News for hackers. Stuff that matters.

A comment on Windows Certificate Manager does not display the complete trust list.

Re:Windows Certificate Manager does not display the complete... by TazeTSchnitzel on Saturday August 29, 2015 @09:32AM (#10139913)
Windows isn't lying. Microsoft openly lists what certificates Windows includes on their site. The fact the root certificate store on your machine only lists certificates it actually contains is to be expected.

This is just a UI failure.

[ Parent | on HN ]
Re:Windows Certificate Manager does not display the complete... by dtech on Saturday August 29, 2015 @09:51AM (#10139969)
Yep, they release a periodical PDF with interim updates [1]. Only the most lazy "security researcher" would believe that Windows only trusts two dozen root certificates.

[1]: http://social.technet.microsoft.com/wiki/contents/articles/1...

[ Parent | on HN ]
Re:Windows Certificate Manager does not display the complete... by pandog on Saturday August 29, 2015 @10:11AM (#10140036)
But there's a difference between looking at the list of root certificates that Microsoft say Windows trusts and looking at the list of root certificates that Windows trusts.
[ Parent | on HN ]
Re:Windows Certificate Manager does not display the complete... by dtech on Saturday August 29, 2015 @10:33AM (#10140085)
Only if the two lists differ, that would actually be noteworthy. Currently it's just a blatantly clickbait title.
[ Parent | on HN ]
Re:Windows Certificate Manager does not display the complete... by pandog on Saturday August 29, 2015 @10:49AM (#10140146)
If it changes and you haven't taken the software update yet the lists will differ.
[ Parent | on HN ]
Re:Windows Certificate Manager does not display the complete... by nailer on Saturday August 29, 2015 @02:01PM (#10140817)
So roots are dynamically fetched and this is the list of previously fetched roots? Or is it a revocation check before first use? Do you have a link?
[ Parent | on HN ]
Re:Windows Certificate Manager does not display the complete... by TazeTSchnitzel on Saturday August 29, 2015 @03:04PM (#10141025)
> So roots are dynamically fetched and this is the list of previously fetched roots?

Precisely. Windows comes with a small number of roots pre-installed. I can't remember which they are, I assume it's probably just Microsoft's own, one of which is presumably used to check roots fetched later. When you browse the web with a browser that uses Windows's certificate store, it'll fetch other roots as needed.

Interestingly, this might be a security benefit. If you'd never visited a site using a revoked root, you never had the root in the first place.

[ Parent | on HN ]
Re:Windows Certificate Manager does not display the complete... by tellthetruth1 on Saturday August 29, 2015 @01:08PM (#10140651)
When an American company lies, it's only a UI failure.
[ Parent | on HN ]
Re:Windows Certificate Manager does not display the complete... by benbenolson on Monday August 31, 2015 @11:24AM (#10147215)
Why, specifically, American companies? I've encountered countless companies from other countries that lie.
[ Parent | on HN ]