Re:Avoid Non-Microsoft Antivirus Software
by kbart on Thursday January 26, 2017 @05:01AM
(#13490085)
You can manage pre-installed root certificates manually in Windows. As far as I've seen, there was nothing sinister in default Windows root CA list.
[ Parent
| on HN ]
Re:Avoid Non-Microsoft Antivirus Software
by Elhana on Thursday January 26, 2017 @05:27AM
(#13490202)
Microsoft just silently adds back root certs when you delete them (if it is trusted by microsoft). Or at least it did in winxp by default.
Re:Avoid Non-Microsoft Antivirus Software
by yAnonymous on Thursday January 26, 2017 @05:28AM
(#13490206)
That's hardly relevant for the average computer user. By default, root certs are updated automatically.
>As far as I've seen, there was nothing sinister in default Windows root CA list.
Are you in any way related to MS or is your memory just very short?
>Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates
https://arstechnica.com/security/2014/07/emergency-windows-u...
Re:Avoid Non-Microsoft Antivirus Software
by kbart on Thursday January 26, 2017 @05:39AM
(#13490261)
"Thursday's unscheduled update effectively blocks highly sensitive secure sockets layer (SSL) certificates covering 45 domains that hackers managed to generate after compromising systems operated by the National Informatics Centre (NIC) of India. That's an intermediate certificate authority (CA) whose certificates were automatically trusted by all supported versions of Windows"
I'd argue that's a problem in CA trust model, not MS. If you trust a certain CA, of course you trust their issued certificates by design. Currently, if some high tier CA f*cks up, there's no other way to invalidate their issued certificates than propagating CRLs and removing its certificate from the root CA stores manually (or by updates, as in MS case).