Dell does a Lenovo

[ScaredyCat]

[DrSnoosnoo]

I r compooter noob. What does this mean? Is it a snooping device?
____________________
I'm Sam; Northern, Ginger, Lover
Did have: '95 ZZR600 '83 CG125 '97 ZZR1100 '15 Hypermotard 821 SP Do Have: '10 ZX10R

[DrDonnyBrago]

https://en.community.dell.com/dell-blogs/direct2dell/b/direct2dell/archive/2015/11/23/response-to-concerns-regarding-edellroot-certificate

[ScaredyCat]

[J.M.]

[Polarbear]

Which way round?

If I have a Dell I can see what others do or if I have a Dell, others can see what I do?
____________________
Triumph Trophy Launch Edition

[J.M.]

I haven't fully read in to it, so I can't comment for certain.

A certificate is created by a signing body and added to a computer. A website will be signed by one of the signing bodies in order to use HTTPS.

When you go on a HTTPS website, your computer verifies the website's certificate by using the signing body's certificate that is on your computer. If you don't have the signing body's certificate, you will get an error. If the website's certificate is wrong or tampered with, you will get an error.

This Dell certificate is another signing body certificate. It can be used to create valid certificates for websites. This means that whoever owns the dell certificate is able to create a certificate for any HTTPS website.

This means that person can sit in the middle of a connection between say you and the bank, and your computer would have no idea, because they can present to you a valid certificate because the Dell certificate verifies it.

These certificates by the signing body work in two parts:
- public key
- private key

The signing body will sign the certificate to the website with their private key. The public key is on your computer and you decrypt the message using their public key to verify it. (Note this is the opposite way around than encrypting a message).

ScaredyCat's screenshot clearly shows that the private key for the signing certificate is on each computer. This means that anybody can create a certificate for a website and the dell computer will accept it.

This is assuming that Dell hasn't generated a unique key for each system produced, which I would find highly unlikely.

Even if the company didn't have bad intentions, as their official comment states, this is exactly the reason why companies need to hire people that actually understand the security implications of their actions, rather than hiring just programmers.

tl;dr if you're smart, you'll probably be able to see what others do. Others will be able to see what you do too (unless you remove the certificate).
____________________
2004 R1 & 2018 XSR900

[CaNsA]

But wait, there's more.

https://www.theregister.co.uk/2015/11/25/dsdtestprovider/