3 ms·

And break the code signature in the process, thus causing Windows to display a large nasty warning about the exe being unverified.

Ajedi32 8y ago
What, you mean this warning? https://files.brightside.me/files/news/part_46/468060/20593810-UAC_PROMPT-1516629223-1517845099-650-cf6d3a4568-1520921909.jpg https://files.brightside.me/files/news/part_46/468060/205938... I don't know any normal user who would think twice about clicking "Yes" on a prompt like that when they're trying to install a program they just downloaded. There are plenty of legitimate programs that don't have a signature, and plenty of malicious programs that do.
- everfree 8y ago
  A big problem is that it's so difficult (and expensive) to get a code signing certificate that's valid under Windows that many developers just don't bother: https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate https://docs.microsoft.com/en-us/windows-hardware/drivers/da... Here's hoping that something like LetsEncrypt comes along for code signing or EV certificates, or that Microsoft makes the process easier somehow.
  - gruez 8y ago
    >A big problem is that it's so difficult (and expensive) to get a code signing certificate that's valid under Windows that many developers just don't bother: That's for EV certificates. Regular certificates are a lot more affordable: https://comodosslstore.com/ca/code-signing https://comodosslstore.com/ca/code-signing (~$100/yr). For comparison, apple developer program is also around $100/yr. Certum also provides discounted certificates for open source projects (around $30). >Here's hoping that something like LetsEncrypt comes along for code signing or EV certificates, or that Microsoft makes the process easier somehow. The only reason that letsencrypt can be free is that domains can be validated at 0 marginal cost. Code signing certificates are issued to persons or corporations, not domains. Because of that, the issuer has to do a bunch of manual checks that drives up the marginal cost of each certificate. Also, letsencrypt has many corporate sponsors who directly benefit from https adoption. Who benefits from microsoft code signing certificate adoption? Only microsoft.
    - justinclift 8y ago
      > Certum also provides discounted certificates for open source projects (around $30). The Certum ones turn out to be about 135 Euro, after the mandatory super expensive (and super slow) postage for the key fob to store the key on is included. They do have "Cloud hosted" ones available too, which don't need the electronic fob. But I don't know anyone who'd trust their electronic signing keys to "the cloud". ;)
      - gruez 8y ago
        >The Certum ones turn out to be about 135 Euro, after the mandatory super expensive (and super slow) postage for the key fob to store the key on is included. I heard that you could use any smartcard/hsm, not just their fob, so there might be same savings there. >They do have "Cloud hosted" ones available too, which don't need the electronic fob. But I don't know anyone who'd trust their electronic signing keys to "the cloud". ;) What's the issue here? Certum is the CA so they can already issue whatever certificates they want. They don't need to steal your cloud keys. The only real threat is if their service gets hacked, but at that point the hacker could also re-issue your certificate with his keys.
        justinclift 8y ago
        Just my general lack of trust in things stored "securely" in the Cloud, vs securing it locally offline ourselves. :) There are plenty of examples of stuff that should be secure, being leaked. Also, if Certum "gets hacked" that's not a generic blanket giving complete access to every one of their systems. It's entirely possible they could get "hacked" and the hackers would only obtain read only access to stuff, without penetrating whatever signing systems there are. Using a local fob circumvents several of those particular threats. The weirdly expensive and slow postage option makes me curious about other things though. But that's probably just my paranoia revealing itself. ;)

Ajedi32 8y ago

What, you mean this warning? https://files.brightside.me/files/news/part_46/468060/20593810-UAC_PROMPT-1516629223-1517845099-650-cf6d3a4568-1520921909.jpg https://files.brightside.me/files/news/part_46/468060/205938... I don't know any normal user who would think twice about clicking "Yes" on a prompt like that when they're trying to install a program they just downloaded. There are plenty of legitimate programs that don't have a signature, and plenty of malicious programs that do.

everfree 8y ago
A big problem is that it's so difficult (and expensive) to get a code signing certificate that's valid under Windows that many developers just don't bother: https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate https://docs.microsoft.com/en-us/windows-hardware/drivers/da... Here's hoping that something like LetsEncrypt comes along for code signing or EV certificates, or that Microsoft makes the process easier somehow.
- gruez 8y ago
  >A big problem is that it's so difficult (and expensive) to get a code signing certificate that's valid under Windows that many developers just don't bother: That's for EV certificates. Regular certificates are a lot more affordable: https://comodosslstore.com/ca/code-signing https://comodosslstore.com/ca/code-signing (~$100/yr). For comparison, apple developer program is also around $100/yr. Certum also provides discounted certificates for open source projects (around $30). >Here's hoping that something like LetsEncrypt comes along for code signing or EV certificates, or that Microsoft makes the process easier somehow. The only reason that letsencrypt can be free is that domains can be validated at 0 marginal cost. Code signing certificates are issued to persons or corporations, not domains. Because of that, the issuer has to do a bunch of manual checks that drives up the marginal cost of each certificate. Also, letsencrypt has many corporate sponsors who directly benefit from https adoption. Who benefits from microsoft code signing certificate adoption? Only microsoft.
  - justinclift 8y ago
    > Certum also provides discounted certificates for open source projects (around $30). The Certum ones turn out to be about 135 Euro, after the mandatory super expensive (and super slow) postage for the key fob to store the key on is included. They do have "Cloud hosted" ones available too, which don't need the electronic fob. But I don't know anyone who'd trust their electronic signing keys to "the cloud". ;)
    - gruez 8y ago
      >The Certum ones turn out to be about 135 Euro, after the mandatory super expensive (and super slow) postage for the key fob to store the key on is included. I heard that you could use any smartcard/hsm, not just their fob, so there might be same savings there. >They do have "Cloud hosted" ones available too, which don't need the electronic fob. But I don't know anyone who'd trust their electronic signing keys to "the cloud". ;) What's the issue here? Certum is the CA so they can already issue whatever certificates they want. They don't need to steal your cloud keys. The only real threat is if their service gets hacked, but at that point the hacker could also re-issue your certificate with his keys.
      - justinclift 8y ago
        Just my general lack of trust in things stored "securely" in the Cloud, vs securing it locally offline ourselves. :) There are plenty of examples of stuff that should be secure, being leaked. Also, if Certum "gets hacked" that's not a generic blanket giving complete access to every one of their systems. It's entirely possible they could get "hacked" and the hackers would only obtain read only access to stuff, without penetrating whatever signing systems there are. Using a local fob circumvents several of those particular threats. The weirdly expensive and slow postage option makes me curious about other things though. But that's probably just my paranoia revealing itself. ;)