10 ms·

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20

• Sephr 8y ago
  > Even if it's just $20. $20 doesn't get you an EV certificate anywhere. We're talking about non-trivial hundreds of dollars per year, which is completely unsustainable for an open source driver for example.
  • juliusmusseau 8y ago
    My point was I would trust someone who drops $20 more than I would trust someone who drops nothing. $61/yr (USD) will get you an OV cert - there are 10% discount codes that are easy to find for these guys, and their list price is $67/yr: https://codesigning.ksoftware.net/ https://codesigning.ksoftware.net/ But the Notepad++ guy will need a business registered with that name before he can obtain CN=Notepad++, no matter how much he's willing to pay.
    • ex3ndr 8y ago
      This certificate doesn't help to bypass UAC and "unsecure" prompt still be shown to the user.
      • gruez 8y ago
        That's incorrect. All code authenticode signing certificates (trusted by microsoft) turns the UAC prompt from yellow to blue. EV certificates is probably for auto-trust for smartscreen.
        • Leace 8y ago
          > EV certificates is probably for auto-trust for smartscreen. Yes, that's correct. EV just skips the reputation building phase. Source: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/ https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma... > Programs signed by an EV code signing certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher.
        • ex3ndr 8y ago
          Only after you noticed that UAC color is blue instead of yellow i started to see difference. No user will understand this though.
          • Marsymars 8y ago
            Up until reading this thread I wasn't even aware that there were different UAC colours.
• msla 8y ago
  > Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Why? If I expect to make four figures on spreading malware/adware, and I can assuage the nerves of people like you by spending two or three figures on a certificate, I'm going to buy the certificate and make it look all nice and pretty and take your money. > Your business name and physical address are injected into the certificate. Basically code-signing certificates make it easier for people to find you and sue you if they truly want to. I suspect that's the whole point. So I have to incorporate in Delaware, make up a fake address, and rent a burner phone for a while. I'm not seeing the downside. https://www.bizfilings.com/toolkit/research-topics/incorporating-your-business/how-to-incorporate-a-business-in-delaware https://www.bizfilings.com/toolkit/research-topics/incorpora... > Delaware does not require director names and addresses to be listed in the Certificate of Incorporation.
  • xvector 8y ago
    I would imagine barrier to entry plays a large role in the sense of comfort here. If you have to incorporate in Delaware and pay $500 and jump through hoops, you’re more likely to turn to a simpler and easier alternative.
    • juliusmusseau 8y ago
      Exactly! I trust "you must do some things to obtain this" more than I trust "you don't have to do anything".
  • smacktoward 8y ago
    They didn't say they trust the developer who spends the money absolutely, they said they trust the developer who spends the money more than they trust one who doesn't. Which is fair -- as you note, not every scammer will be scared off by the need to spend some money to pull the scam off; but some will, so the ratio of legitimate developers to illegitimate ones will be higher in markets where there's some cost to entry.
    • 8y ago
• kazinator 8y ago
  Your trust is misplaced; a developer who drops $$$ on a certificate could be a dyed-in-the-wool criminal. Just because code is signed and certified doesn't mean it doesn't do anything bad. Signing and certificates revolve around trust/mistrust in the delivery channel not in the purveyor. That problem can be solved with other tools, like PGP. You don't have to be blackmailed by a platform's certificate racket.
  • Leace 8y ago
    > That problem can be solved with other tools, like PGP. You don't have to be blackmailed by a platform's certificate racket. It kind of works that way in Linux world where artifacts are PGP signed and to get your key into distro store one has to have "reputation". With the caveat that different distros have different schemes. X.509 used by Windows has two nice properties that PGP doesn't - certificate attestation (MS can be sure your private key is on a hardware token) and timestamping (even if the cert expires if the signature has a timestamp it's still valid).
    • g45y45 8y ago
      Kinda. You can use mimikatz to override the checks that the private key is isolated, you can even override 'no export' flag. Timestamping relies on external trusted timestamp providers implementing RFC 3161. There are many out there, maybe you could get a false timestamp out of them. I agree could be stronger than PGP, however it suffers a design flaw in that it considers the geometry of the PE file. PGP signs the whole blob. CVE-2017-0215 is an example of bypass by copying a previously signed header. It is more fragile and has been bypassed historically.
      • Leace 8y ago
        > You can use mimikatz to override the checks that the private key is isolated, you can even override 'no export' flag. "No export" flag is not the same. What I'm talking about is keys stored in hardware modules (TPM, Yubikey) so that the private key is never disclosed, you can only ask the hardware to perform actions using that key. See for example Yubikey docs: https://developers.yubico.com/PIV/Introduction/PIV_attestation.html https://developers.yubico.com/PIV/Introduction/PIV_attestati... > There are many out there, maybe you could get a false timestamp out of them. Maybe? That's how CA model works, they are trusted third parties. Code signing CAs are required to operate timestamping services so it getting a cert from them is not a security issue, timestamping should also be fine. PGP on the other hand if used in a Web of Trust model makes every valid key a CA. Not to mention that PGP doesn't have extended key usage flags so signing software is the same as signing e-mail (you cannot specify that you want to have this key be used for code signing exclusively).
• NullPrefix 8y ago
  >Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. I don't trust poor people either. Bigger chance that they're scaming .... because they need the money.
  • OldSchoolJohnny 8y ago
    Wow.
  • Intermernet 8y ago
    The flip side of this reasoning is that successful scammers aren't poor, but they are very likely to to still be scammers.
• bradstewart 8y ago
  You can file a "doing business as" (DBA) certificate online for under $10, at least in Texas.
• ozim 8y ago
  You know our whole civilization is based on $$$ == trust. Just wait until you lend money to someone who is going to remind you every month he will pay you back because he is a good person, but you never see the money.
• alerighi 8y ago
  Well I don't care if the developer payed the certificate, and I don't see why someone that develops FOSS should pay money for something that doesn't bring to him any of that money back. At least for open source software certificates should be offered for free, in my opinion. Also the fact that you are required to have a corporation, why? If I develop again an open source software I need to register a corporation just to deploy that software on Windows the correct way? That is total bullshit for me, just let me sign my software like is done on other platforms for nothing or a very small fee and done.
  • mizaru 8y ago
    Certum offers cheap code signing certificates for open source developers. I don't know how "good" they are, though, just stumbled across them a while ago because MPC-BE is using one.
• kbutler 8y ago
  > I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. This is a misapplication of Bayes theorem. P(bad) is the probability any app is bad P(signed) is the probability any app is signed P(bad if signed) = P(signed if bad) * P(bad) / P(signed) Essentially your trust model requires that "the fraction of bad apps that are signed is small", or P(signed if bad) approaches 0. But signed malware is available - famously stuxnet, but others before and since: http://users.umiacs.umd.edu/~tdumitra/papers/CCS-2017.pdf http://users.umiacs.umd.edu/~tdumitra/papers/CCS-2017.pdf Malware authors have incentive to make their apps appear legitimate, either by stealing keys, impersonating companies, or other mechanisms. Signing also helps get past automated checks (per the paper above). Further, those probabilities assume random distribution, but I'd suggest that really expensive/dangerous malware has greater incentives to appear safe, so it is even more likely to be signed, even if most malware is not. Stuxnet would be a case in point - high value, sophisticated malware, signed. P(really bad if signed) = P(signed if really bad) * P(really bad) / P(signed) P(really bad) is lower, but P(signed if really bad) approaches 1, so P(really bad if signed) approaches P(really bad) Meaning the worse the malware, the less the signature tells you.
  • marcosdumay 8y ago
    All the GP is saying is that he believes that P(signed if bad) < P(signed). It's a fair belief because paying for something leaves a paper trail. MS certificates are a farce at $500/year, but Google's $20 once is a very reasonable thing. Your point that really bad malware has higher odds of being signed is a good one, but really bad malware is much less likely than simply "malware".
    • kbutler 8y ago
      I believe he's saying P(bad if signed) < P(bad if not signed) - "I trust signed apps more than unsigned apps". I'm saying, maybe, but I'm not sure, and Cost * P(bad if signed) may be much worse than Cost * P(bad if not signed). When the Transmission bittorrent client site was hacked to distribute ransomware, it was signed using an unrelated certificate that was likely stolen. This happened twice within a year, with different valid (stolen) certificates: https://blog.malwarebytes.com/threat-analysis/2016/09/transmission-hijacked-again-to-spread-malware/ https://blog.malwarebytes.com/threat-analysis/2016/09/transm... Stuxnet certificates were also stolen. This disproves the GGP's premise that a signed app implies the developer paid for it, as well as your assumption that the paper trail for legally acquiring a certificate is an impediment to signing malware. You're not only trusting the developer who purchased the certificate and the CA that granted the certificate, but also trusting the ongoing security of everybody else who has purchased a trusted certificate. That's a pretty open circle of trust. Certificate revocation can limit the time of exposure once malware is distributed, but it isn't always implemented. https://arstechnica.com/information-technology/2017/11/evasive-code-signed-malware-flourished-before-stuxnet-and-still-does/ https://arstechnica.com/information-technology/2017/11/evasi... "they found 189 malware samples bearing valid digital signatures that were created using compromised certificates issued by recognized certificate authorities and used to sign legitimate software. In total, 109 of those abused certificates remain valid."
• JohnFen 8y ago
  > I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Why? > you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public directory (e.g., bbb.org), and someone representing your business needs to pick up that phone when the cert validator calls it. So you only trust code that comes from businesses?
• xkcd-sucks 8y ago
  When we were getting EV certs from Digicert, somebody called up the office to confirm the name of the CEO. He answered the phone and the person told him he couldn't validate his own identity. So he passed the phone to the person sitting next to him, she said "Oh yeah this totally him sitting next to me" and we got our EV cert within the hour.
• iforgotpassword 8y ago
  To me it's rather the opposite. Especially for open source software. Spend your time, money and energy on improving the actual product instead of wasting it on smoke and mirrors.
• flukus 8y ago
  > Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Ever notice how most con-men wear nice suits? Your advocating for the digital equivalent.
  • vnnkov 8y ago
    Ever noticed how con-men in nice suit is much more convincing than the one in tracking suit?
• martin_a 8y ago
  > but he won't be able to obtain that until he has some kind of business or organization registered in his jurisdiction with that name. Even in good old bureaucratic Germany this will take you less than an hour and cost you about 30€. Can't believe it can be much worse anywhere else.