Hacker News Reader

Comment by kbart | Hacker News Reader

You can manage pre-installed root certificates manually in Windows. As far as I've seen, there was nothing sinister in default Windows root CA list.

View on HN

Microsoft just silently adds back root certs when you delete them (if it is trusted by microsoft). Or at least it did in winxp by default.

That's hardly relevant for the average computer user. By default, root certs are updated automatically.

>As far as I've seen, there was nothing sinister in default Windows root CA list.

Are you in any way related to MS or is your memory just very short?

>Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates

https://arstechnica.com/security/2014/07/emergency-windows-u...

"Thursday's unscheduled update effectively blocks highly sensitive secure sockets layer (SSL) certificates covering 45 domains that hackers managed to generate after compromising systems operated by the National Informatics Centre (NIC) of India. That's an intermediate certificate authority (CA) whose certificates were automatically trusted by all supported versions of Windows"

I'd argue that's a problem in CA trust model, not MS. If you trust a certain CA, of course you trust their issued certificates by design. Currently, if some high tier CA f*cks up, there's no other way to invalidate their issued certificates than propagating CRLs and removing its certificate from the root CA stores manually (or by updates, as in MS case).

Reply on news.ycombinator.com