4 ms·

Microsoft doesn't exactly have a great record with root certificates either. >Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates

Microsoft doesn't exactly have a great record with root certificates either. >Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates https://arstechnica.com/security/2014/07/emergency-windows-update-revokes-dozens-of-bogus-google-yahoo-ssl-certificates/ https://arstechnica.com/security/2014/07/emergency-windows-u... They revoked certs like this silently in the past which makes it even worse.

josteink 10y ago
Got an example? I haven't heard anything about this and I'm genuinely curious.
- yAnonymous 10y ago
  Added a link to the post.
- provirus 10y ago
  There has been critics on the quietly updating of root certs by Microsoft. https://news.ycombinator.com/item?id=9789819 https://news.ycombinator.com/item?id=9789819
bad_user 10y ago
Any references, because I don't know what you're talking about? I'm not a Windows user, haven't been a Windows user since 2001, my AV experience has been with the PCs of my family, whom I'm trying to keep safe. But even if I were a Windows user, if you can't trust Microsoft, you can't trust their OS, at which point it would be better to use something else because security really depends on how trustworthy that OS and its vendor are. I do trust Microsoft more than I trust an AV vendor though.
- yAnonymous 10y ago
  Added a link to the post.
kbart 10y ago
You can manage pre-installed root certificates manually in Windows. As far as I've seen, there was nothing sinister in default Windows root CA list.
- Elhana 10y ago
  Microsoft just silently adds back root certs when you delete them (if it is trusted by microsoft). Or at least it did in winxp by default.
- yAnonymous 10y ago
  That's hardly relevant for the average computer user. By default, root certs are updated automatically. >As far as I've seen, there was nothing sinister in default Windows root CA list. Are you in any way related to MS or is your memory just very short? >Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates https://arstechnica.com/security/2014/07/emergency-windows-update-revokes-dozens-of-bogus-google-yahoo-ssl-certificates/ https://arstechnica.com/security/2014/07/emergency-windows-u...
  - kbart 10y ago
    "Thursday's unscheduled update effectively blocks highly sensitive secure sockets layer (SSL) certificates covering 45 domains that hackers managed to generate after compromising systems operated by the National Informatics Centre (NIC) of India. That's an intermediate certificate authority (CA) whose certificates were automatically trusted by all supported versions of Windows" I'd argue that's a problem in CA trust model, not MS. If you trust a certain CA, of course you trust their issued certificates by design. Currently, if some high tier CA f*cks up, there's no other way to invalidate their issued certificates than propagating CRLs and removing its certificate from the root CA stores manually (or by updates, as in MS case).

josteink 10y ago

Got an example? I haven't heard anything about this and I'm genuinely curious.

yAnonymous 10y ago
Added a link to the post.
provirus 10y ago
There has been critics on the quietly updating of root certs by Microsoft. https://news.ycombinator.com/item?id=9789819 https://news.ycombinator.com/item?id=9789819

bad_user 10y ago

Any references, because I don't know what you're talking about? I'm not a Windows user, haven't been a Windows user since 2001, my AV experience has been with the PCs of my family, whom I'm trying to keep safe. But even if I were a Windows user, if you can't trust Microsoft, you can't trust their OS, at which point it would be better to use something else because security really depends on how trustworthy that OS and its vendor are. I do trust Microsoft more than I trust an AV vendor though.

yAnonymous 10y ago
Added a link to the post.

kbart 10y ago

You can manage pre-installed root certificates manually in Windows. As far as I've seen, there was nothing sinister in default Windows root CA list.

Elhana 10y ago
Microsoft just silently adds back root certs when you delete them (if it is trusted by microsoft). Or at least it did in winxp by default.
yAnonymous 10y ago
That's hardly relevant for the average computer user. By default, root certs are updated automatically. >As far as I've seen, there was nothing sinister in default Windows root CA list. Are you in any way related to MS or is your memory just very short? >Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates https://arstechnica.com/security/2014/07/emergency-windows-update-revokes-dozens-of-bogus-google-yahoo-ssl-certificates/ https://arstechnica.com/security/2014/07/emergency-windows-u...
- kbart 10y ago
  "Thursday's unscheduled update effectively blocks highly sensitive secure sockets layer (SSL) certificates covering 45 domains that hackers managed to generate after compromising systems operated by the National Informatics Centre (NIC) of India. That's an intermediate certificate authority (CA) whose certificates were automatically trusted by all supported versions of Windows" I'd argue that's a problem in CA trust model, not MS. If you trust a certain CA, of course you trust their issued certificates by design. Currently, if some high tier CA f*cks up, there's no other way to invalidate their issued certificates than propagating CRLs and removing its certificate from the root CA stores manually (or by updates, as in MS case).