http://dottech.org/10032/paying-a-price-to-use-free-software-the-dark-side-of-comodo-products/
or
http://tinyurl.com/hm2g77s
Paying a price to use free software: the dark side of Comodo products
By Ashraf - September 23, 2009 - 88 Comments
image:
http://dottech.org/images/email_16_x_16.png Email article |
Print article
image:
http://dt.azadicdn.com/wp-
content/themes/dt/images/printer_famfamfam.gif?2724
Comodo is a popular name in the software business. Comodo provides
multiple free, and excellent, products for home users including, but
not limited to, the award winning Comodo Firewall (now bundled with
Comodo Internet Security). Comodo has also recently become a big name
in multiple front-page controversies including the issuance of its SSL
security certificates to known malware distributors/scam websites and
a row with Softpedia over the inclusion of a third party toolbar in
their software. For those that don’t know I will do a quick recap for
you:
Comodo has been caught selling its popular SSL certificate to malware
distributors/scan websites. Now in Comodo’s defense, whenever a
malware distributor/scan website which has Comodo’s certificate is
brought to their attention, they remove it; furthermore the purpose of
the SSL certificate, technically, is not to verify the contents of the
website but rather to verify how secure it is to buy from (the irony).
However the question of why Comodo is repeatedly selling the
certificates to known malware distributors/scam websites (there have
been cases where a website with the same exact layout, interface, and
“product” except different name has been issued a certificate even
though their earlier one was revoked) is still a significant one and
still an on going issue. Softpedia, once upon a time, labeled Comodo
Internet Security as “malware” because CIS included SafeSurf, an
optional third party toolbar considered to be malware by Softpedia. Of
course Comodo did not like that, so they tried to get Softpedia to
remove the label. Softpedia, standing by their high standards,
refused. So in the end the result was (is) Comodo Internet Security
was (is) removed from Softpedia’s download database.
Whatever side you are on for the above two issues, this post is not to
discuss them; that is for another time. I am creating this post to
address another (potentially more important) issue with Comodo
products.
Today as I was checking my e-mail, I got an e-mail from a dotTechie
informing me of the fact Comodo Backup, a free backup solution
provided by Comodo, was recently updated to v2 with major changes and
I should check it out (yes – I do read the e-mails I am sent even if I
forget to reply… surprise, surprise). So, naturally, I was intrigued
and went to download Comodo Backup. While installing Comodo Backup I
glanced over its EULA (End User License Agreement) and was shocked by
what I saw:
image:
http://dt.azadicdn.com/wp-content/uploads/2009/09/2009-09-
23_1520592-300x232.jpg?2724 2009-09-23_1520592
I am not legal mind, but to me this says if you install Comodo Backup,
Comodo will collect data from your computer such as how you use Comodo
Backup. Not only will Comodo collect data, but the data can
potentially be personally identifiable: Comodo won’t disclose the data
to a third party in a manner which will personally identify you but
that means if they are taking a deliberate and conscious action to
make sure the data is not personally identifiable when being passed on
to a third party, the data is personally identifiable when Comodo
themselves have it. Am I understanding it properly or am I being
paranoid?
Now it is not just Comodo wanting to collect data from you while you
use their software. Many software developers ask you if you want to
send anonymous usage statistics to the developer while using their
program; however you can always opt out if you do not want to. I
looked up, down, left, right, in, and out – no where in Comodo Backup
did I see an option to opt out of sending data to Comodo. At best I
found an option under settings named “Enable log” which a user can
check or uncheck; however there is no clear indication if this “log”
refers to the data collection done by Comodo or a different program
function. Shame on you Comodo; not only are you collecting
questionable data but the user has no clear way to opt out if they
find this action less than desirable (bar blocking the program with
Firewall of course and/or not installing the program in the first
place).
After I got done with Comodo Backup, I was curious to see if other
Comodo software do the same thing as Comodo Backup. I found indeed
there are other perpetrators which do the exact same thing…
Comodo System Cleaner
image:
http://dt.azadicdn.com/wp-content/uploads/2009/09/2009-09-
23_1539012-300x232.jpg?2724 2009-09-23_1539012
Comodo SecureEmail
image:
http://dt.azadicdn.com/wp-content/uploads/2009/09/2009-09-
23_1550132-300x259.jpg?2724 2009-09-23_1550132
…and other Comodo software which do something similar except
explicitly state the information collected will be non-personally
identifiable:
Comodo EasyVPN
image:
http://dt.azadicdn.com/wp-content/uploads/2009/09/2009-09-
23_1547512-300x233.jpg?2724 2009-09-23_1547512
Comodo Internet Security
image:
http://dt.azadicdn.com/wp-content/uploads/2009/09/2009-09-
23_2201103-300x258.jpg?2724 2009-09-23_2201103
CIS is the bundle which contains Comodo Firewall, AntiVirus, and
AntiMalware solutions.
Since EULAs are long, and Comodo did not exactly help by not properly
formatting some of the EULAs for some of their software, I may have
missed a software or two which act in the same way as Comodo Backup;
so if you find another Comodo product which collects data (personally
identifiable or not) without an ethical and clear declaration and a
user opt-out, please post below and I will be sure to update this
post.
Furthermore, I visited the privacy policy link you see provided in
CIS’s EULA. The description on how user personal data is used is vague
at best:
image:
http://dt.azadicdn.com/wp-content/uploads/2009/09/2009-09-
23_220032-300x166.jpg?2724 2009-09-23_220032
So who exactly are Comodo’s affiliates and what are their privacy
policies? Farther down the page Comodo does state more explicitly its
partners and affiliates have “similar” privacy policies…
image:
http://dt.azadicdn.com/wp-content/uploads/2009/09/2009-09-
23_221419-300x42.jpg?2724 2009-09-23_221419
…but I am not really impressed in the first place by Comodo so I don’t
know what to think.
To make matters even more confusing, it turns out there is another
privacy policy currently linked to Comodo’s website (this one was last
updated in July as opposed to April for the other one). This one is a
little bit more definitive about exactly what Comodo does:
image:
http://dt.azadicdn.com/wp-content/uploads/2009/09/2009-09-
23_2205001-300x213.jpg?2724 2009-09-23_220500
image:
http://dt.azadicdn.com/wp-content/uploads/2009/09/2009-09-
23_221724-300x139.jpg?2724 2009-09-23_221724
Of course Comodo states the affiliates and/or partners have “similar
privacy standards” but I am not particularly impressed by Comodo’s
“standards” when it collects data related to its programs without
obvious user consent and/or clear opt-out option.
So what do you guys think. Am I being a daft, paranoid idiot or is
Comodo pulling a fast one over all of us? Please, dotTechies, lawyers,
Comodo reps, and everyone else: post your thoughts below. As it
stands, I don’t know about everyone else, but Comodo has lost at least
one potential customer: me.
***Update***
Let me make this clear: If potential data collection is not a concern
for you, by all means use Comodo products (I have stated time and time
again, at face value, Comodo programs are great). However me, and many
others, deplore this practice of data collection without clear
notification and/or opt-out option and will probably never use Comodo
products again.
Read more at
http://dottech.org/10032/paying-a-price-to-use-free-
software-the-dark-side-of-comodo-products/#e2VwEBfcz5xdkvIv.99