4 ms·
Am I reading it correctly that they also included the private keys? Why are the private keys for the cert installed with the cert? That doesn't make any sense.
by AndyMcConachie 11y ago
Am I reading it correctly that they also included the private keys? Why are the private keys for the cert installed with the cert? That doesn't make any sense.
Is this just incompetence, or is there some other reason that I'm failing to understand?
- bognition 11y agoIf the article is correct then this is a major mistake on dell's part.
- mfisher87 11y agoI would use a stronger word than "mistake," you have to have 0 understanding of what you're doing and 0 code reviews to do this.
- jloughry 11y agoIt reminds me of the various usability studies of PGP where new users, tasked to exchange keys with a correspondent, in a large percentage of cases emailed the private key to the recipient. It's awfully easy to do. Exactly how Dell managed to distribute both private and public keys to this certificate is a wonder.
- Swannie 11y agoIt might make sense if a unique private key was generated each time the application was downloaded. For example, a user wishing to use the Azure web services either supplies their own cert/public key to Azure, OR requests Azure to generate a unique cert/key, and supplies the private key to you. Now, obviously, someone using Azure APIs doesn't install this key into your root store. And that's the second "WTF?" - why install this as a Trusted Root cert, when your application could just hold it locally, and reference it? (The first WTF being distributing a common private key - rendering the point of encryption useless.)