3 ms·

Why are they deploying their own certificate into the root store???? This is shocking behaviour. What's the difference between this and malicious software.

• sneak 8y ago
  Intent.
• merb 8y ago
  the problem is not that they add a root ca to the store. the problem is that they use the same Root CA on every computer in the world AND adding it into the Store AND having the Root CA PRIVATE KEY on ANY computer.
  • avian 8y ago
    > the problem is not that they add a root ca to the store. Yes there is. There is no valid reason for a glorified headphone driver to mess with what website your browser trusts.
    • kilburn 8y ago
      There is a valid reason: to enable website-to-hardware communication (i.e, to provide a javascript-based api for websites to interface with that hardware). Ideally browsers should implement well standardized, secure APIs for all devices in the world, but we are far from there. Until browser vendors implement the API you need, the only option is to employ this trick. Of course, companies should NOT reuse the same certificate between installations though (just generate a certificate during the installation process and life is good again).
      • merb 8y ago
        > Ideally browsers should implement well standardized, secure APIs for all devices in the world, but we are far from there. Until browser vendors implement the API you need, the only option is to employ this trick well not only browsers, os's in general ;)
      • deleted 8y ago
        [deleted]
• kakwa_ 8y ago
  See how bad are software companies at creating reliable pieces software/services that don't crash and are without security flaws. Now imagine Companies where software development is not a priority and/or is not in the set of core competencies. As long as it functionally (kind of) works, it will be good enough.