Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!nntp.club.cc.cmu.edu!micro-heart-of-gold.mit.edu!bloom-beacon.mit.edu!bloom-beacon.mit.edu!panix!MIX!Blackbird From: billy@MIX.COM Newsgroups: comp.sys.mac.system Subject: Re: OT: Lenovo does it for you! Date: Mon, 23 Feb 2015 18:27:50 +0000 (UTC) Organization: PANIX Public Access Internet and UNIX, NYC Lines: 43 Message-ID: References: <1m03c1f.13oxmg919lkst6N%nmassello@yahoo.com> <54e65960$0$54687$c3e8da3$fdf4f6af@news.astraweb.com> NNTP-Posting-Host: panix5.panix.com X-Trace: reader2.panix.com 1424716070 12532 166.84.1.5 (23 Feb 2015 18:27:50 GMT) X-Complaints-To: abuse@panix.com NNTP-Posting-Date: Mon, 23 Feb 2015 18:27:50 +0000 (UTC) Xref: csiph.com comp.sys.mac.system:70146 JF Mezei writes: > This is one of the HUGE advantages Apple has over competition for both > computers and iDevices. No manufacturer or wireless network allowed to > add thyeir bloatware onto the Apple device and everyone gets the same OS > irrespective of whom they bought the device from. Everyone also gets the same web browsers - http://www.chromium.org/Home/chromium-security/security-faq #TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- | Chrome does not perform pin validation when the certificate | chain chains up to a private trust anchor. A key result of this | policy is that private trust anchors can be used to proxy (or | MITM) connections, even to pinned sites. "Data loss prevention" | appliances, firewalls, content filters, and malware can use this | feature to defeat the protections of key pinning. | | We deem this acceptable because the proxy or MITM can only be | effective if the client machine has already been configured to | trust the proxy's issuing certificate - that is, the client is | already under the control of the person who controls the proxy | (e.g. the enterprise's IT administrator). If the client does not | trust the private trust anchor, the proxy's attempt to mediate | the connection will fail as it should. https://www.eff.org/deeplinks/2015/02/further-evidence-lenovo-breaking-https-security-its-laptops : The fact that there are significant numbers of Firefox victims : somewhat contradicts the speculation that Firefox is safe because : it doesn't use the Windows root store. This either indicates : that Superfish also injects its certificate into the Firefox : root store, or that on a large number of occasions Firefox : users have been clicking through certificate warnings caused : by Superfish MITM attacks. Billy Y.. -- sub #'9+1 ,r0 ; convert ascii byte add #9.+1 ,r0 ; to an integer bcc 20$ ; not a number