4 ms·
Trying to understand this: Is it that Kasperkey thinks its certs are more secure? Which I suppose would be the whole point behind this WPF driver?
by itissid 10y ago
Trying to understand this:
Is it that Kasperkey thinks its certs are more secure? Which I suppose would be the whole point behind this WPF driver?
- idlewords 10y agoIt wants to look at the contents of every connection in order to hunt for malware.
- gertef 10y agosort of like following ones own footprints.
- scott_s 10y agoNo, my understanding was in order to inspect network traffic for malware, it's essentially doing a man-in-the-middle using its own certificates.
- okdana 10y agoI'm not familiar with WFP (or Windows in general really), so i can't comment on the use of that particular technology, but the fundamental idea here is to man-in-the-middle the user's TLS connections so that the product can inspect or manipulate the data within. Presumably in this case it's for anti-virus purposes, but the same technology is used by schools and businesses to filter pornography, piracy, gaming, phishing, and other 'undesirable' Web sites, to shape bandwidth, and to log Web activity. The firewall/software generates a root certificate so that it can sign and serve 'fake' leaf (site) certificates on the fly. Because the root certificate is self-signed, however, most browsers/whatever won't automatically trust it, which is why the user/admin has to add the root certificate to each affected machine's browser or OS certificate trust store.