News for hackers. Stuff that matters.

A comment on Avoid Non-Microsoft Antivirus Software. Parent comment

Re:Avoid Non-Microsoft Antivirus Software by yAnonymous on Thursday January 26, 2017 @05:28AM (#13490206)
That's hardly relevant for the average computer user. By default, root certs are updated automatically.

>As far as I've seen, there was nothing sinister in default Windows root CA list.

Are you in any way related to MS or is your memory just very short?

>Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates

https://arstechnica.com/security/2014/07/emergency-windows-u...

[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by kbart on Thursday January 26, 2017 @05:39AM (#13490261)
"Thursday's unscheduled update effectively blocks highly sensitive secure sockets layer (SSL) certificates covering 45 domains that hackers managed to generate after compromising systems operated by the National Informatics Centre (NIC) of India. That's an intermediate certificate authority (CA) whose certificates were automatically trusted by all supported versions of Windows"

I'd argue that's a problem in CA trust model, not MS. If you trust a certain CA, of course you trust their issued certificates by design. Currently, if some high tier CA f*cks up, there's no other way to invalidate their issued certificates than propagating CRLs and removing its certificate from the root CA stores manually (or by updates, as in MS case).

[ Parent | on HN ]