Hacker News Reader

Comment by smacktoward | Hacker News Reader

Every single person who installed Bonzi Buddy thought they were getting it from a good source.

Bonzi Buddy, as a money making enterprise, would have paid for a signing certificate as a cost of business. This does not save you from Bonzi Buddy.

Sure, Bonzi Buddy might not be the best example, but you get his point. People just click through dialogs to close them without thinking about what they are clicking.

You don't get to handwave away a clear fallacy with "ok but you get the point". _My_ point is that the point is false, not that the example is bad. If Bonzi Buddy can just buy their way into your computer, then this does not save you. From anything. Because real malicious actors like Bonzi Buddy can just buy their way in!

I don't think this is just a hypothetical either; if I remember rightly, a lot of the really obnoxoius unwanted software from that era was signed with valid, purchased signing certificates in order to encourage people to install it via ActiveX.

A trojan that steals banking information is going to be able to afford a certificate, but they aren't going to buy one because they would have to identify themselves.

> they would have to identify themselves

False. https://en.wikipedia.org/wiki/Identity_fraud

In order to understand this, you really need to start thinking like a criminal. "If I had money, power, maybe guns, and no conscience or care for anyone else, what could I get away with?"

You're imagining some mastermind criminal rather than some kid or for-hire hacker who finds an exploit kit and gets to work piecing together something malicious.

Reply on news.ycombinator.com