undefined | Better HN

0 pointsswiley6y ago0 comments

That’s trivially easy to get around by installing you’re own CA cert when you install the driver.

This is arguably worse security wise but it makes the driver install process identical to the way it used to be as far as the average consumer can tell. This is why (IMO) free software is so important, to the point where I’ve begun to agree with the radicals and think it should be mandatory.

0 comments

stefan_6y ago

No, that's exactly not how it works. You can not change the set of root certificates.

CamperBob26y ago

How does Zadig work, then?

bri3d6y ago

There are two separate authentication processes for drivers on Windows: Authenticode, which is used for the kernel-mode driver (.sys) and is strictly enforced, and driver package signing (.cat/.inf installation packages), which has a mutable root storage called Trusted Publisher system store. Zadig works by adding its own certificate root to the Trusted Publisher system store and self-signing the installation packages, but the three possible installed drivers (WinUSB, libusb0, and libusbK) were all still signed by Authenticode.

swileyOP6y ago

> Zadig works by adding its own certificate root to the Trusted Publisher system store and self-signing the installation package

Is this different than the local CA cert list? Sorry I don’t use Windows.

1 more reply

j / k navigate · click thread line to collapse