Information on the revocation of WinRAR 5.91 digital certificate

Post by skymt » Wed, Aug 26, 2020, 5:09 PM UTC

akersten wrote: post #27

> another explanation, i.e. that one reason for the revocation is some mysterious 570 MB executable file, which had been signed with our certificate but looked like a file used by hackers. Woah, talk about burying the lede? This sentence makes it sound like their private key was compromised, in which case it makes total sense to revoke the cert. Unless I'm misunderstanding what they're trying to say here.

Post by skymt » Wed, Aug 26, 2020, 5:13 PM UTC

gruez wrote: post #43

skymt wrote: post #42

Earlier quoted context omitted.

You are misunderstanding. WinRAR's implication is that the CA is lying about the 570 MB file because they didn't mention it until WinRAR challenged them on the VirusTotal justification for revocation, and because they were unable to provide the file in question or any evidence that it exists.

[deleted]

Post by ikeboy » Wed, Aug 26, 2020, 5:16 PM UTC

gruez wrote: post #41

ikeboy wrote: post #20

Not a lawyer but I suspect there's a viable tortious interference claim. Revocation is effectively telling your customers that your product is unsafe, if done without cause it could be actionable.

>Revocation is effectively telling your customers that your product is unsafe ...or that the certificate was no longer in compliance with their Certificate Practice Statement. It looks like their CPS gives them a great deal of leeway here. https://sectigo.com/uploads/files/Sectigo-CPS-v5.2.pdf#page=...

Post by MikusR » Wed, Aug 26, 2020, 5:17 PM UTC

Arnavion wrote: post #4

black3r wrote: post #3

Do people still use WinRar? :O

Yes. People who don't know any better alternatives continue to use it, and continue to recommend it to other people. So the cycle continues. Heck, WinZip still makes new releases so I'm sure people still use that too.

Post by yjftsjthsd-h » Wed, Aug 26, 2020, 5:18 PM UTC

breakfastduck wrote: post #32

mrweasel wrote: post #13

Earlier quoted context omitted.

Or maybe their customers just like the product, as in the GUI and feature and don’t care that another compression algorithm can shave off a few extra megabytes. If I recall correctly WinRAR can make self extracting archives pretty easily. If you use that feature it might be easier/better to just continue using WinRAR. I love the fact that small software companies like RARLAB can still exist.

It would be incredibly sad to see them go out of business, it's such an iconic piece of software.