4 ms·

Just emphasizes what is common knowledge anyways: code signing is security circus in windows, it's just an entry tax really.

• R0b0t1 6y ago
  To anyone who doubts this: while there is strict enforcement for kernel code just having a signature on binaries or scripts silences errors.
  • GordonS 6y ago
    A valid signature. That means the signature must chain to a trusted root CA, and the signing must have taken place within the signing certificate's validity period. If the certificate has expired at the time the user executes the binary, a counter-signature from a trusted timestamping service must also be present, to prove the binary was indeed signed within the certificate's validity period. This seems fairly sane to me, and and allows doing things in software like trusting particular publishers.
    • R0b0t1 6y ago
      No, it doesn't need to chain to a trusted root. Any signature silences a whole class of errors. You can also do strict enforcement if you'd like but the last I looked at this it's not the default.
      • GordonS 6y ago
        Digital signatures absolutely do need to chain to a trusted root (also, I forgot to mention that the certificate also has to have the "digital signature" EKU). What errors do you believe are silenced when an executable has an invalid or untrusted signature?
        • R0b0t1 6y ago
          From memory adding a valid but unchained signature to a binary will change how SmartScreen initially evaluates your application. If there's no signature at all you get a yellow box or at least a message that is more alarming than if there is a valid signature even if unrecognized. Similar thing for the script signing policies -- during my testing the default seems to want a signature, but not a valid chained one. I was confused in the same way you are, but the documentation doesn't actually say you need a valid chained signature nor does it really describe the threat and security models. They just have signatures, because signatures make things more secure, right?
          • GordonS 6y ago
            Apologies, I was thinking of Windows installers, rather than executables - a warning is given for installers with an invalid or untrusted signature, but you were correct that no warning is given for executables.