Issuer: C=US, O=DigiCert Inc, OU= CN=DigiCert SHA2 High Assurance Server CA Signature Algorithm: sha256WithRSAEncryption On any computer with BattleNet installed and active go to this url:Īnd currently it uses this certificate. Your PC? (Yes, theoretically there are, but the risks seem to way outweighīlizzard went to DigiCert and got another certificate instead: Should be able to quietly access services running on various TCP sockets on It will also kill of a lot of use cases that should probably be killed.įor example, is there ever a legitimate reason that visiting a website Software companies to get certificates like this. That change to the browser will kill the use case that keeps causing Time, under any further conditions via connections to any IP endpoint on IP endpoint on the local host were unable to load any sub-resources, any It would be incredible if a page that loads from a URI not resolving to an These certs started being used because Chrome would not allow WSS Simple control over the software on the PC. The rich-client is installed and if so, what version. They use this for things like determining whether Website is able to cause the browser to load resources from the daemon on When a user in a regular browser comes across an appropriate website, that The idea is that rich-client software on the PC has a daemon running in theīackground on one of a number of chosen TCP ports. I think the technique is repugnant garbage that the In any case: If you are aware of other software doing something alike (Full disclosure: DoingĪnything on a Windows system is not my strength.) (grep), but it is almost certainly possible. I also was not able to extract the private keys with simple methods Haven't seen any reports of breakage (I checked twitter for signs of Information about what these local connections were used for, if theyĬhanged anything and if anything broke due to the revocations, but I Ports after running the software that were served with TLS.)īoth certificates have been revoked. (Which doesn't mean it's not there - but I didn't see open I brieflyĬhecked other gaming software (steam, uplay), but didn't find anythingĪlike. Refer to examples from the past that are already known. I also heard a claim that "everyone does this", however this seemed to I learned that there's a practically identical issue with I talked to Tavis, reported the issue to the CA and to Mozilla'sīugtracker. Making it obvious that the private key is part of the software. The content is served via HTTPS with a valid cert, that points to localhost, allowing the software to What's happening here: The software by Blizzard has a domain
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |