Why are they deploying their own certificate into the root store???? This is shocking behaviour. What's the difference between this and malicious software.
Intent.
Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
11–20 of 123 posts
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#12> the software was also installing a root certificate into the Trusted Root CA Certificate store. This kind of stuff shouldn't even be legal.
I have to STRONGLY disagree.
It's a slippery slope towards a world in which the computers we use are completely locked down and we have no control over what they trust, being dictated by the corporations and their interests. The freedom to modify your roots of trust is extremely important and situations like this should not scare us into depriving ourselves out of that. I say this as someone who runs an adblocking/filtering proxy and MITM my own traffic continuously. What's scarier than being MITM'd? Being force-fed by those who want to control your life.
These certificates are used by the software to communicate with the headset using a TLS encrypted web socket.
Why does a headset even need TLS...
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#13Earlier quoted context omitted.
As a bit of a layman, is there even any legitimate reason at all (other than a user installing it in their own machine for reverse engineering purposes) for anyone to install a root certificate anymore? I could understand it if it was a small company doing so at the time when certificates were expensive, but Sennheiser has plenty of money and certificates can be obtained for free nowadays.
It's perfectly normal to install new root certificates - for example, so that a company can sign internal websites (or for MITM proxies). It's incredibly shady to have random software install into your trust store.
As someone that has been burned by self signed internal only sites. Take the extra 15 minutes and get a proper cert, and domain name for your internal sites. It can save a massive amount of pain later.
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#14> the software was also installing a root certificate into the Trusted Root CA Certificate store. This kind of stuff shouldn't even be legal.
Why? The user chose to run the installer and opted to give it control to modify their computer. What part of that process should be illegal?
They give permission to modify their computer/device, but obviously there's an implicit trust that it isn't going to do something horrifically bad.
Trusting a builder to come in to your home and change things- you'd be pretty angry if they took down a supporting wall to put up a new light fitting (and you'd probably have some legal comeback).
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#15Why are they deploying their own certificate into the root store???? This is shocking behaviour. What's the difference between this and malicious software.
the problem is not that they add a root ca to the store. the problem is that they use the same Root CA on every computer in the world AND adding it into the Store AND having the Root CA PRIVATE KEY on ANY computer.
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#16> the software was also installing a root certificate into the Trusted Root CA Certificate store. This kind of stuff shouldn't even be legal.
I have to STRONGLY disagree. It's a slippery slope towards a world in which the computers we use are completely locked down and we have no control over what they trust, being dictated by the corporations and their interests. The freedom to modify your roots of trust is extremely important and situations like this should not scare us into depriving ourselves out of that. I say this as someone who runs an adblocking/fi…
The law doesn't have to lock it down though. Software companies should be accountable for putting users at risk in this way, it should not be legal to install fundamentally insecure software without explicit permission from the user.
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#17Have any hardware companies ever written good accompanying software? From all the custom-ui graphics card config nonsense to utilities that phone home of their own accord, to things like this which are laughably awful. I feel glad I left for the mild shores of Linux in the early 00s.
Yeah, because on Linux the community has to support the hardware because the manufacturer doesn't even bother. Sounds way better...
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#18Earlier quoted context omitted.
As a bit of a layman, is there even any legitimate reason at all (other than a user installing it in their own machine for reverse engineering purposes) for anyone to install a root certificate anymore? I could understand it if it was a small company doing so at the time when certificates were expensive, but Sennheiser has plenty of money and certificates can be obtained for free nowadays.
I run some services for my private use. It's crazy that I need to have them certified by some third-party over-seas CA since I can't get my own devices to trust my own certificates. We're not at that point yet, but running your own trust root is getting quite annoying. For example, Android constantly nags about "network might be monitored" when custom certificates are installed.
Android constantly nags about "network might be monitored" when custom certificates are installed.
It won't if you add name constraints to your root certificate (because then it can't be used for blanket monitoring).
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#19> the software was also installing a root certificate into the Trusted Root CA Certificate store. This kind of stuff shouldn't even be legal.
Why? The user chose to run the installer and opted to give it control to modify their computer. What part of that process should be illegal?
They gave it control to install headphone software. This is beyond the reasonable scope of what headphone software could be expected to do.
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#20Earlier quoted context omitted.
As a bit of a layman, is there even any legitimate reason at all (other than a user installing it in their own machine for reverse engineering purposes) for anyone to install a root certificate anymore? I could understand it if it was a small company doing so at the time when certificates were expensive, but Sennheiser has plenty of money and certificates can be obtained for free nowadays.
I run some services for my private use. It's crazy that I need to have them certified by some third-party over-seas CA since I can't get my own devices to trust my own certificates. We're not at that point yet, but running your own trust root is getting quite annoying. For example, Android constantly nags about "network might be monitored" when custom certificates are installed.
[deleted]