browsing. The identifier acted as a unique serial number that website operators could use to track him.
Kaspersky stopped sending the identifier in June, after Eikenberg privately reported the behavior to the AV company. The identifier was introduced in the fall (for those in the Northern Hemisphere, anyway) of 2015. That meant that for close to four years, all consumer versions of Kaspersky software for Windows?including the free version, Kaspersky Internet Security, and Kaspersky Total Security?silently branded users with a unique identifier.