Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Information on the revocation of WinRAR 5.91 digital certificate

rarlab.com

Post reply on HN
Print view View original

71–80 of 156 posts

Re: Information on the revocation of WinRAR 5.91 digital certificate

#71

Post by joshspankit »

t0mas88 wrote: post #16
xacky wrote: post #11

With both Windows and MacOS both putting scary warnings and hard to bypass blocking methods on improperly signed software this could eventually lead to developers being ransomed, “pay us big money or we will revoke your certificate”. This is not the only incident like this.

That would also be possible for a successful website or app using pinning. So far there are no public reports of it happening. Would probably also put the CA out of business in no time if they did.

For now.

It’s very easy to see two steps ahead on this

Re: Information on the revocation of WinRAR 5.91 digital certificate

#73

Post by batch12 »

pimterry wrote: post #24

> We think that revoking certificates based on questionable data discredits the certification system. It's hard to dispute this imo. There are many good reasons certificates should be revoked, but the reasoning should be 100% public information, for both the vendor and users who may have trusted the original certificate. I'm building a desktop app, and the process to even get a certificate is absurd. Each CA has thei…

I agree that it would be nice to have a letsencrypt for code. The biggest hurdle I see is getting the the root trusted by OS vendors. While not impossible (the browser vendors did it), trust on these platforms may be a bigger issue since the code runs natively.

Re: Information on the revocation of WinRAR 5.91 digital certificate

#74

Post by joshspankit »

EricE wrote: post #61
phreack wrote: post #30

Earlier quoted context omitted.

Apple is effectively doing this to Epic and others, but it could be done by any agreement of enough CA's as well.

Epic violated the agreements they signed with Apple. Whether or not we care for the contents of the agreements is a separate issue. Apple did not capriciously act against Epic - if they had then Epic wouldn’t have had an advertising campaign and lawsuit ready to go within hours. The situation with WinRAR is completely different and it doesn’t help anything in trying to conflate the two; indeed it just muddies the wat…

I’d argue that it’s more similar than it seems, but with one caveat: Apple (rightfully) became the market leader, but is essentially running what should be a public market.

If one company took over all the physical land on the planet, and had everyone sign agreements to essentially pay taxes to them with every transaction, would we still argue that that’s not only legal, but morally justified?

Re: Information on the revocation of WinRAR 5.91 digital certificate

#75

Post by asdfasgasdgasdg »

gruez wrote: post #51
asdfasgasdgasdg wrote: post #33

Earlier quoted context omitted.

There's another aspect of this situation that also discredits the system: that they can just go out and get a different cert from another vendor. How many such vendors are there? How long would it take for an actual bad actor to have all their certs discovered and revoked? If that time is long, then the certification process is of even more dubious value, since the bad guys would not be materially hindered by the cer…

"Security-in-depth": https://news.ycombinator.com/item?id=24193087

On some level I get it but aren't cash cards a thing? What actual level of identity and KYC do these cert companies do? How easy is it for someone without scruples to get another cert without revealing their identity? (Genuine questions: I do not personally know.)

Re: Information on the revocation of WinRAR 5.91 digital certificate

#76

Post by tgsovlerkhgsel »

asdfasgasdgasdg wrote: post #33
pimterry wrote: post #24

> We think that revoking certificates based on questionable data discredits the certification system. It's hard to dispute this imo. There are many good reasons certificates should be revoked, but the reasoning should be 100% public information, for both the vendor and users who may have trusted the original certificate. I'm building a desktop app, and the process to even get a certificate is absurd. Each CA has thei…

There's another aspect of this situation that also discredits the system: that they can just go out and get a different cert from another vendor. How many such vendors are there? How long would it take for an actual bad actor to have all their certs discovered and revoked? If that time is long, then the certification process is of even more dubious value, since the bad guys would not be materially hindered by the cer…

The job of a certificate authority is to verify an identity, not to vet that the holder is using the certificate only for good.

As long as the CAs do that job (which is a separate issue), it's fine if John Doe can get 50 different CAs to certify that he is, indeed, John Doe.

Re: Information on the revocation of WinRAR 5.91 digital certificate

#77

Post by londons_explore »

skymt wrote: post #42
akersten wrote: post #27

> another explanation, i.e. that one reason for the revocation is some mysterious 570 MB executable file, which had been signed with our certificate but looked like a file used by hackers. Woah, talk about burying the lede? This sentence makes it sound like their private key was compromised, in which case it makes total sense to revoke the cert. Unless I'm misunderstanding what they're trying to say here.

You are misunderstanding. WinRAR's implication is that the CA is lying about the 570 MB file because they didn't mention it until WinRAR challenged them on the VirusTotal justification for revocation, and because they were unable to provide the file in question or any evidence that it exists.

Why not at least link to the virustotal listing for said file? Perhaps someone else has it from the hash?

I doubt the CA would lie about the existence of such a file, although perhaps they are mistaken about the signature (it could be a case of a 570 MB file concatenated with a legitimately signed winrar executable - signatures don't always cover all parts of the file)

Re: Information on the revocation of WinRAR 5.91 digital certificate

#78

Post by luckylion »

LorenPechtel wrote: post #6
breakfastduck wrote: post #5

I know the authorities need to err on the side of caution, but it's quite astonishing to me that someone at the authority didn't just say 'It's WinRAR...' and let it slide. It's got to be one of the most well known tools in the entire windows ecosystem.

If it were just the file not being clean on Virustotal I would fully agree. Heuristic detection will result in false positives. However, if they had an actual example of malware signed by that key that would indicate a compromise and that would justify pulling it. The absence of the offending file is suspicious, though.

If they had an example, they would've never deleted it though. I mean, that part is so unprofessional, it's rude to believe are that incompetent, the polite explanation is that they lied about it.

Re: Information on the revocation of WinRAR 5.91 digital certificate

#79

Post by Arnavion »

Santosh83 wrote: post #39

It is particularly ironic that so many people in this thread are recommending 7-zip in response to a cert problem with WinRAR when 7-zip has no code signing at all and presents the scary yellow "unknown software" screen when you try to install it.

The scary yellow screen that everyone clicks through anyway. I don't think 7zip needs to worry about that harming its adoption.

Codesigning is a protection racket, and FOSS should not feel pressured to participate in it.

Re: Information on the revocation of WinRAR 5.91 digital certificate

#80

Post by tgsovlerkhgsel »

gruez wrote: post #29

The CA in question is CN = Sectigo RSA Code Signing CA

This is the most important information in this. Other people who are looking for code signing certificates should use this information to choose their CA.

From the view of the certificate holder, the CA has one job: Keep their certificate valid. Everything else (including the trustworthiness of the CA, e.g. whether they issue false certificates) only matters insofar as it affects that job (if the CA were to screw up up badly enough to get removed from certificate stores, the certificate also becomes invalid, but other than that, the certificate holder doesn't really care how the CA acts).

By relying on a CA known to take such action (whether justified or unjustified), you're putting the continued usability of your software at risk, i.e. there is a strong reason to pick any other trusted CA.

Post reply on HN