3 ms·

[1] suggests that this can be used for code signing, but not to MITM network requests, which makes it bad in a different way to superfish. [1] https://np.reddi

by philh 11y ago

[1] suggests that this can be used for code signing, but not to MITM network requests, which makes it bad in a different way to superfish. [1] https://np.reddit.com/r/technology/comments/3twmfv/dell_ships_laptops_with_rogue_root_ca_exactly/cxa00fo https://np.reddit.com/r/technology/comments/3twmfv/dell_ship...

diafygi 11y ago
Right, but the private key is also included(!), so anyone can now sign code that will be trusted by these computers. Edit: Confirmed can issue ssl certs. https://mobile.twitter.com/_xpn_/status/668745489823768576 https://mobile.twitter.com/_xpn_/status/668745489823768576
- cpach 11y ago
  Why in the world did Dell ship the private key?
  - Swannie 11y ago
    So that a program could use this Cert + Key to create arbitrary signed certs for google.com, facebook.com, etc. etc. This is what the Superfish software did.
Someone1234 11y ago
That person was mistaken. Keep reading the thread. Several people have already created website certificates that validate in browsers using the private key provided.
nly 11y ago
So should it not have been tagged solely for code-signing? x509 has a field for intended usage.
- Laforet 11y ago
  This particular certificate has no constraints, so if my understanding of x.509 is correct then it can be used for everything. Of course if they had known better they probably would not have shipped it with the private key protected by such a obvious and weak password.