3 ms·
The driver is signed with the certificate of the developer, an EV certificate at that. The “Microsoft signature” is just an attestation signature and does not i
by FounderBurr 5y ago
The driver is signed with the certificate of the developer, an EV certificate at that. The “Microsoft signature” is just an attestation signature and does not indicate the software is from Microsoft.
Every driver that runs on Windows 7+ is required to be signed this way via the Microsoft portal.
Why the article seems to go out of its way to not mention the name of the certificate used to sign the driver first is strange.
They also fail to mention that this cross signature gives Microsoft the power to revoke the validity of the driver or every driver signed with the developers certificate.
Again this may not have fit into the crafted narrative they are providing.
- judge2020 5y agoThe issue it seems is that MS dropped the requirement that drivers must also be signed by the developer’s own EV certificate - it seems developers can get binaries signed without that, which means only MS knows which company is the one that signed a specific program/driver in this configuration. https://twitter.com/gossithedog/status/1405976566694395906?s=21 https://twitter.com/gossithedog/status/1405976566694395906?s...
- FounderBurr 5y agoWow that’s a huge WTF on Microsoft’s part. Why drop the only component of signing that actually identifies the author?!