3 ms·
> If you have local malware that changes the GMP DLLs thereafter, the malware might as well change Firefox itself. Well hopefully firefox itself is signed. Th
by duaneb 12y ago
> If you have local malware that changes the GMP DLLs thereafter, the malware might as well change Firefox itself.
Well hopefully firefox itself is signed. This is exactly what signing is designed to prevent.
- hsivonen 12y agoFor software that runs as non-admin, authenticode is very much about checking delivery-time integrity. If you have admin-level malware, it can replace signed software (that gets run without admin privs and doesn't have UAC at launch) with unsigned lookalikes.
- duaneb 12y ago> If you have admin-level malware ...you should reinstall your OS. Really, that shouldn't even be an "if" these days. Of course security doesn't matter if people can just execute random code on your machine. Anyway, code signing is not about delivery time integrity. It's easy to check whether a given binary is code signed at any given time—without it you wouldn't be able to revoke bad certificates. The only reason you shouldn't sign is if signing has some cost (like in the Mac OS X ecosystem) or you can't trust a single root certificate anyway (at which point you might as well move to OpenBSD anyway).
- briansmith 12y agoNot if the computer is configured to only run signed code, which is an option on Windows.