Lenovo pre-installs PCs with HTTPS hijacking adware
-
how do we know hardware is not already compromised too right from get free of charge ??
-
To me this speaks volumes to what Lenovo thinks about their customers.
Not that all manufacturers don't hate us but need our $$ so we're a necessary evil, Lenovo got caught.
RSA got caught too and nobody cares, so…
-
I always wondered about the big blue split. Seemed mighty strange at the time. Maybe in 40 years we will get the truth…
Anybody remember this:
http://www.washingtonpost.com/wp-srv/politics/special/campfin/stories/circuit070898.htm -
I remember extremely clearly…
-
Even Homeland Security is "urging" Lenovo customers to remove it
http://yro.slashdot.org/story/15/02/20/2357234/homeland-security-urges-lenovo-customers-to-remove-superfish
-
The rabbit hole goes even deeper :o :o
http://www.securityweek.com/superfish-ssl-interception-library-found-several-applications-researchers
-
Oh how wonderful…
-
And it would be good if this class action scared other companies into removing some of the pre-installed crapware from their distributions:
http://www.law360.com/articles/623675/lenovo-hit-with-class-suit-over-pcs-preloaded-spywareMaybe it is time to get serious about jumping from the Windows ship?
-
I would have expected that you would already have jumped ship for the most part.
You seem like such a smart guy.
-
Maybe it is time to get serious about jumping from the Windows ship?
Yeah because you can't do this in FreeBSD or Linux? Why would you blame Microsoft for a Lenovo issue? Seems like the Chinese have learned something from us, greed!
-
I think Microsoft is a known offender by now. Too many complicated holes for it to be an accident.
-
So is Google, Linkedin, Facebook and all the other almost free shot on the interwebs….
Get off, live your life and give a fuck!
-
The real problem is the CA trust model, when we live in a world where you can trust no one. But then you have to trust someone other wise you might as well live on a deserted Island.
-
I can agree with that - It is an issue.
-
But then you have to trust someone other wise you might as well live on a deserted Island.
I'd rather trust myself than funding the CAs bullshit business.
-
Same here
-
-
Which is worse… McAfee or viruses.... Damn its a tough call...
-
I think this article has a good view of the problem.
http://www.computerworld.com/article/2894233/web-browsers-are-also-to-blame-for-lenovos-superfish-fiasco.html -
@Phishfry:
I think this article has a good view of the problem.
http://www.computerworld.com/article/2894233/web-browsers-are-also-to-blame-for-lenovos-superfish-fiasco.htmlNah. The browsers need to implement TLSA/DANE. Noone will ponder which CA is supposed to sign which certificate for whom; the server owner should tell the client behind the scenes. The average Joe does not understand the details and does not care. CAs should provide enhanced validation and that's it. This BS about "oh baaad boy, you are using self-signed certificate/your own CA -> lets nag the shit out of anyone trying to use HTTPS with your website" needs to end.
