Re:Private key for *.xboxlive.com certificate disclosed
by 0x0 on Tuesday December 08, 2015 @06:13PM
(#10700522)
How come "Xbox" is not in the list of affected devices?
[ Parent
| on HN ]
Re:Private key for *.xboxlive.com certificate disclosed
by johncolanduoni on Tuesday December 08, 2015 @06:23PM
(#10700582)
I suspect that the Xbox's communication with servers is validated using an entirely different certificate; it almost certainly doesn't use DNS to lookup Microsoft servers to connect to (I remember the Xbox 360 didn't). At the very least updates are (and I would be shocked if that key wasn't in an HSM inside a safe).
Re:Private key for *.xboxlive.com certificate disclosed
by speps on Wednesday December 09, 2015 @02:56AM
(#10702483)
It uses Windows 10 since November 2015.
Re:Private key for *.xboxlive.com certificate disclosed
by scott_karana on Wednesday December 09, 2015 @12:49PM
(#10705285)
Yes, and Windows 10 was affected, just like all the other listed OSes.
However, xbox users might not be able to make the connection. Explicit is better than implicit for security announcements, I daresay.
> An automatic updater of certificate trust lists is included in supported editions of ... Windows 10 ...