Hacker News Reader

Anyone who installed this audio driver could have all their https traffic intercepted by Savitech.

Does this mean savitech needs to hypothetically set up some mitm attack somewhere and wait for you to send traffic, then they can decrypt and read, or does it mean that they can do that direct from your computer by virtue of that root certificate?

They would need to MITM you. But take into account that it doesn't need to be Savitech. If Savitech was compromised, an attacker could get access to their private key.

In a sense, your security becomes dependent on the security of Savitech. I imagine their private key is not as securely stored as a real CA would store theirs. (e.g. with Superfish, Lenovo included the private key on all laptops, for anyone to grab[1])

[1] https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci...

They would need to MITM you somewhere, but that could probably happen in their audio driver that's already installed and running on the target machine.

Reply on news.ycombinator.com