Password protected Uninstallation of Bitdefender products

Agree, also as one of the members here who had a password-protected BD, his child was able to uninstall BD to bypass the Parental Controls.

Gjoksi

@Scott

I had that topic in mind before writing this topic. I think it was posted a week or two weeks ago.

That is one of the many reasons that uninstallation process must be password protected.

https://community.bitdefender.com/en/discussion/90967/password-protected-uninstallation-of-bitdefender-products

I also agree with the same and this option is currently only available in Bitdefender mobile security for android (paid version) since one has to activate device administrator for the proper functioning of the application, and if someone tries to uninstall the application on android he will first have to deactivate the device administrator which will either require any of the protection method that a user has active on his android (fingerprint, pin or pattern lock)

Regards

Flex

(Bitdefender beta tester 2019/ 2020)

Alexandru_BD

Hello guys,

Thank you so much for sharing your ideas here. I will forward your suggestion to the development teams in the upcoming product feedback & feature request session.

Best wishes to you!

I'm bumping this because yesterday I found about this vulnerability (It's by definition one) while uninstalling a password protected instance of Total Security, this has to be implemented ASAP, it's unbelievable Bitdefender didn't think about this when making the uninstaller and STILL hasn't fixed it 10 months later after this post.

Alexandru_BD

The simplest solution that comes to mind is to change the user access control settings, so you will be prompted to enter the Windows admin password for uninstallation.

https://community.bitdefender.com/en/discussion/comment/320431#Comment_320431

Instead of changing that to require a password for every UAC action on Windows, it’s far more logical to implement this on Bitdefender instead.

If we ask for something on this section of the forum, it’s not to “find a way around it” and make changes on Windows to fix a security mistake that Bitdefender failed to address, it’s so you can implement this.

Seeing this post, I can see I’m not the only one who can uninstall without password, so this is not an isolated bug; It’s a widespread security error.

Do we have any new information regarding this? Or was there a post I missed somewhere that maybe Windows hinders that ability?

TIA

https://community.bitdefender.com/en/discussion/comment/320447#Comment_320447

While in above post I might have provided information related to android and might have stated my request to introduce the same for pc/mac, but after getting to know about development a little bit I think for windows/mac it may not get implemented.

What I think here is that the solution provided by @Alexandru_BD of enabling UAC is the best thing because if bitdefender will set password protection for mac/windows devices for its uninstallation, it can become a chaos for user who are not tech savvy and who forget the password easily.

So providing the option of asking a user whether they need to set password protection for uninstallation is not a bad idea but not a good idea as well and to me it seems useless when you have UAC available in windows itself. I think the development will also not agree of implementing this feature.

+1 with @Alexandru_BD for the resolution he provided for enabling the UAC.

Regards

https://community.bitdefender.com/en/discussion/comment/326758#Comment_326758

Lets see if @camarie can provide us information related to this.

Regards

https://community.bitdefender.com/en/discussion/comment/320447#Comment_320447

@SaurikSI, there are around 20-30 antimalware products in the market. Can you list the majority of antimalware solutions which have the password protection for uninstalling their respective antimalware product. I remember kaspersky has this option. Can you provide some more antimalware products which display the same warning at the time of their product uninstallation.

Also, as far as I know when you use the product uninstallers built by the respective companies for their product uninstallation, they do not display any warning. The password protected barely happens for the product if uninstalled via windows uninstaller.

Like suppose if I will delete kaspersky product via windows uninstaller, kaspersky will warn me if I need to uninstall the product but if I will directly use the uninstaller created by kaspersky for their product, it will bypass that warning and will directly uninstall the product.

Regards

https://community.bitdefender.com/en/discussion/comment/326758#Comment_326758

it can become a chaos for user who are not tech savvy and who forget the password easily

For the love of God, that’s clearly a non-issue, few people set password protection on their security solution, and those who do obviously do it for a reason, and not asking for that password undermines the ENTIRE concept of this security.

Please stop treating everyone as babies, it’s getting tiring, especially on an environment like this, literally NO ONE who doesn’t know what they’re doing uses password protection.

Setting UAC is obviously is not what anyone is looking for, the OP paid for Bitdefender so they want a feature, UAC would apply to other programs too.

https://community.bitdefender.com/en/discussion/comment/326760#Comment_326760

LOL, just replied before you mentioned me.

I honestly don’t remember, I think Kaspersky, ESET, and Avast (AVG too)

Kaspersky also implements password protection when completely exiting the AV (A feature a lot of people also requested, but my thread was rejected for paranoid and unreasonable reasons as well)

https://community.bitdefender.com/en/discussion/comment/326761#Comment_326761

Well let's narrow down the things and get to a conclusion. If @Alexandru_BD said that he will send the feedback to the developers and came down with the solution regarding the UAC, that may clearly state that developers are not interested in introducing the feature. While I am not exactly sure about this, that is why I tagged @camarie who is one of the developers for bitdefender windows product who can provide us with an insight on this. Kindly wait for his reply since he visits the community forum on occasional basis.

Regards

https://community.bitdefender.com/en/discussion/comment/326762#Comment_326762

ESET does not has this feature since I use it on my laptop and have installed and uninstalled it on my laptop. Avast & AVG might have this feature because their parent is Avast only and they have almost same setting and malware detection database. But still I cannot confirm about this.

Regards

https://community.bitdefender.com/en/discussion/comment/326761#Comment_326761

Agree, setting a separate UAC is not the solution, IMO.

And if for some reason it can't be done, then it can't be done.

Cheers

This post is from the perspective of BD on Windows devices.

I guess if a person forgot their settings password, which would also lock BD from being uninstalled, how would they uninstall BD when needed, via Safe Mode (if that can be done)?

Granted, we're not talking about a password that is password generated and would be hard to remember, so in that sense if someone couldn't remember that password, why even have the option included in the app? This is maybe where a separate UAC could come in handy, in protecting an uninstall if it were a shared PC/notebook.

So in my being single, and the constant Admin of my devices, is the password protection something a family account Admin is enabling, after setting up a family member's BD settings?

Edit: I didn't reopen this thread to stir the pot, but I saw a post where a member mentioned that his kid seemingly found a way to disable BD parental controls, and this thread came to mind. But I do like the "iron sharpening iron" debate by the members here :)

https://community.bitdefender.com/en/discussion/comment/326772#Comment_326772

why even have the option included in the app?

For the same reason we can set a password for the settings: All the security Bitdefender provides is totally useless if someone can just disable it. With the settings password you mitigate that, but you can still uninstall it without a password, which is a security vulnerability in an antivirus solution, that’s not good.

I hate this argument of “I wouldn’t use it myself, so don’t add it”, it’s the same I heard when I requested an option to complete close Bitdefender, it’s simple: If you don’t want to use it, just don’t! Just leave the option for those who will, the default mentality behind a software should be to help the user by giving freedom to choose, not restricting just in case.

This is by far the only aspect I dislike about Bitdefender, this trend of not giving advanced users their right to choose how to use their own PC and security solution that they own.

https://community.bitdefender.com/en/discussion/comment/326776#Comment_326776

Good reasonings in your posts, no absolute disagreements from me. I did vote up, for this ability 15 minutes after this thread was posted. I also did vote up for your Exit Bitdefender, thread :) So, maybe I ask more questions than have answers for? :)

https://community.bitdefender.com/en/discussion/comment/326777#Comment_326777

Fair enough 🤝🏻

camarie

I will discuss this with PM and the team. This is not a simple feature and it can easily put the user in the impossibility of uninstalling, at least via normal means.

The uninstall should be no different than the other application, though, because the vast majority of the users, and Microsoft themselves, expect a certain way to follow. Inside the application, yes, one can ask for password, make user perform additional validations, invoke UAC etc. since changing a setting or starting an operation which may prove sensitive could justify the additional stress.

But the uninstallation, at least as the user experience, is mostly handled by Windows. It is possible, true, to incorporate into the uninstaller an additional initial step that asks for an additional validation via UAC, and from a member of the Administrators group, but this will complicate the process anyway.

Perhaps a new setting, default OFF, maybe called "Perform program maintenance only by an administrator", which will do the same validation (ask for an admin password via UAC), and if validates, it will be set to ON. If one wants to set it to OFF, the same thing has to be done as well. Thoughts?

@camarie that's kinda what I was wondering on my end, as far as Windows allowing it. How many times over the years have I ever seen an app have the ability to be password protected from a Windows uninstall?

timbermark

Bitdefender's settings password option is compromised anyway. I've been chasing a related problem for over a year: Bitdefender, or something, will change the state of a setting even though the password option is active. The setting in question is Firewall, Alert Mode. It will deactivate itself without a prompt for the password. I tolerated this issue until I enabled the setting password option, and realized that it was compromised. That broke my trust in the product. Back to Norton.

https://community.bitdefender.com/en/discussion/comment/327189#Comment_327189

I still use Bitdefender, but I do have a problem with the attitude of this company, just look at this thread: The level of debate, mental gymnastics and downright excuses people are willing to do here to avoid fixing a CLEAR security vulnerability is appalling, and we’re talking about a SECURITY product, I never expected it would be so hard to understand why it’s ridiculous to have a settings password but not a password to uninstall the WHOLE SECURITY SOLUTION ITSELF!

It’s always “We’re not going to add this useful feature because think of the rookie users”, rookie users would NOT activate something like this in the first place! This is literally compromising the security of a lot of users just for the newbies.

timbermark

It is frustrating. I dealt with support a couple of times and gave up. The forum has been more helpful. To your point, the forum reveals ongoing themes and ignored issues. It does not take much to spoil a good thing. I continue to use BD on my laptop--smaller footprint and resource needs--but was forced to use Norton for my desktop because I need total integrity on that platform.