It's not clear why "Authenticode bypass" was the first (and in some cases the only) thing that people jumped on with this X.509 verification bypass vul.
Ho, by the way, #curveball #cve20200601 is not only about TLS & Authenticode... it's also for S/MIME and other signatures.
Yes, it's also valid against #Outlook mail signature verification 
I hope nobody rely on it for legal / workflow validationpic.twitter.com/xds8l2gSIL
-
-
-
Maybe because it's (now) more complicated to bypass 'from' validation between secure and well configured SMTP servers (not always, of course)
- Još 3 druga odgovora
Novi razgovor -
-
-
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
SmartCards? :)
-
Unlikely, maybe in a very specific environment. But most of these are still on RSA and unlikely to allow for private roots.
- Još 1 odgovor
Novi razgovor -
-
-
Any Windows application from Microsoft that calls CertGetCertificateChain will be affected. And yes, all Microsoft apps that use PKI use this library.https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-certgetcertificatechain …
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Omg!!
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.