Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Certificate Manager does not display the complete trust list

hexatomium.github.io

Post reply on HN
Print view View original

61–70 of 103 posts

Re: Windows Certificate Manager does not display the complete trust list

#61

Post by nailer »

mattkrea wrote: post #49
geographomics wrote: post #12

You can also use certutil to grab all the trusted root certificates from the Windows Update server: certutil -generateSSTFromWU roots.sst Then open roots.sst (which defaults to viewing in certmgr) and it will show the whole lot. Or use certutil -syncWithWU to get all the certs individually. Alternatively: download http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... [1], extract the authroot.stl file (whic…

The bigger takeaway from this is with a system like this (fully managed by Windows Updates).. how can you remove certificates you don't trust? Latest documentation for this seems to be for IE 5. I sure as hell like to run dkpkg-reconfigure ca-certificates every once in a while after some roots get compromised and don't trust Microsoft to be on the ball.

That seems reasonable : CNNIC compromised themselves and were removed from Mozilla and Android root cert stores, Microsoft's root cert store still trusts CNNIC.

Re: Windows Certificate Manager does not display the complete trust list

#62

Post by nailer »

forgottenpass wrote: post #13
eli wrote: post #9

Earlier quoted context omitted.

You're reading Hacker News and you want to know why someone would bother reverse engineering a closed source platform?

To be fair, Hacker is weird misnomer in many ways. It's starutp-scene-connected-tech-heavy-news more than anything else.

It used to be called Startup News.

Re: Windows Certificate Manager does not display the complete trust list

#63

Post by nailer »

TazeTSchnitzel wrote: post #6

Windows isn't lying. Microsoft openly lists what certificates Windows includes on their site. The fact the root certificate store on your machine only lists certificates it actually contains is to be expected. This is just a UI failure.

So roots are dynamically fetched and this is the list of previously fetched roots? Or is it a revocation check before first use? Do you have a link?

Re: Windows Certificate Manager does not display the complete trust list

#64

Post by KC8ZKF »

chc wrote: post #59
UnoriginalGuy wrote: post #47

Earlier quoted context omitted.

I did not: > And nothing you've said in this apologist answer has come close to addressing that, you're just dancing around it. I said the answer was apologist, not the individual. I myself post apologist answers all the time (justifications for controversial positions), but I don't consider myself an apologist broadly speaking. I also don't presume that the above poster is an "apologist" even if I do consider this s…

"Apologist" is a word for a person. Perhaps you were looking for "apologetic"? (Though given that an apologist is someone who practices apologetics, it still seems like a hazy distinction.)

In English, nouns can be used as adjectives. e.g. School bus, ticket office, computer mouse, apologist answer.

"Apologetic" has connotations of regret. I think this confusion might lead some people to take "apologist" as a derogatory or inflammatory word, when it shouldn't be.

https://en.wikipedia.org/wiki/Christian_apologetics https://en.wikipedia.org/wiki/Apologia

Re: Windows Certificate Manager does not display the complete trust list

#65

Post by mattkrea »

nailer wrote: post #61
mattkrea wrote: post #49

Earlier quoted context omitted.

The bigger takeaway from this is with a system like this (fully managed by Windows Updates).. how can you remove certificates you don't trust? Latest documentation for this seems to be for IE 5. I sure as hell like to run dkpkg-reconfigure ca-certificates every once in a while after some roots get compromised and don't trust Microsoft to be on the ball.

That seems reasonable : CNNIC compromised themselves and were removed from Mozilla and Android root cert stores, Microsoft's root cert store still trusts CNNIC.

e-Guven as well

https://blog.mozilla.org/security/2015/04/27/removing-e-guve...

edit: e-Guven is being removed "due to insufficient and outdated audits" and not a compromise (Couldn't reply below).

Re: Windows Certificate Manager does not display the complete trust list

#67

Post by yuhong »

mattkrea wrote: post #65
nailer wrote: post #61

Earlier quoted context omitted.

That seems reasonable : CNNIC compromised themselves and were removed from Mozilla and Android root cert stores, Microsoft's root cert store still trusts CNNIC.

e-Guven as well https://blog.mozilla.org/security/2015/04/27/removing-e-guve... edit: e-Guven is being removed "due to insufficient and outdated audits" and not a compromise (Couldn't reply below).

e-Guven was never compromised, it just still uses outdated practices like issuing directly from the root and expires in 2017 anyway. I once even caught an 1024-bit DSA cert being issued from this root by mistake.

Re: Windows Certificate Manager does not display the complete trust list

#68

Post by skrebbel »

mattkrea wrote: post #53
geographomics wrote: post #52

Earlier quoted context omitted.

It can be added to the disallowed certificate store, which takes precedence over any trusted stores. For example, using the root discussed in the article: 1. Download the root cert from http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... (or save it from the browser's certificate viewer) 2. Open certmgr and import it into 'Untrusted Certificates'. (This just adds it for the current user's store. Could als…

Thanks! While I still find this kind of backwards at least something like this exists.

Hmm, I think it's a very elegant design, probably built to precisely address the problem you asked about. Update server manages whitelist, user/admin manages blacklist, which wins. Nice!

Re: Windows Certificate Manager does not display the complete trust list

#69

Post by chc »

KC8ZKF wrote: post #64
chc wrote: post #59

Earlier quoted context omitted.

"Apologist" is a word for a person. Perhaps you were looking for "apologetic"? (Though given that an apologist is someone who practices apologetics, it still seems like a hazy distinction.)

In English, nouns can be used as adjectives. e.g. School bus, ticket office, computer mouse, apologist answer. "Apologetic" has connotations of regret. I think this confusion might lead some people to take "apologist" as a derogatory or inflammatory word, when it shouldn't be. https://en.wikipedia.org/wiki/Christian_apologetics https://en.wikipedia.org/wiki/Apologia

When you use a noun referring to a person to modify another noun, it will generally be taken to mean "belonging or related to such a person." For example, "school teacher salaries" means salaries belonging to school teachers. Similarly, the phrase "apologist comment" naturally reads as "a comment belonging to an apologist."

And I don't think it's the connotations of regret that lend the term "apologist" its negative connotations. The negative connotation of that word is the implication that you are bound and determined to defend some position and will not be moved — stemming from its roots of defending literal dogma. People take it to mean a sort of closed-minded, blind tribalism.

At any rate, if you don't trust your audience to read "apologetic" in the proper sense, I certainly wouldn't hold out much hope for a neutral reading of "apologist."

Re: Windows Certificate Manager does not display the complete trust list

#70

Post by mattkrea »

skrebbel wrote: post #68
mattkrea wrote: post #53

Earlier quoted context omitted.

Thanks! While I still find this kind of backwards at least something like this exists.

Hmm, I think it's a very elegant design, probably built to precisely address the problem you asked about. Update server manages whitelist, user/admin manages blacklist, which wins. Nice!

I prefer the situation on Linux where I don't have the certificate at all rather than getting the certificate and having to mark it untrusted.

Edit: I'm referring to configuring the package as ca-certificates is installed or via dpkg-reconfigure

Post reply on HN