News for hackers. Stuff that matters.

A comment on Basic Electron Framework Exploitation. Parent comment

Re:Basic Electron Framework Exploitation by mceachen on Wednesday August 07, 2019 @04:37PM (#20638727)
Can confirm. It took the better part of a month to get both windows and mac code signing certificates provisioned for PhotoStructure.

The diligence applied for both platforms at least exceeded pure security theater. They actually did a modicum of effort to ensure I was who I said I was, but it wasn't much. It just took a lot of wall time.

[ Parent | on HN ]
Re:Basic Electron Framework Exploitation by mgoetzke on Thursday August 08, 2019 @03:03AM (#20642435)
which is really weird. a let's encrypt approach to validate ownership of a domain should be sufficient. if the app is from a domain you trust that should be enough for most apps. bonus checks for high-risk applications (banking/LoB etc)
[ Parent | on HN ]
Re:Basic Electron Framework Exploitation by mceachen on Thursday August 08, 2019 @02:06PM (#20646958)
I don't think it's analogous.

If you need a certificate to prove you own a domain, changing DNS TXT records for that domain, or serving a secret, from that domain, proves you own the domain.

If I need a certificate that proves I am the corporate entity on some signature, say, "PhotoStructure, Inc.", there isn't some magick TXT record I can add that uniquely identifies me as the owner of that business.

[ Parent | on HN ]