> If you have a signed driver that you want your (non-admin) users to be
able to install, is it enough to have it in the Trusted Publisher CS?
No, I don’t care about non-admin users not being able to install drivers,
and never did. I was always referring to admins.
Of course it could open a gaping security hole. But if I remember
correctly, it is the only chance to get a more-or-less silent install.
At what cost? It is absolutely unacceptable for me to ask my customers to
mess with certificates. I’d rather tolerate the “unsigned” warning.
Besides, it is relatively easy to install an unsigned driver silently
anyway, without interfering with signature checking. Don’t ask me how, I
won’t tell.
(This seems in line with the former MS policy of “Make it work.”
Security came second. And convenience is what users actually want.)
Unfortunately, this is too far from being convenient. What’s easier - click
Continue Anyway or install a certificate?
On the other hand - if you trust a company to provide a signed driver for
the core of your system, they can be assumed to be trusted to also provide
e.g. applications. Or even certificates.
Not at all. For example, Microsoft is a big company. Different projects are
done by different people. People also tend to change with time. If I
installed an application from a company, it does not mean I trust them in
any way. Most likely, I simply did not have a choice. For the last years, I
prefer to install apps on virtual machines. This gives me some sense of
security with the inherently unsecure OS.
Another trouble is, I might trust Microsoft when it comes to THEIR OWN
software. But I definitely do not trust company X the software of which is
signed by Microsoft and installs silently. Essentially, Microsoft endorses
third party software it has little knowledge of, and allows silent install
of such software. IMHO, it’s a major breach of security.
(Rhetorical / mocking / funny question:)
Hmmm… beats me… do they possibly get any money for it?
Or is a WHQL signature free? 
No, it is not. Both Microsoft and Verisign are getting money. But I have to
admit Microsoft is better. They take less money for more. Verisign takes
much more for nothing, just because they have a monopoly agreement with
Microsoft.
On the other hand - you already trust M[company] to provide an operating
system that you entrust vital (e.g. business) information to be handled
correctly by.
I don’t trust them. But I have no other choice.
What proof have you got that your (e.g. confidential) information is kept
confidential? And not sent by the OS to the XXX, YYY or ZZZ government
authority?
Then you can also trust them to decide - after some reasonable testing -
to sign a driver from a third party company and thus give you a “silent”
installation archive.
I would like to minimize the risks. If I have a dubious inherely unsecure OS
installed, it does mean it won’t be any worse if I additionally install
loads of other rubbish.
> I want all software signed my Microsoft to produce by default the same
> warning prompts as the software signed by any other non-Microsoft
> company, so that I could make my choice.
Not possible. Example: happily installing on a fresh system (aka IPL):
See above. There’s
- Software from Microsoft signed by Microsoft which comes with the
operating system. If I agreed to install OS, I don’t need any futher
warnings.
- Software from third parties signed by Microsoft which comes with OS. OK,
I agree that that rubbish can be installed silenly, even though I won’t use
99.999% of it.
- Software from Microsoft signed by Microsoft, which comes separately from
OS, like Windows Updates etc. Currently, I have to agree to the terms before
installing it - that’s OK.
- Software (drivers) from third parties signed by Microsoft, which comes
separately from OS. Under no circumstances it should be able to install
silently. According to Microsoft, currently this software can be silently
installed.
As far as I understand M[company], user mode software is supposed to
ususally run in user mode (surprise!), without ADMIN or SYSTEM rights.
You are missing my point. There is user mode software running with admin
privileges and there are drivers. Both types of the software can easily
screw up the machine. Then why are there two different signature policies?
Let’s put it simple. I am a driver developer. And I care about my customers.
I want them to be secure. I want to sign my software and I do so whenever
possible. But for some reason I feel like avoiding and or actively resisting
the driver signing policy being pushed by Microsoft, for as long as I can
and for as long as it’s commercially viable.
Be careful with spreading this reasonable argument.
Otherwise it might be that in the next M[company] OS release “Admin”
accounts can only start WHQL signed software packages.
This will definitely happen if everyone keeps happy silence. I have a small
hope that somebody from Microsoft will read this, and another hope (though
even smaller one) that because of this the things will eventually get
better.
Cheers
–
“Hagen Patzke” wrote in message news:xxxxx@ntdev…
> cristalink wrote:
>
>> The Trusted Root Certification Authorities (TRCA) certificate store, by
>> definition, should contain only TRUSTED Certification Authorities’
>> certificates.
>
> Absolutely my opinion.
> I just stated what I glanced from the documentation and the system
> behaviour - call it the “observerd MS intent”.
>
>
>> The publisher’s certificate should not be placed into TRCA as
>> http://www.microsoft.com/whdc/winlogo/drvsign/drvsign_perOS.mspx
>> suggests.
>
> If you have a signed driver that you want your (non-admin) users to be
> able to install, is it enough to have it in the Trusted Publisher CS?
> It should be, of course. But does it work?
>
>
>> This statement is truly amazing. Why would anyone in their right mind
>> install a certificate from an unknown source into TRCA? This would
>> essentially legitimate all certificates issued by that unknown source.
>
> Of course it could open a gaping security hole. But if I remember
> correctly, it is the only chance to get a more-or-less silent install.
> (This seems in line with the former MS policy of “Make it work.”
> Security came second. And convenience is what users actually want.)
>
> On the other hand - if you trust a company to provide a signed driver for
> the core of your system, they can be assumed to be trusted to also provide
> e.g. applications. Or even certificates.
>
>
>> I am a customer and I sometimes install drivers on my machine. I don’t
>> understand why company M[icrosoft] marks all software originated from
>> whoever but signed by some WHQL, whatever that acronym means, trustworthy
>> by default without my consent.
>
> (Rhetorical / mocking / funny question:)
> Hmmm… beats me… do they possibly get any money for it?
> Or is a WHQL signature free?
>
>
> On the other hand - you already trust M[company] to provide an operating
> system that you entrust vital (e.g. business) information to be handled
> correctly by.
>
> What proof have you got that your (e.g. confidential) information is kept
> confidential? And not sent by the OS to the XXX, YYY or ZZZ government
> authority?
>
> Then you can also trust them to decide - after some reasonable testing -
> to sign a driver from a third party company and thus give you a “silent”
> installation archive.
>
>
>> I want all software signed my Microsoft to produce by default the same
>> warning prompts as the software signed by any other non-Microsoft
>> company, so that I could make my choice.
>
> Not possible. Example: happily installing on a fresh system (aka IPL):
>
> “New device MOUSE detected. … MOUSE driver is signed by M[company].
> Do you trust this company? [OK] [CANCEL]”
>
> …which then fails because you don’t have a mouse driver for the mouse
> you use to klick onto the [OK] button. Nor a keyboard driver…
>
>
>> Really? Are you saying that one cannot easily write a piece of user mode
>> software which, once started with administrative rights, cannot screw up
>> the machine completely?!
>
> If you start something as Administrator, of course you can.
>
> If you pull the trigger of a loaded and armed weapon, of course you can
> shoot yourself in the foot.
>
>
> (If the OS is buggy, you can also do this without Admin rights. 
)
>
>
>> So the question remains: How are drivers principally different from user
>> mode software running under an admin account, so that the drivers need
>> to be signed by Microsoft+Verisign, but the user mode software can be
>> signed by anyone+any trusted CA?
>
> As far as I understand M[company], user mode software is supposed to
> ususally run in user mode (surprise!), without ADMIN or SYSTEM rights.
>
>
> Be careful with spreading this reasonable argument.
> Otherwise it might be that in the next M[company] OS release “Admin”
> accounts can only start WHQL signed software packages.
>
> With DRM enforcement I see this actually coming in the not too far future.
>
>
>
> Thanks for the nice conversation. -H
>