On: AvastSvc.exe contains a full, unsandboxed JavaScri...

[Leace]

Very nice writeup!

It contains a link to Avast's Coordinated Vuln Disclosure site: https://www.avast.com/coordinated-vulnerability-disclosure and this has a link to Avast PGP key that's served via unencrypted HTTP: http://virfile.avast.com/viruslab/avast-bugs-pgp-key.txt Not only that, the key is a weak 1024 bit DSA key :(

[MarioMan → Leace]

I'm hoping this isn't a dumb question, but why does it matter that a public key is public-facing and unencrypted?

[jurgemaister → MarioMan]

If someone intercepted the communication, they could swap the Avast key for their own, allowing them to decrypt your message.

[Leace → MarioMan]

What jurgemaister said. If you don't have another trust mechanism (like Web of Trust) to validate if this is a correct key then HTTPS gives at least some assurance that no intermediaries between you and avast changed the key material.