3 ms·
They added a password to the private key which they didn't have to, so it's not true that they didn't attempt to obfuscate it at all. In practice that only boug
by xnyhps 12y ago
They added a password to the private key which they didn't have to, so it's not true that they didn't attempt to obfuscate it at all. In practice that only bought them a couple of hours at most, but why add a password unless you're trying to stop people from using it?
- spacefight 12y agoThey didn't "buy hours" - they didn't really have a defense line there. They cashed in the day they signed the contract with Lenovo. Someone should sue to see these contracts open in the public.
- mikeash 12y agoIf you subscribe to the idea that you shouldn't assume malice when stupidity suffices, maybe the programmer in question just saw somewhere that it's good practice to use a password on private keys, and didn't understand why you do it or how it helps.
- jessaustin 12y agoYeah that's another point for the "don't blame us because we're stupid" argument. They're actually so stupid that they use a password, that's stored in the same place as the cert. If they used any of the standard anti-reversing techniques, that would have implied enough sophistication to be expected to know how TLS certs work, thus enough sophistication to know to just generate new certs on first use. One would have expected Commodea to make this automatic for their poor stupid customers, however.
- xnyhps 12y agoLooks like the software they were using indeed requires a password on the private key: http://www.komodia.com/wiki/index.php/Komodia%27s_Redirector_API_Guide#Flags http://www.komodia.com/wiki/index.php/Komodia%27s_Redirector... (Down near the bottom, "sslpsd - To the password of the root CA (it's mandatory).")