To add a reference, here's a reproduction of my comment on a discussion of Lenovo from 4 years ago [1]: I want to emphasize how bad the TLS MITM malware was (a

To add a reference, here's a reproduction of my comment on a discussion of Lenovo from 4 years ago [1]: I want to emphasize how bad the TLS MITM malware was (adware is too nice a term): they installed a TLS MITM attack by adding the same CA public key to the trust store of every non-business device they sold, and then proxied all internet traffic through an on-device MITM proxy that contained the private key to that CA. Yes you read that right: every device with this malware had the public and private key used to decrypt the TLS traffic of every other device with this malware, effectively exposing every user to have all of their traffic both decrypted and MITM'd again by anyone who tries. This train wreck was malicious and incompetent. I don't consider this a technical failure, this is a fatal business failure: either nobody in Lenovo reviewed this software integration from a privacy and security perspective, or they did review it and the business deal overruled the security team's ability to veto it, or they're so inept that they didn't notice how bad it was. In any case, this indicates an organizational dysfunction so severe there's no way I can trust Lenovo with my personal or business security again. [1]: https://news.ycombinator.com/item?id=22194428 https://news.ycombinator.com/item?id=22194428 | Lenovo now shipping Ubuntu on high end workstations in the US