Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dell shipping laptop with rogue self-signed root CA

np.reddit.com

Post reply on HN
Print view View original

81–90 of 109 posts

Re: Dell shipping laptop with rogue self-signed root CA

#81

Post by spectralblu »

guelo wrote: post #31

On Android I only buy and recommend Nexus devices because of crapware, privacy and security concerns. It might be a good time for Microsoft users to switch to that same strategy and only buy Microsoft devices, since the introduction of Microsoft's own laptop makes it possible. It's also pretty much the Apple model.

An interesting thing I realized on Android while doing some development was that if you install a custom root cert, Android actually persists a notification that says something along the lines of "other people may be able to intercept your communication".

Noticed this while I was installing the MITM cert for CharlesProxy.

Re: Dell shipping laptop with rogue self-signed root CA

#82

Post by Raed667 »

okuli wrote: post #36
guelo wrote: post #31

On Android I only buy and recommend Nexus devices because of crapware, privacy and security concerns. It might be a good time for Microsoft users to switch to that same strategy and only buy Microsoft devices, since the introduction of Microsoft's own laptop makes it possible. It's also pretty much the Apple model.

Microsoft sells laptops from different manufacturers with Signature Edition. Those laptops don't have any junk.

can you explain to me how an i5-6300HQ/8GB memory/256GB SSD worth 1'700$ ?

For that price I'd buy a gamer laptop and just do a clean install.

Re: Dell shipping laptop with rogue self-signed root CA

#83

Post by endgame »

tetrep wrote: post #33
tedunangst wrote: post #25

Karmic. Straight from Dell's website: Dell is serious about your privacy Worried about Superfish? Dell limits its pre-loaded software to a small number of high-value applications on all of our computers. Each application we pre-load undergoes security, privacy and usability testing to ensure that our customers experience the best possible computing performance, faster set-up and reduced privacy and security concerns.

In case they think it wise to remove that blurb (it's on various product pages): https://web.archive.org/web/20151123183352/http://www.dell.c...

And in case they twiddle robots.txt to force the wayback machine to clear out: https://archive.is/IaIcl

Re: Dell shipping laptop with rogue self-signed root CA

#84

Post by daxelrod »

rasz_pl wrote: post #63

Off topic: I dont reddit that much, so this is a first time I see this banner (specifically crafted to not be copyable!) > You have been linked to a read-only version of this subreddit. Please respect the community by not voting. Please do not vote or comment when you come from external subreddits. wtf?

It's non-copyable because it's added with CSS and not an element on the page. It's done this way because CSS is the only way for a subreddit's moderators to add a message like this. (Reddit allows moderators to customize CSS, but not otherwise alter pages.)

Re: Dell shipping laptop with rogue self-signed root CA

#85

Post by lazaroclapp »

astrodust wrote: post #22
Avitas wrote: post #17

It's hard for me to imagine a company as big as Dell making such a bone-headed blunder.

Volkswagen made a much bigger blunder, as you might have heard. Sometimes companies fail to comprehend the consequences of their actions.

In that particular case, it's likely less "fail to comprehend the consequences of their actions" and more "underestimate the chances of being caught"...

Re: Dell shipping laptop with rogue self-signed root CA

#86

Post by scholia »

cm2187 wrote: post #41
guelo wrote: post #31

On Android I only buy and recommend Nexus devices because of crapware, privacy and security concerns. It might be a good time for Microsoft users to switch to that same strategy and only buy Microsoft devices, since the introduction of Microsoft's own laptop makes it possible. It's also pretty much the Apple model.

I am not sure that buying an Android phone is helping much from a privacy point of view. There is a reason Android is free...

Probably not many people have read (for example) Torproject ...

Mission Impossible: Hardening Android for Security and Privacy

https://blog.torproject.org/blog/mission-impossible-hardenin...

Re: Dell shipping laptop with rogue self-signed root CA

#87

Post by Tloewald »

scholia wrote: post #80
astrodust wrote: post #20

Earlier quoted context omitted.

So buy it twice to get a good copy? Microsoft really needs to reel in the bad behaviour on the part of the OEMs.

The US government launched a massive anti-trust case against Microsoft to enable OEMs to do whatever they wanted. It cost Microsoft many billions of dollars, almost had the company broken up, and put them under close Department of Justice supervision for a decade. I don't think Microsoft will risk anything like that again....

Microsoft didn't get sued for trying to make installing Windows easier. It got sued for making changes in Windows designed to damage competitors (specifically Netscape, Sun, Borland, and Apple) and publicly and repeatedly lying about it.

Re: Dell shipping laptop with rogue self-signed root CA

#88

Post by thescriptkiddie »

r00fus wrote: post #60
thescriptkiddie wrote: post #49

Earlier quoted context omitted.

They could have just put the drivers on the CD like every linux distro ever.

You mean the CD recovery image disk which would ostensibly have all the same bloat/spyware as the PC itself?

No, I mean the official Windows CD (technically two DVD set now). New Windows versions are shipping frequently enough now that it would actually be possible.

Re: Dell shipping laptop with rogue self-signed root CA

#89

Post by j_h_s »

r00fus wrote: post #60
thescriptkiddie wrote: post #49

Earlier quoted context omitted.

They could have just put the drivers on the CD like every linux distro ever.

You mean the CD recovery image disk which would ostensibly have all the same bloat/spyware as the PC itself?

Microsoft could maintain specific install mediums for each device, including the drivers necessary, but without allowing vendors to load crapware

Re: Dell shipping laptop with rogue self-signed root CA

#90

Post by Laforet »

nly wrote: post #65
philh wrote: post #2

[1] suggests that this can be used for code signing, but not to MITM network requests, which makes it bad in a different way to superfish. [1] https://np.reddit.com/r/technology/comments/3twmfv/dell_ship...

So should it not have been tagged solely for code-signing? x509 has a field for intended usage.

This particular certificate has no constraints, so if my understanding of x.509 is correct then it can be used for everything.

Of course if they had known better they probably would not have shipped it with the private key protected by such a obvious and weak password.

Post reply on HN