News for hackers. Stuff that matters.

A comment on Lenovo Statement on Superfish.

Re:Lenovo Statement on Superfish by resonantcore on Thursday February 19, 2015 @11:29AM (#9074886)
They disabled it server-side? What about the CA certificate in all these Lenovo users' trust stores that blackhats can now use to MITM with wild abandon?
[ Parent | on HN ]
Re:Lenovo Statement on Superfish by thesimon on Thursday February 19, 2015 @12:48PM (#9075505)
It enhances the users experience when being MITM'd.

But yeah, the removal instructions mention that the certificate won't be removed, which is quite dangerous.

EDIT: And users removing the cert would be unable to load https pages, which is a tricky situation.

[ Parent | on HN ]