Hacker News Reader

Comment by xnyhps | Hacker News Reader

They added a password to the private key which they didn't have to, so it's not true that they didn't attempt to obfuscate it at all. In practice that only bought them a couple of hours at most, but why add a password unless you're trying to stop people from using it?

View on HN

They didn't "buy hours" - they didn't really have a defense line there. They cashed in the day they signed the contract with Lenovo.

Someone should sue to see these contracts open in the public.

If you subscribe to the idea that you shouldn't assume malice when stupidity suffices, maybe the programmer in question just saw somewhere that it's good practice to use a password on private keys, and didn't understand why you do it or how it helps.

Yeah that's another point for the "don't blame us because we're stupid" argument. They're actually so stupid that they use a password, that's stored in the same place as the cert. If they used any of the standard anti-reversing techniques, that would have implied enough sophistication to be expected to know how TLS certs work, thus enough sophistication to know to just generate new certs on first use. One would have expected Commodea to make this automatic for their poor stupid customers, however.

Looks like the software they were using indeed requires a password on the private key:

http://www.komodia.com/wiki/index.php/Komodia%27s_Redirector...

(Down near the bottom, "sslpsd - To the password of the root CA (it's mandatory).")

Reply on news.ycombinator.com