Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Certificate Manager does not display the complete trust list

hexatomium.github.io

Post reply on HN
Print view View original

41–50 of 103 posts

Re: Windows Certificate Manager does not display the complete trust list

#41

Post by corndoge »

ryanlol wrote: post #34
vtlynch wrote: post #22

Earlier quoted context omitted.

"Typical users only care about the abstraction of web security so that's what Windows surfaces." Typical users do not open certmgr.msc

People that understand what certmgr.msc does (or should do) would immediately realize that it's not telling the full story.

I'm not a web developer, I am not intimately familiar with the intricate details of SSL, and yet I understand what a root store is and how it works. I have used certmgr.msc in the past, understanding that it should show me the certificates trusted by the system -- no more, no less. I did not immediately realize that it was not showing me all the certs my system trusts and I would like to know how I could have immediately realized that without knowing all the major CA's and the names of their root certs off the back of my hand.

Perhaps that could be written off as my failing in not knowing what certmgr.msc "should do", but Windows certainly does not make it very clear and I think it's reasonable for an average power user to assume that it shows all the trusted certs on the system, and not part.

Re: Windows Certificate Manager does not display the complete trust list

#42

Post by oblio »

kuschku wrote: post #25
forgottenpass wrote: post #13

Earlier quoted context omitted.

To be fair, Hacker is weird misnomer in many ways. It's starutp-scene-connected-tech-heavy-news more than anything else.

Which can also be seen in the fact that the general consensus on startup-news is often the opposite of what the actual hackers, for example those who are in the CCC, think.

CCC = ?

Re: Windows Certificate Manager does not display the complete trust list

#44

Post by Bob_Sheep »

oblio wrote: post #42
kuschku wrote: post #25

Earlier quoted context omitted.

Which can also be seen in the fact that the general consensus on startup-news is often the opposite of what the actual hackers, for example those who are in the CCC, think.

CCC = ?

Chaos Computer Club

Re: Windows Certificate Manager does not display the complete trust list

#46

Post by fimdomeio »

kuschku wrote: post #25
forgottenpass wrote: post #13

Earlier quoted context omitted.

To be fair, Hacker is weird misnomer in many ways. It's starutp-scene-connected-tech-heavy-news more than anything else.

Which can also be seen in the fact that the general consensus on startup-news is often the opposite of what the actual hackers, for example those who are in the CCC, think.

Oblio that's leet speak. hacker history (well and present) nothing that a google search won't clarify.

Re: Windows Certificate Manager does not display the complete trust list

#47

Post by UnoriginalGuy »

tptacek wrote: post #37
UnoriginalGuy wrote: post #32

Earlier quoted context omitted.

The problem with your argument is that this is an administrative GUI that isn't even normally presented to end users unless you search for it or know how MMC snap-ins work. It is a power-user interface by all measure. And while Microsoft does simplify UIs for end users, they don't typically do the same for administrative content (just look at anything in the Admin Tools, or MMC snap-ins, no sugar coating there). Your…

Please don't call commenters "apologists" on HN.

I did not:

> And nothing you've said in this apologist answer has come close to addressing that, you're just dancing around it.

I said the answer was apologist, not the individual.

I myself post apologist answers all the time (justifications for controversial positions), but I don't consider myself an apologist broadly speaking. I also don't presume that the above poster is an "apologist" even if I do consider this singular post "apologist" in nature.

Re: Windows Certificate Manager does not display the complete trust list

#48

Post by amlgsmsn »

UnoriginalGuy wrote: post #32
brudgers wrote: post #17

One feature of Windows is defaulting to not showing messy complexity to the user. The other feature is defaulting to backward compatibility. Combined, this means that Windows often has more than two data stores for some aggregate feature [e.g. web browser security, software configuration etc.] as new versions of Windows implement these features in more robust ways. So yeah there are two or more places where certifica…

The problem with your argument is that this is an administrative GUI that isn't even normally presented to end users unless you search for it or know how MMC snap-ins work. It is a power-user interface by all measure. And while Microsoft does simplify UIs for end users, they don't typically do the same for administrative content (just look at anything in the Admin Tools, or MMC snap-ins, no sugar coating there). Your…

>Please link to the documentation about this on Microsoft's site.

Here are a few:

http://social.technet.microsoft.com/wiki/contents/articles/3...

Mailing list: https://cabforum.org/pipermail/public/2015-August/005847.htm...

http://social.technet.microsoft.com/wiki/contents/articles/1...

Re: Windows Certificate Manager does not display the complete trust list

#49

Post by mattkrea »

geographomics wrote: post #12

You can also use certutil to grab all the trusted root certificates from the Windows Update server: certutil -generateSSTFromWU roots.sst Then open roots.sst (which defaults to viewing in certmgr) and it will show the whole lot. Or use certutil -syncWithWU to get all the certs individually. Alternatively: download http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... [1], extract the authroot.stl file (whic…

The bigger takeaway from this is with a system like this (fully managed by Windows Updates).. how can you remove certificates you don't trust?

Latest documentation for this seems to be for IE 5. I sure as hell like to run dkpkg-reconfigure ca-certificates every once in a while after some roots get compromised and don't trust Microsoft to be on the ball.

Re: Windows Certificate Manager does not display the complete trust list

#50

Post by dfc »

tptacek wrote: post #37
UnoriginalGuy wrote: post #32

Earlier quoted context omitted.

The problem with your argument is that this is an administrative GUI that isn't even normally presented to end users unless you search for it or know how MMC snap-ins work. It is a power-user interface by all measure. And while Microsoft does simplify UIs for end users, they don't typically do the same for administrative content (just look at anything in the Admin Tools, or MMC snap-ins, no sugar coating there). Your…

Please don't call commenters "apologists" on HN.

I never knew apologists had a negative connotation. What is the concern with apologists?
Post reply on HN