2 ms·
That’s trivially easy to get around by installing you’re own CA cert when you install the driver. This is arguably worse security wise but it makes the driver
by swiley 7y ago
That’s trivially easy to get around by installing you’re own CA cert when you install the driver.
This is arguably worse security wise but it makes the driver install process identical to the way it used to be as far as the average consumer can tell. This is why (IMO) free software is so important, to the point where I’ve begun to agree with the radicals and think it should be mandatory.
- stefan_ 7y agoNo, that's exactly not how it works. You can not change the set of root certificates.
- CamperBob2 7y agoHow does Zadig work, then?
- bri3d 7y agoThere are two separate authentication processes for drivers on Windows: Authenticode, which is used for the kernel-mode driver (.sys) and is strictly enforced, and driver package signing (.cat/.inf installation packages), which has a mutable root storage called Trusted Publisher system store. Zadig works by adding its own certificate root to the Trusted Publisher system store and self-signing the installation packages, but the three possible installed drivers (WinUSB, libusb0, and libusbK) were all still signed by Authenticode.
- swiley 7y ago> Zadig works by adding its own certificate root to the Trusted Publisher system store and self-signing the installation package Is this different than the local CA cert list? Sorry I don’t use Windows.
- bri3d 7y agoYes, it is its own list for software publisher signing specifically, and is separate from the Trusted Root Certification Authorities certificate store.