Comment by ebg13 | Hacker News Reader

Comment by ebg13 | Hacker News Reader

Parent Full thread

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation?

Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking up what I'm putting down, great. I also care about my users, so I'll happily mark my applications.

But you don't need to take $100/year from me for the right to not have thugs block access.

> Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates.

Malware exists to make money. Therefore malware authors can easily pay for certificates as a cost of business. Megacorp software fucks people over all the time. It exfiltrates their browsing history, MITMs their secure connections, installs rootkits and backdoors. Please don't pretend that this increases security.

Having gone through the process myself, it’s not trivial.

We first tried through GoDaddy who shouldn’t even offer the service to South Africans because they “required” a photograph of a company director holding a government issued photo identity document with physical address included. There is no such type of document here. We offered affidavits, lawyers letters, but they were unbending.

We then tried and managed to succeed through Digicert. Their process involved a few checks including checking local government mandated company registry and using the telephone number from that registry to phone a director to confirm they were aware of the certificate request.

Bad guys can certainly get this done, but it raises the bar very substantially, and once they’ve burned their credibility of the company the certificate is issued against, they have to use a different company.

Not that simple to just pay. You need an EV certificate (https://en.m.wikipedia.org/wiki/Extended_Validation_Certific...), which in turn needs a verified business address.

Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations.

And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo!

The only person in this story who doesn't have a business address is me.

What usually happens is that legitimate certificates are stolen.

What usually happens is that "legitimate" software distributors aren't. Just read the GP again.

Second to that, it's that people set the information up so that they'll mislead your verification processes just enough to pass.

Certificates stolen are way down from that.

This is in line with my experience. I've worked with cybersecurity in the past and the "attackers" used to be huge black hat companies that had much more money and power than all white hat companies combined. We joked that only the bad guys went to work using suits, since they are very powerful and well organized :)

I know there's a smiley in your comment, but this is a now a very genuine issue, and working in cybersecurity I feel helpless to do anything about the situation.

My biggest worry is the endless "telemetry", "customer experience feedback", "licensing", "opt-out", "tracing", "quality improvement programs", etc. On and on. There are now a thousand hooks into every data centre by just about every vendor involved. Every one of them is exfiltrating information. Every one of them is a data leak waiting to happen. Every one of them could take control at any time.

Huawei isn't doing anything different. The western governments just don't like it that they're copying them.

If you need a business address, it's pretty simple to get.

The main purpose is a paper trail leading the software back to you. If you aren't malicious, it's a few hours task to arrange.

https://www.microsoft.com/en-us/microsoft-365/business-insig...

> malware outfits bringing in millions of dollars a year

With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place without completely sacrificing usability.

You should see most security measures as the lock on your door. It doesn't take an expert to crack but still stops most from even attempting it. No security measure is 100% effective but it still raises the bar for a successful attack.

You seem to have a bone to pick with MS's choice so I'm genuinely curious in which direction would you go. And keep in mind you have a billion users and a truck load of baggage to work with.

> With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place

Exactly. That's why this should just stop. Because it hurts without helping.

> That's why this should just stop

So they should stop (discontinue) every measure that can be bypassed by an outfit with this kind of money? That doesn't leave many measures, if any. And it lowers the bar for a successful attack to someone with a couple of hours to spare. SmartScreen prompts are just like any HTTP error in a browser. The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it.

> it hurts without helping

It helps me verify that the software I use comes from the developer I expected. It may not be a catch-all but I find value in this.

Don't forget, your door lock can be opened in seconds and the person it inconveniences is mostly you, especially if you lock your keys inside. Your argument would be far more convincing if you took no precautions whatsoever because someone with millions to spend can bypass them.

> It helps me verify that the software I use comes from the developer I expected.

Nobody needs to charge money for me to be able to sign my executables with something like PGP.

> The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it.

And yet the message is very clearly "THIS IS UNSAFE" because "WE don't know the guy". It isn't "Don't run"/"Run anyway thanks." It's "DON'T RUN" in BOLD in an eye-catching bright box in a prominent location where buttons go and "(more info)" in body text somewhere else.

> Nobody needs to charge money

Your initial argument was against SmartScreen, not against paying. Now it's that things should be free. A cert costs because it gives you access to an already established infrastructure, integrated with everything, where you can easily verify the identify being certified.

Business opportunity for you: set up a similar infra for PGP but free. Something that can be integrated with an OS and can instantly allow me to see what a certificate would. Then make sure your infra don't become the point of failure. You can also implement a reputation system where a new developer gets a warning but one that's not intrusive, almost easy to miss... I will gladly use it (and I'm sure OS makers will too once you prove your solution is at least as solid as PKI) because I want the functionality, not the particular implementation.

> because "WE don't know the guy"

I don't know the guy either because there's not kind of identification attached to the package. A clear identification and reputation systems definitely help. Both of these are widely used on the internet today because it's pretty much the only way anyone ever came up with to discourage offenders. I will say it again and again: it raises the bar for a successful attack.

> It isn't "Don't run"/"Run anyway thanks." It's "DON'T RUN"

Which is almost identical to a browser security warning. It stands to reason that protecting your own machine should have an even more prominent message.

If you jump from one line of argumentation to another you'll never make a point. And your "solution" was to suggest that any security measure which can be bypassed by someone with millions of dollars to spend on this should not be implemented at all. Which is not even worthy of discussion.

As someone who used to make fake IDs it would be very easy to pass EV checks. It's like putting a padlock on a gate. Anyone who wants to get past it can easily do so.

Locks only keep honest people out

They also keep people honest by diminishing the temptation

I have a hard time believing this. Based on my experience, a part of the EV check was checking of the business entity with the state and sending snail mail to the address of record. Since our registered address was a law firm, I had to go through all kinds of hoops to get that letter as it contained the string needed to proceed to the next step in the EV verification.

You can recruit a clueless person to be a “virtual assistant” or similar, give them some random admin tasks (to make it feel legitimate) before sending the letter to their address and asking them to read/scan the contents for you.

A similar approach is successfully used by scammers to recruit money mules.

You have to be first registered with the state and the feds (IRS) as a business which creates all kinds of legal obligations and paperwork.

You're assuming this is in the US; some countries have different requirements and it's much easier to set up a business fraudulently. Not to mention, given the current situation with fraudulent covid-related unemployment/benefit claims in the US I am pretty sure there are ways to set up a business fraudulently in the US too.

In most US states it's very easy and inexpensive to register a business.

You can create shell corporations anonymously where the only thing that ties you to the company is possession of the bearer bonds

That's messing with the taxes. That's the most dangerous kind of enterprise.

digressing a bit, that's believable but my registered agent (a specialized law firm) just scans and uploads any mail to my account on their portal. It's not a problem most businesses spend much time on but you can probably find one that lives in this century. If I'm paying them a tiny annual retainer it's the least they can do and has already saved me a lot of tax compliance hassle being able to pull old docs that were handled by someone else.

If you were deliberately trying to set up a few shells for obfuscation it would not be hard, particularly if you had some means of buying fake IDs.

That's easy with a fake ID. You can get a personal mailbox (eg UPS Store) with fake IDs and register a company on the state's website with an anonymous prepaid debit card.

This is less than a day's worth of work to setup.

Registering offshore company with a fake passport will take whole $300 out of malware distributor pocket. Or might be $500 if they need random homeless guy to pass interview for them.

You can buy a verified business address pretty easily. See physicaladdress.com as an example.

Reply on news.ycombinator.com