Live data from Hacker News

Windows Certificate Manager does not display the complete trust list

hexatomium.github.io

51–60 of 103 posts

Re: Windows Certificate Manager does not display the complete trust list

#51

Earlier quoted context omitted.

In my experience, Docs can't even reliably align the cursor with the position between characters (problem described here[1], except my zoom is at 100% already). Thankfully all my documents have very light formatting, so I can just write in Vim and then upload them. [1] http://www.podiohelp.com/google-docs-cursor-misaligned/

I've seen this happen before, but only very rarely and refreshing would always fix it. Does refreshing not work for you?

Unfortunately not.

Re: Windows Certificate Manager does not display the complete trust list

#52

You can also use certutil to grab all the trusted root certificates from the Windows Update server: certutil -generateSSTFromWU roots.sst Then open roots.sst (which defaults to viewing in certmgr) and it will show the whole lot. Or use certutil -syncWithWU to get all the certs individually. Alternatively: download http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... [1], extract the authroot.stl file (whic…

The bigger takeaway from this is with a system like this (fully managed by Windows Updates).. how can you remove certificates you don't trust? Latest documentation for this seems to be for IE 5. I sure as hell like to run dkpkg-reconfigure ca-certificates every once in a while after some roots get compromised and don't trust Microsoft to be on the ball.

It can be added to the disallowed certificate store, which takes precedence over any trusted stores.

For example, using the root discussed in the article:

1. Download the root cert from http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... (or save it from the browser's certificate viewer)

2. Open certmgr and import it into 'Untrusted Certificates'.

(This just adds it for the current user's store. Could also import into the computer store by running mmc, adding the Certificates snap-in, and specifying 'Computer account' as the target.)

3. Restart browser. Go to https://certplusrootcag1-test.opentrust.com/ - it should say the certificate is revoked.

This only works for browsers like IE and Chrome, that use the Windows certificate store. Firefox has its own so would have to be done separately.

Re: Windows Certificate Manager does not display the complete trust list

#53

Earlier quoted context omitted.

The bigger takeaway from this is with a system like this (fully managed by Windows Updates).. how can you remove certificates you don't trust? Latest documentation for this seems to be for IE 5. I sure as hell like to run dkpkg-reconfigure ca-certificates every once in a while after some roots get compromised and don't trust Microsoft to be on the ball.

It can be added to the disallowed certificate store, which takes precedence over any trusted stores. For example, using the root discussed in the article: 1. Download the root cert from http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... (or save it from the browser's certificate viewer) 2. Open certmgr and import it into 'Untrusted Certificates'. (This just adds it for the current user's store. Could als…

Thanks! While I still find this kind of backwards at least something like this exists.

Re: Windows Certificate Manager does not display the complete trust list

#54
post #50
post #37

Earlier quoted context omitted.

Please don't call commenters "apologists" on HN.

I never knew apologists had a negative connotation. What is the concern with apologists?

The dictionary definition of apologist is "a person who offers an argument in defense of something controversial", and is usually used in such contexts as "hitler apologists" or the like. From there stems tptacek's reaction to someone using the term in a way that implies disparagement.

Re: Windows Certificate Manager does not display the complete trust list

#55

Windows isn't lying. Microsoft openly lists what certificates Windows includes on their site. The fact the root certificate store on your machine only lists certificates it actually contains is to be expected. This is just a UI failure.

When an American company lies, it's only a UI failure.

Re: Windows Certificate Manager does not display the complete trust list

#56
post #36
post #33

Earlier quoted context omitted.

If somebody out there has a reliable way to measure resource consumption in Windows (Mark Russinovich?), I'd be interested in a comparison between (say) a thousand word document in Word and the same document in Google Docs in Chrome. I think you could probably add "resource hungry" to your description of GDocs....

That's probably the case, but does it matter?

It chops off a solid 30-45 minutes of battery life on my laptop, in Safari (to say nothing of Chrome, at which point it becomes a campfire on my lap), so yeah, I think so.

Re: Windows Certificate Manager does not display the complete trust list

#59
post #37

Earlier quoted context omitted.

Please don't call commenters "apologists" on HN.

I did not: > And nothing you've said in this apologist answer has come close to addressing that, you're just dancing around it. I said the answer was apologist, not the individual. I myself post apologist answers all the time (justifications for controversial positions), but I don't consider myself an apologist broadly speaking. I also don't presume that the above poster is an "apologist" even if I do consider this s…

"Apologist" is a word for a person. Perhaps you were looking for "apologetic"? (Though given that an apologist is someone who practices apologetics, it still seems like a hazy distinction.)

Re: Windows Certificate Manager does not display the complete trust list

#60
post #9

Earlier quoted context omitted.

You're reading Hacker News and you want to know why someone would bother reverse engineering a closed source platform?

To be fair, Hacker is weird misnomer in many ways. It's starutp-scene-connected-tech-heavy-news more than anything else.

> It's starutp-scene-connected-tech-heavy-news more than anything else.

Yes, and that's because it is a very powerful marketing tool for Paul Graham's huge YC business.

Post reply on HN