Hacker News Reader

I haven't seen anything that really showed the intent of Dell, just a bunch of woolly corp-speak about improved customer service.

View on HN

The intent is in the certificate. Superfish could create and sign any certificate, meaning it could impersonate websites. This certificate cannot sign other certificates, meaning it can't be used in the same way as superfish. Thus the logical intent seems to be bloatware, backdoors, etc.. not snooping on HTTPS connections.

This is the distinction the person you are replying to is trying to make, because although similar to superfish, it is not quite the same.

If the dell cert can't be used to impersonate websites, what's with all the test websites people set up to demonstrate it?

I think the problem is the private key is accessible AND machines were already setup to trust it (because of the cert). So what s_henry_paulson said is technically correct but it's conceptually wrong.

Reply on news.ycombinator.com