Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

bug1134506.bugzilla.mozilla.org

Post reply on HN
Print view View original

121–130 of 188 posts

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#121

Post by TeMPOraL »

wongarsu wrote: post #111
cpeterso wrote: post #91

Earlier quoted context omitted.

Are compromised machines on your corporate network a common problem? It seems like the problem is the compromised machines, not the phoning home. :)

It's called defence in depth. If you can prevent 99% of malware infections and can prevent 75% of malware from phoning home, you have a 99.75% confidence (1 in 400) of not having a data leak due to a compromised machine. That's 4 times better than only preventing infections.

I'm pretty sure the real reason is managers not wanting their employees to do private browsing while at work.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#122

Post by nikital »

lstamour wrote: post #46
hurin wrote: post #12

Earlier quoted context omitted.

I'm somewhat puzzled by the single certificate. Couldn't they have generated a new signing request and self-signed on each machine - at least ensuring that each customer has a unique cert for their proxy?

These guys aren't the brightest bulbs out there. You could even have it switch certificates on every reboot... or not do this in the first place. ;-)

> or not to do this in the first place.

Are there other options besides installing my own root certificate?

Assuming I want to write software that legitimately MITMs all HTTP and HTTPS traffic (parental control, ad blocker, anti-virus scan for webpages...). I want it to be browser independent and work with browsers that don't support extensions.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#123

Post by evilpie »

TeMPOraL wrote: post #120
armb wrote: post #112

Earlier quoted context omitted.

If the user installs a Firefox update and then all their HTTPS connections stop working, most users will blame Firefox unless the error messages are very specific about Lenovo's involvement, which simple blacklisting won't do. Users who follow technical news and understand the problem will already have removed the certificate manually (and removed the proxy).

I doubt it. Most non-techie users will probably not get around to installing another browser, so seeing that neither bank nor gmail nor facebook works, they'll blame their ISP.

But most people already have IE installed!

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#124

Post by busterarm »

remarkEon wrote: post #70
emehrkay wrote: post #57

Computing is genuinely becoming scary. If I didn't browse tech sites or spend my days on HackerNews, I probably wouldn't know about these things. I'm getting older and more disinterested in the constant maintenance -- I just want the shit to work. It sucks the most for those who learned "don't install anything fishy, run a virus scan, don't open attachments, and you'll be fine." They bought a computer and followed th…

This. I can tell several stories of trying to set things up for my parents, only to have to call them/wait until I fly home next to fix something. Lessons have been learned the hard way on dumb email chains/anti-virus software, but trying to give them a list of browser settings (among other things) to do is getting to be too much. So, now what?

I'm in this situation too.

We're at an impasse now too where my mom wants a new laptop. She doesn't want to learn anything new (Mac OS) and both she and I don't want to deal with Windows 8+. I'm skeptical about just installing Windows 7 on a newer laptop (...driver/hardware support).

If I could get her to switch to Mac (she's in her 70s), I could set her up with a non-admin user account and set it up easily so that I can securely do remote support. The funny thing is that she would probably do it if not for my brother, who does support for a living and doesn't want to learn to fix Macs...smh

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#125

Post by 300bps »

userbinator wrote: post #76
emehrkay wrote: post #57

Computing is genuinely becoming scary. If I didn't browse tech sites or spend my days on HackerNews, I probably wouldn't know about these things. I'm getting older and more disinterested in the constant maintenance -- I just want the shit to work. It sucks the most for those who learned "don't install anything fishy, run a virus scan, don't open attachments, and you'll be fine." They bought a computer and followed th…

I've convinced many people to do clean installs on new computers - my reasoning usually goes like "the software it comes with is suitable for demos in the store; when you start using it, you should clean that out and install your own." It used to be relatively easy to do a full reformat+install of the OS and drivers; not sure whether that's gotten easier or harder now.

If you buy a computer from the Microsoft Store it is guaranteed to have no crapware, trialware or any other junk on it. If you buy a computer from somewhere else and take it to the Microsoft Store they will place a clean operating system on it for $99.

For technical people of course, it is no big deal to install the OS yourself, but I have to say it was nice getting my last HP notebook without a single thing I had to uninstall.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#126

Post by ptaipale »

busterarm wrote: post #124
remarkEon wrote: post #70

Earlier quoted context omitted.

This. I can tell several stories of trying to set things up for my parents, only to have to call them/wait until I fly home next to fix something. Lessons have been learned the hard way on dumb email chains/anti-virus software, but trying to give them a list of browser settings (among other things) to do is getting to be too much. So, now what?

I'm in this situation too. We're at an impasse now too where my mom wants a new laptop. She doesn't want to learn anything new (Mac OS) and both she and I don't want to deal with Windows 8+. I'm skeptical about just installing Windows 7 on a newer laptop (...driver/hardware support). If I could get her to switch to Mac (she's in her 70s), I could set her up with a non-admin user account and set it up easily so that I…

Windows 7 is going to be absolutely fine. If it's what she's used to, and you have the license and media, just go ahead.

And something like TeamViewer does the remote support nicely.

I'm all for Linux otherwise, but in this use case I'd let old people use whatever keeps them going.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#127

Post by agapos »

jedanbik wrote: post #35

Not only did I have to remove the certificate from my root authority in the control panel, I also had to remove it from my list of certificates in Firefox. This was after uninstalling Superfish. Once I did all of these things, and cleared my history and cache and all that, the website that folks have been linking said that it didn't detect Superfish (sorry, I'm typing this from a phone). So my explanation wasn't very…

Here is a bit of article on Foxes and Fishes: http://arstechnica.com/security/2015/02/how-to-remove-the-su...

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#128

Post by busterarm »

ptaipale wrote: post #126
busterarm wrote: post #124

Earlier quoted context omitted.

I'm in this situation too. We're at an impasse now too where my mom wants a new laptop. She doesn't want to learn anything new (Mac OS) and both she and I don't want to deal with Windows 8+. I'm skeptical about just installing Windows 7 on a newer laptop (...driver/hardware support). If I could get her to switch to Mac (she's in her 70s), I could set her up with a non-admin user account and set it up easily so that I…

Windows 7 is going to be absolutely fine. If it's what she's used to, and you have the license and media, just go ahead. And something like TeamViewer does the remote support nicely. I'm all for Linux otherwise, but in this use case I'd let old people use whatever keeps them going.

Yeah, it's just an insecure mess.

She always makes a mess of Windows machines. If her first instinct weren't always to call my older brother for help, I'd have gotten her the Mac ages ago.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#129

Post by masswerk »

Shouldn't the content providers strike back, in order to stop such things as a business? E.g., a class action against those vendors who pre-install said software. Determine the average share of traffic of these machines, use average Adsense-earnings to determine the damage ... Globally, this might add up to something that would be suitable to take even a major corporation out of business ...

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#130

Post by higherpurpose »

emehrkay wrote: post #57

Computing is genuinely becoming scary. If I didn't browse tech sites or spend my days on HackerNews, I probably wouldn't know about these things. I'm getting older and more disinterested in the constant maintenance -- I just want the shit to work. It sucks the most for those who learned "don't install anything fishy, run a virus scan, don't open attachments, and you'll be fine." They bought a computer and followed th…

Oh no, I'd say this is still mildly scary. Wait until cars get the same computing capabilities. Then you should fear it - fear for your life even.
Post reply on HN