Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Certificate Manager does not display the complete trust list

hexatomium.github.io

Post reply on HN
Print view View original

11–20 of 103 posts

Re: Windows Certificate Manager does not display the complete trust list

#11

Post by sp332 »

zxcvcxz wrote: post #8
philliphaydon wrote: post #5

Earlier quoted context omitted.

Everyone talks about how great the alternatives for office are. Buy they are good. Not great. Even office word online is better than Google docs.

What is "better" about MS word than google docs? The only reason I see to use word is if you're using files from 1999 that don't work anywhere else. Google docs is a much simpler system, especially for places like schools because of the "cloud" nature of it. Google docs has all the features the average person needs. MSWord is for specialty cases, google docs and the open alternatives are for everyone else. I'm about…

I think you missed the word "online". https://office.live.com/start/Word.aspx

Re: Windows Certificate Manager does not display the complete trust list

#12

Post by geographomics »

You can also use certutil to grab all the trusted root certificates from the Windows Update server:

    certutil -generateSSTFromWU roots.sst
Then open roots.sst (which defaults to viewing in certmgr) and it will show the whole lot. Or use certutil -syncWithWU to get all the certs individually.

Alternatively: download http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... [1], extract the authroot.stl file (which is in PKCS#7 format), use 'certutil -dump' to list all the subject key identifiers therein, and then download them from the same location as authrootstl.cab by appending ".crt" to the identifier.

Windows is not lying about anything, you just need to look in the right place.

Also, if you want to examine the CTL list that Windows is currently using - which should be identical to the one above unless it's brand new or there has been a problem downloading it - this will extract it from the registry:

    powershell -Command "[IO.File]::WriteAllBytes('authroot-local.stl',(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate').EncodedCtl)"
Then use 'certinfo -dump' or whatever you like, it's exactly the same format as the downloaded authroot.stl. This is the same registry data that the OP's CTLInfo tool examines.

[1] as specified in https://support.microsoft.com/en-us/kb/2677070

Re: Windows Certificate Manager does not display the complete trust list

#13

Post by forgottenpass »

eli wrote: post #9
FreeHugs wrote: post #2

CTLInfo is the result of a few sleepless nights spent understanding and reverse engineering some of the CTL obscure format I wonder what the reason is to use a userunfriendly system like Windows and then spend hours and hours fighting it? No matter how much time you put in, you will never win against an OS that is working against your interests.

You're reading Hacker News and you want to know why someone would bother reverse engineering a closed source platform?

To be fair, Hacker is weird misnomer in many ways. It's starutp-scene-connected-tech-heavy-news more than anything else.

Re: Windows Certificate Manager does not display the complete trust list

#14

Post by dtech »

TazeTSchnitzel wrote: post #6

Windows isn't lying. Microsoft openly lists what certificates Windows includes on their site. The fact the root certificate store on your machine only lists certificates it actually contains is to be expected. This is just a UI failure.

Yep, they release a periodical PDF with interim updates [1]. Only the most lazy "security researcher" would believe that Windows only trusts two dozen root certificates.

[1]: http://social.technet.microsoft.com/wiki/contents/articles/1...

Re: Windows Certificate Manager does not display the complete trust list

#15

Post by icebraining »

zxcvcxz wrote: post #8
philliphaydon wrote: post #5

Earlier quoted context omitted.

Everyone talks about how great the alternatives for office are. Buy they are good. Not great. Even office word online is better than Google docs.

What is "better" about MS word than google docs? The only reason I see to use word is if you're using files from 1999 that don't work anywhere else. Google docs is a much simpler system, especially for places like schools because of the "cloud" nature of it. Google docs has all the features the average person needs. MSWord is for specialty cases, google docs and the open alternatives are for everyone else. I'm about…

In my experience, Docs can't even reliably align the cursor with the position between characters (problem described here[1], except my zoom is at 100% already).

Thankfully all my documents have very light formatting, so I can just write in Vim and then upload them.

[1] http://www.podiohelp.com/google-docs-cursor-misaligned/

Re: Windows Certificate Manager does not display the complete trust list

#16

Post by MatmaRex »

zxcvcxz wrote: post #8
philliphaydon wrote: post #5

Earlier quoted context omitted.

Everyone talks about how great the alternatives for office are. Buy they are good. Not great. Even office word online is better than Google docs.

What is "better" about MS word than google docs? The only reason I see to use word is if you're using files from 1999 that don't work anywhere else. Google docs is a much simpler system, especially for places like schools because of the "cloud" nature of it. Google docs has all the features the average person needs. MSWord is for specialty cases, google docs and the open alternatives are for everyone else. I'm about…

It's true that the average user uses maybe 20% of Word's features, and Google Docs have 50% of them. The problem is that each person uses a different 20%.

One feature I personally needed and missed was to generate a table of contents with page numbers for each heading. I ended up exporting the doc to Word to do it, and in the process discovered that the exported document had a messed up layout in a few places.

Re: Windows Certificate Manager does not display the complete trust list

#17

Post by brudgers »

One feature of Windows is defaulting to not showing messy complexity to the user. The other feature is defaulting to backward compatibility. Combined, this means that Windows often has more than two data stores for some aggregate feature [e.g. web browser security, software configuration etc.] as new versions of Windows implement these features in more robust ways.

So yeah there are two or more places where certificates are stored. Typical users only care about the abstraction of web security so that's what Windows surfaces. Application developers should choose the new store for new applications. Existing applications can use the old method. System administrators and security consultants should make themselves familiar with all the documentation and double their rates.

Bloggers, however, are still free to write linkbait headlines using the Windows bashing meme.

Re: Windows Certificate Manager does not display the complete trust list

#18

Post by CrazyCatDog »

3pt14159 wrote: post #10
johnminter wrote: post #7

Earlier quoted context omitted.

I'll add to philtar's comment: Because senior management forces workers to use it. I'm a scientist who analyzes large data sets. I also need to communicate to my co-workers. I need a secure operating system without a lot of eye-candy that makes it look like a tablet and lets me give priority to my data analysis tasks. Windows is not it, but I have to use it.

But you can use things like Excel easily in a VM. Not pull your hair out hard, but easily . Then you can parse Excel or Word with Python in Linux easily . I just don't get how we still allow closed source operating systems for critical business tasks.

Try deploying and a different OS with easily understandable UI. Make it easy so that companies can issue laptops and upon first login the machines are appropriately imaged per the user needs. Make sure that strong user limits are in place to prevent users from running bitcoin-mining/porn-servers/or-worse on corporate machines and then and only then, you may have a shot at disrupting the Windows enterprise stronghold.

If you were to poll corporate user income and their provided OS, you will likely find that 99% of workers earning low wages (i.e. not trusted by their companies) are provided windows, the more someone earns the more likely they are to have a choice in OS from their employer--just my hypothesis.

Re: Windows Certificate Manager does not display the complete trust list

#19

Post by pandog »

TazeTSchnitzel wrote: post #6

Windows isn't lying. Microsoft openly lists what certificates Windows includes on their site. The fact the root certificate store on your machine only lists certificates it actually contains is to be expected. This is just a UI failure.

But there's a difference between looking at the list of root certificates that Microsoft say Windows trusts and looking at the list of root certificates that Windows trusts.

Re: Windows Certificate Manager does not display the complete trust list

#20

Post by LoSboccacc »

philtar wrote: post #3
FreeHugs wrote: post #2

CTLInfo is the result of a few sleepless nights spent understanding and reverse engineering some of the CTL obscure format I wonder what the reason is to use a userunfriendly system like Windows and then spend hours and hours fighting it? No matter how much time you put in, you will never win against an OS that is working against your interests.

1) Because MSFT provides great corporate support for desktops. Keyword: great. Not good. Great. 2) Because people are used to it. 3) Because Office products are the de facto standard, and they run best on windows. I could go on, but you get the point.

x) Anything related with drivers, especially video and audio

With the exception of printers. Omg printers are such a PITA on windows I often just send a pdf to me and print it with the phone.

Post reply on HN