5 ms·

Anyway to see if that certificate is on a Lenovo computer? Anyway to remove it? I bought a Lenovo laptop recently, and I was appalled at the amount of crapware

by eloff 12y ago

Anyway to see if that certificate is on a Lenovo computer? Anyway to remove it? I bought a Lenovo laptop recently, and I was appalled at the amount of crapware that was installed. It's a wonderful laptop at a great price, just too bad about the software.

voltagex_ 12y ago
Check Certificate Management in mmc.exe (Add Snap-In).
- yuhong 12y ago
  Or just run certmgr.msc.
kentonv 12y ago
It should show up in the system certificates list as "Superfish, Inc.". I haven't seen it myself but search for #superfish on Twitter to see a lot of screenshots and such.
ekianjo 12y ago
> It's a wonderful laptop at a great price, just too bad about the software. Lenovo's hardware support for Linux is great so unless there's something keeping you on Windows switching to a good Linux distro usually works fine on these laptops.
- Argorak 12y ago
  Do you trust a hardware vendor that installs MITM stuff on your machine per default to keep the firmware untampered? There is almost no machine out there running openly auditable code on all components.
  - ekianjo 12y ago
    So what? At least with the software part you remove a large portion of the risks. It's better to go half way than doing nothing about it, and hardware tampering for a company could be more risky since they would have to do mass recall if discovered.
    - Argorak 12y ago
      I'm talking Firmware-tampering, which is rather risk-free and firmware patches are not unusual.
  - dingaling 12y ago
    > Do you trust a hardware vendor that installs MITM stuff on your machine per default to keep the firmware untampered? Adding dodgy userspace software is easy and remunerative for Lenovo ( lots of $$$ from the software vendor for 'bundling' ). Tampering with firmware is hard, expensive and doesn't seem to offer compelling return on investment. What's the business case?
    - bronson 12y ago
      Well over $10 million? http://www.cnet.com/news/security-firm-rsa-took-millions-from-nsa-report/ http://www.cnet.com/news/security-firm-rsa-took-millions-fro...
- bencollier49 12y ago
  Screen rotation is borked on the Yoga, apparently.
rst 12y ago
A cloudflare developer (I think) has put a test site up here: https://filippo.io/Badfish/ https://filippo.io/Badfish/ The idea is something like <img src="haveproblem.gif" onError="this.src='noproblem.gif'/> where haveproblem.gif is signed with the superfish cert (so you'll get an error if your machine does not have it, triggering the onError JS).
- throw7 12y ago
  Here's the url: https://badfish.filippo.io/yes.png https://badfish.filippo.io/yes.png

by eloff 12y ago

voltagex_ 12y ago

Check Certificate Management in mmc.exe (Add Snap-In).

yuhong 12y ago
Or just run certmgr.msc.

kentonv 12y ago

It should show up in the system certificates list as "Superfish, Inc.". I haven't seen it myself but search for #superfish on Twitter to see a lot of screenshots and such.

ekianjo 12y ago

> It's a wonderful laptop at a great price, just too bad about the software. Lenovo's hardware support for Linux is great so unless there's something keeping you on Windows switching to a good Linux distro usually works fine on these laptops.

Argorak 12y ago
Do you trust a hardware vendor that installs MITM stuff on your machine per default to keep the firmware untampered? There is almost no machine out there running openly auditable code on all components.
- ekianjo 12y ago
  So what? At least with the software part you remove a large portion of the risks. It's better to go half way than doing nothing about it, and hardware tampering for a company could be more risky since they would have to do mass recall if discovered.
  - Argorak 12y ago
    I'm talking Firmware-tampering, which is rather risk-free and firmware patches are not unusual.
- dingaling 12y ago
  > Do you trust a hardware vendor that installs MITM stuff on your machine per default to keep the firmware untampered? Adding dodgy userspace software is easy and remunerative for Lenovo ( lots of $$$ from the software vendor for 'bundling' ). Tampering with firmware is hard, expensive and doesn't seem to offer compelling return on investment. What's the business case?
  - bronson 12y ago
    Well over $10 million? http://www.cnet.com/news/security-firm-rsa-took-millions-from-nsa-report/ http://www.cnet.com/news/security-firm-rsa-took-millions-fro...
bencollier49 12y ago
Screen rotation is borked on the Yoga, apparently.

rst 12y ago

A cloudflare developer (I think) has put a test site up here: https://filippo.io/Badfish/ https://filippo.io/Badfish/ The idea is something like <img src="haveproblem.gif" onError="this.src='noproblem.gif'/> where haveproblem.gif is signed with the superfish cert (so you'll get an error if your machine does not have it, triggering the onError JS).

throw7 12y ago
Here's the url: https://badfish.filippo.io/yes.png https://badfish.filippo.io/yes.png