4 ms·
Unless I'm misreading this, the "vulnerability" is 4 certs deployed on machines with deprecated hashing algorigthms. The steps the author takes from that to "t
by raesene9 9y ago
Unless I'm misreading this, the "vulnerability" is 4 certs deployed on machines with deprecated hashing algorigthms.
The steps the author takes from that to "this could allow your machine to be compromised" are.... well tenuous at best. The idea that just because a certificate is present, an attacker will easily be able to use that to sign malware and bypass anti-malware protections as a result doesn't appear supported by the evidence presented.
- francisck 9y agoI completely agree with you. This article is nothing but pandering for notability by publishing something that attempts to scare the reader. I'm all for pushing O.S and Browser vendors to remove many of the trusted certs in the root store...but this is just silly and frustrating. Articles like this make the security industry lose credibility.
- bdonlan 9y agoMoreover the hash algorithm doesn't matter for the root cert, because the system has a trusted copy of the certificate in its root cert store and doesn't need to check any signatures on the root itself.