News for hackers. Stuff that matters.

A comment on Lockdown.exe: Block unknown apps via Windows software restriction policy. Parent comment

Re:Lockdown.exe: Block unknown apps via Windows software res... by FoolishTech on Wednesday June 09, 2021 @11:29AM (#27449076)
I'm interested in where you can you get a code certificate for $99? My renewal is coming up and I'm paying $699/annual for a extended validation cert; I'm willing to consider a standard cert but even they are $499/annual. Buying a 3 year cert provides very little discount... that 3 year ev cert on Lockdown and my other apps is a $2000 deal.
[ Parent | on HN ]
Re:Lockdown.exe: Block unknown apps via Windows software res... by mattowen_uk on Thursday June 10, 2021 @05:24AM (#27458680)
Ah it's gone up a bit since I last looked, and you have to hunt around but the base cost seems to be $129:

https://www.ssl.com/certificates/code-signing/buy/

That's a yearly cost, but you only need to keep renewing if you are signing and releasing new apps or updates. Existing apps you've signed will remain valid if if you don't renew your cert (unlike websites etc.)

Also, it seems that the LARGE cost for the EV certs is only really needed for things like Windows drivers.

[ Parent | on HN ]
Re:Lockdown.exe: Block unknown apps via Windows software res... by FoolishTech on Thursday June 10, 2021 @09:09AM (#27460257)
wow, I hadn't researched in a while, but that looks sketchy. I purchased one that cheap some time around 2011 and the company ended up having certs revoked and went out of business, and the next best thing I found was digicert at a fraction of the cost of the comodo and the like.

they do have EV for $350/annual or $750/3 year cert so I might try that it is certainly cheaper than digicert.

and yes EV is good for more than drivers, it allows EXEs to bypass smartscreen prompts that would otherwise trigger on standard certs that have to go through reputation checks in smartscreen.

[ Parent | on HN ]
Re:Lockdown.exe: Block unknown apps via Windows software res... by mattowen_uk on Thursday June 10, 2021 @09:36AM (#27460572)
You make good points - The pricing is still a good example of how it's a tax on hobbyist developers.

Is there any 'free' Authenticode cert providers out there? Doing the same job as LetsEncrypt but for code?

[ Parent | on HN ]