Hacker News Reader

Comment by krichman | Hacker News Reader

Hopefully in the future when all users can install trusted root certificates and only run software that is signed by a descendent we won't have this bullshit.

View on HN

Since when can CAs determine bad intent?

Besides, there are enough legitimate uses for webcam viewing software that you could just take a regular signed program and configure it in a deceptive manner. Modern web-browsers allow camera access without additional software, for example.

I'm all for software being signed as a matter of routine but this is not something that it would help.

They cannot, but they can revoke certificates from malware developers after the fact. And requiring a developer program would vastly reduce the number teenagers tricking people into installing a thing. Allowing self-signed roots would let more technical users manage their own security and install their own apps.

A solution to configuration files is to include them in what is signed or not allow your software to have the webcam on without also showing a window explaining what is happening and a button to turn it off. Modern web browsers typically ask for permission to use the webcam beforehand, and you can always close that page.

I guess there would still be shenanigans with signed binaries but there would be far fewer than what is going on here.

That sounds like a good way to kill innovation: make it impossible to distribute (and possibly develop) software without consent of a CA.

There is a middle ground. OS X default configuration only allows software to run if it is signed by a developer, unless you right-click on the application and select "open" through the contextual menu, in which case you are presented with the option to override it.

I like this, and I am a software developer.

(Windows has something like this too. I don't remember the details.)

I hate OS X's implementation. They need to allow third-party CA's.

I don't want to choose between what Apple allows developers to do and "fuck it let it run free and do whatever it likes". Nor do I want the global choice in System Preferences to be between developers that paid $100 to Apple this year and Wild West.

What would prevent malware authors from just signing with their own CA?

Users shouldn't install self-signed root certs unless they trust that root with access to all of their computer.

"all users can install trusted root certificates" doesn't reject the notion of self-signed roots.

Signed software doesn't matter when it comes to the most common methods of execution: Java, Flash, PDF exploits, Flash objects embedded in Microsoft Word documents currently bypass the sandboxing in both Word and Adobe Flash.

In other words, this isn't going away.

Sounds like they need a better sandbox :)

Signing does matter. Those may still be exploitable to run arbitrary code, but you cannot write code to disk that will get executed on start-up. The victim would have to open the same PDF every time they use their computer.

Read the article. They aren't clever enough to do that, they just get their users to install the software for them.

Not sure if you're being serious. In case you are: http://www.linhadefensiva.com/2013/02/signing-malware-applic...

Is this post sarcastic?

No, signed binaries are wonderful for users. Centralised CA's and not allowing self-signed roots are the only thing that would be objectionable.

What would you recommend the hurdle be for getting your software signed?

Whatever the CA sets as the barrier. Users can pick whatever CA they trust or whatever CA their technical friends and family recommends they trust.

"Users can pick whatever CA they trust or whatever CA their technical friends and family recommends they trust."

Which means you'll wind up with the situation we have with TLS: hundreds of CAs, all trusted by default, most not even remotely trustworthy. Users will have no idea about these CAs and so the CAs will never have to worry about being loose with certificates.

I sure hope we'd be smarter about it this time. I envision something more like the average user chooses from, i.e., Canonical and Microsoft, while a more technical user would choose one of those and also install his own self-signed root as a CA.

So you would have one or a group of companies gain full control over what programs are allowed to be installed on your operating system?

You believe an amateur software developer should have to pay to get her app signed by a CA before she is able to distribute it? That someone else gets a say over whether or not a person can build an application?

And what if that CA gets popped? What if that CA makes a mistake? Do you furthermore think that even semi-technical people will think about these things enough to pick individual CAs?

There are a dozen problems with what you're saying, and I think you know it. What I really wonder is why you're coming into this conversation at such an intellectually dishonest angle, like you've never seen the arguments for/against what you're proposing before.

1. A company you trust is acceptable as a CA. Nowhere did I say it had to be a company. I said users pick the CA's they trust.

2. If they want to distribute it with that CA. Nowhere did I say CA's must require payments. Yes a CA gets a say in who they will verify. That's the point.

3. If the CA gets "popped" or makes a mistake you remove them from your trust list. I don't expect regular people to know how to do this, but they could ask someone they know.

4. You didn't even read my arguments, you are attacking things I didn't say, so you are being intellectually dishonest, not I.

I read your arguments, and drew conclusions based on what you outlined. Again, you know that, and again you ignore that.

What is your real motivation here? Nothing you've said is anything a) useful or b) practical.

I think I see your point, but I wonder if this idealized scenario would be achievable in practice anytime soon, and if it's worth the current issues to try for it.

"Add this certificate for free porn!"

Until someone hacks the certificate and then all hell breaks loose.

sadly, every time we move towards this, people start screaming about "palladium" and "dee-arr-ehm" and "but then I won't be able to install Snarling Sealion!"

Both are true IMO, we really need to be vigilant about whether we can install our own certs or not.

The issue is that it won't be nearly as effective as you think it will be.

Reply on news.ycombinator.com