[flagged]
Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
21–30 of 123 posts
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#22Why are they deploying their own certificate into the root store???? This is shocking behaviour. What's the difference between this and malicious software.
the problem is not that they add a root ca to the store. the problem is that they use the same Root CA on every computer in the world AND adding it into the Store AND having the Root CA PRIVATE KEY on ANY computer.
> the problem is not that they add a root ca to the store.
Yes there is. There is no valid reason for a glorified headphone driver to mess with what website your browser trusts.
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#23Have any hardware companies ever written good accompanying software? From all the custom-ui graphics card config nonsense to utilities that phone home of their own accord, to things like this which are laughably awful. I feel glad I left for the mild shores of Linux in the early 00s.
Apple?
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#24> the software was also installing a root certificate into the Trusted Root CA Certificate store. This kind of stuff shouldn't even be legal.
As a bit of a layman, is there even any legitimate reason at all (other than a user installing it in their own machine for reverse engineering purposes) for anyone to install a root certificate anymore? I could understand it if it was a small company doing so at the time when certificates were expensive, but Sennheiser has plenty of money and certificates can be obtained for free nowadays.
Nobody will issue Sennheiser a certificate for this purpose. Every so often a company abuses a cert they were issued to do what Sennheiser wanted to achieve here (local loopback HTTPS) and when they're caught the cert is revoked and they get a slap on the wrist. Blizzard is a recent example.
The Right Thing (TM) is to not do HTTPS, a modern web browser is supposed to conclude that ::1 and 127.0.0.1 are secure without HTTPS since there is no possibility of a "man in the middle" of your own computer's loopback.
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#25Earlier quoted context omitted.
It's perfectly normal to install new root certificates - for example, so that a company can sign internal websites (or for MITM proxies). It's incredibly shady to have random software install into your trust store.
As someone that has been burned by self signed internal only sites. Take the extra 15 minutes and get a proper cert, and domain name for your internal sites. It can save a massive amount of pain later.
burned how exactly?
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#26Earlier quoted context omitted.
I have to STRONGLY disagree. It's a slippery slope towards a world in which the computers we use are completely locked down and we have no control over what they trust, being dictated by the corporations and their interests. The freedom to modify your roots of trust is extremely important and situations like this should not scare us into depriving ourselves out of that. I say this as someone who runs an adblocking/fi…
The law doesn't have to lock it down though. Software companies should be accountable for putting users at risk in this way, it should not be legal to install fundamentally insecure software without explicit permission from the user.
Did it not ask for permission? "Type in your admin password to install?"
This seems like an OS problem to me. I wish Apple and MS would clamp down on allowing apps to even ask for root to install. I don't think the OS should be as locked as iOS, as a user I still want control, but the fact that so many apps ask for root to install needs to be stopped. 99.9% of all apps need to be sandboxed
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#27This seems like pure laziness. Did the developers really not have an understanding of basic PKI? Or did they realize late in the game that their local web socket was gonna require HTTPS and slap this on at the last minute?
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#28HN discussion and original report - https://news.ycombinator.com/item?id=18550854
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#29> the software was also installing a root certificate into the Trusted Root CA Certificate store. This kind of stuff shouldn't even be legal.
I have to STRONGLY disagree. It's a slippery slope towards a world in which the computers we use are completely locked down and we have no control over what they trust, being dictated by the corporations and their interests. The freedom to modify your roots of trust is extremely important and situations like this should not scare us into depriving ourselves out of that. I say this as someone who runs an adblocking/fi…
No you don't disagree. The comment you're responding to doesn't say users shouldn't be free to add whatever root certificate they want. Of course they should.
What should be illegal are programs that silently add a root certificate without the user's informed consent. I very much doubt you disagree with that.
Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks
#30> the software was also installing a root certificate into the Trusted Root CA Certificate store. This kind of stuff shouldn't even be legal.
I have to STRONGLY disagree. It's a slippery slope towards a world in which the computers we use are completely locked down and we have no control over what they trust, being dictated by the corporations and their interests. The freedom to modify your roots of trust is extremely important and situations like this should not scare us into depriving ourselves out of that. I say this as someone who runs an adblocking/fi…
In practice the corporation "dictating" the set of publicly trusted CA roots is the Mozilla Foundation, a 501(c)(3) non-profit with a large volunteer effort.
On paper all the major browser vendors / operating system vendors (Microsoft, Apple, Google, Mozilla) have independent root trust programmes. But after several years working on this stuff I would say that all real public oversight is done by Mozilla, which AFAICT suits everybody else just fine.
So you can and should help Mozilla "dictate" what is trustworthy. You might be surprised how much difference you can make.
The libertarian dream solution (everybody makes their own trust decisions somehow) is unrealistic in the face of the reality that most people just vaguely assume that "someone" is keeping them safe and lack both the technical knowledge and the spare time to make useful decisions.