3 ms·

Can't an attacker modify the executable to not do that?

• freeone3000 6y ago
  No, because the check isn't part of the executable, it's part of the operating system. An attacker would have to modify the executable to have a valid certificate, which would take several months and a few hundred dollars, which usually makes it not worth it.
  • tinus_hn 6y ago
    The alternative is signing it with another certificate which is about $100
    • freeone3000 6y ago
      From who? It can't be a non-EV cert, since those are trusted less and present the same dialog. A 1-year from Verisign is $500. Comodo is $229. Setigo is $329. All of them require verification that you own a business, which is another $50 to set up an LLC, and the issuance lead time for both of these providers are a few months. If you have a quick, trusted way of getting an EV code-signing cert trusted by SmartScreen, please, let me know.
      • tinus_hn 6y ago
        They do present a dialog but not the same one you get with no or an invalid signature.