3 ms·
That would have been comical, considering uninstalling doesn't remove the root cert, so a user would have been more secure with superfish installed than uninsta
by glandium 12y ago
That would have been comical, considering uninstalling doesn't remove the root cert, so a user would have been more secure with superfish installed than uninstalled.
- patcheudor 12y agoNope. Look at my reply to the parent. The Superfish solution is not properly passing the validation state of the public cert provided by the cert to the browser. As a result its fairly trivial to MitM HTTPS without need of the private when the Superfish software is installed. To be clear, it is absolutely worse to have Superfish installed than to have it removed.