4 ms·
With how eager developers seem to be pushing certification keys into public github repositories or open S3 buckets, it's almost easier for criminals to get a va
by creshal 4y ago
With how eager developers seem to be pushing certification keys into public github repositories or open S3 buckets, it's almost easier for criminals to get a valid signing key than it is for honest developers, especially non-profit entities.
On top of that, the certification process isn't great either. Even honest certificate authorities have occasionally cut a corner too many and allowed malicious certificates to be printed; and there's some rather sketchy authorities that don't take the requirements too seriously. (StartCom e.g. offered to ignore the requirements for bribes years before they finally got removed from trust databases.)
So I don't think that certificates offer any security benefit. Might as well drop them.
- mike_hearn 4y agoWindows signing keys are often protected by hardware security modules (often on USB devices), so you can't push them to GitHub repositories. Malware authors spend a lot of time trying to steal signing keys exactly to try and avoid AV detection, so it's not worthless. It's certainly not easier for criminals to get one than honest developers.