5 ms·

Can someone explain root certificates to me and why this is an issue? I know they sign certificates with a private key at a high level, but don't get the implic

Can someone explain root certificates to me and why this is an issue? I know they sign certificates with a private key at a high level, but don't get the implications of that generally.

arkadiyt 9y ago
Anyone who installed this audio driver could have all their https traffic intercepted by Savitech.
- elbigbad 9y ago
  Does this mean savitech needs to hypothetically set up some mitm attack somewhere and wait for you to send traffic, then they can decrypt and read, or does it mean that they can do that direct from your computer by virtue of that root certificate?
  - xythobuz 9y ago
    They would need to MITM you somewhere, but that could probably happen in their audio driver that's already installed and running on the target machine.
    - deleted 9y ago
      [deleted]
  - jchavannes 9y ago
    They would need to MITM you. But take into account that it doesn't need to be Savitech. If Savitech was compromised, an attacker could get access to their private key. In a sense, your security becomes dependent on the security of Savitech. I imagine their private key is not as securely stored as a real CA would store theirs. (e.g. with Superfish, Lenovo included the private key on all laptops, for anyone to grab[1]) [1] https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci...
raincom 9y ago
Think of trust relationships as a forest of trees. Initial seeds of these trees are root certificates installed by browser vendors(Chrome: Google, Safari: Apple, Firefox: Mozilla, etc). Whenever you open an https site, if your browser checks whether to trust that https site. So, your browser trusts it if that site's public key is signed by the one of roots shipped/installed by the browser vendor. You can also add your own cert to the root certs list of any of the browser, then any site's key's signed by your cert is gonna be trusted. Next time, check whenever your browser says "Don't trust this site", then explore the key chain.

Can someone explain root certificates to me and why this is an issue? I know they sign certificates with a private key at a high level, but don't get the implications of that generally.

arkadiyt 9y ago

Anyone who installed this audio driver could have all their https traffic intercepted by Savitech.

elbigbad 9y ago
Does this mean savitech needs to hypothetically set up some mitm attack somewhere and wait for you to send traffic, then they can decrypt and read, or does it mean that they can do that direct from your computer by virtue of that root certificate?
- xythobuz 9y ago
  They would need to MITM you somewhere, but that could probably happen in their audio driver that's already installed and running on the target machine.
  - deleted 9y ago
    [deleted]
- jchavannes 9y ago
  They would need to MITM you. But take into account that it doesn't need to be Savitech. If Savitech was compromised, an attacker could get access to their private key. In a sense, your security becomes dependent on the security of Savitech. I imagine their private key is not as securely stored as a real CA would store theirs. (e.g. with Superfish, Lenovo included the private key on all laptops, for anyone to grab[1]) [1] https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci...

raincom 9y ago

Think of trust relationships as a forest of trees. Initial seeds of these trees are root certificates installed by browser vendors(Chrome: Google, Safari: Apple, Firefox: Mozilla, etc). Whenever you open an https site, if your browser checks whether to trust that https site. So, your browser trusts it if that site's public key is signed by the one of roots shipped/installed by the browser vendor. You can also add your own cert to the root certs list of any of the browser, then any site's key's signed by your cert is gonna be trusted. Next time, check whenever your browser says "Don't trust this site", then explore the key chain.