Re: A mighty fortress is our PKI, Part II

2010-08-06 Thread Anne & Lynn Wheeler
Zeus malware used pilfered digital certificate http://www.computerworld.com/s/article/9180259/Zeus_malware_used_pilfered_digital_certificate Zeus Malware Used Pilfered Digital Certificate http://www.pcworld.com/businesscenter/article/202720/zeus_malware_used_pilfered_digital_certificate.html & Z

Re: A mighty fortress is our PKI, Part II

2010-08-06 Thread James A. Donald
On 2010-08-05 11:30 AM, David-Sarah Hopwood wrote: > Signatures are largely a distraction from the real problem: that software > is (unnecessarily) run with the full privileges of the invoking user. > By all means authenticate software, but that's not going to prevent malware. A lot of devices

Re: A mighty fortress is our PKI, Part II

2010-08-06 Thread Tom Ritter
> And what else should Windows say? "We put this through our time machine and > noticed that at some time in the past it was signed and now it isn't"? Absolutely, on initial install there's no way to know it was originally signed (if you're smart about it). But in another architecture Microsoft