<story><title>Download.com and Others Bundle Superfish-Style HTTPS Breaking Adware</title><url>http://www.howtogeek.com/210265/download.com-and-others-bundle-superfish-style-https-breaking-adware/</url></story><parent_chain></parent_chain><comment><author>pdkl95</author><text>Lets say I ran a well-known business that sold a some sort of physical product.&lt;p&gt;It could be a toy, a common household tool or appliance, or anything else that is small and inexpensive. It more-or-less works as intended, but it also included a small robot. The packaging and marketing would be designed so you weren&amp;#x27;t supposed to notice the robot, but the packaging included the necessary fine print and an explanation that this robot was just there to make sure you got the &lt;i&gt;best experience&lt;/i&gt; possible for anybody that spotted this &amp;quot;extra feature&amp;quot;.&lt;p&gt;Unrelated to whatever it was that you bought, at night the robot would install a device on your phone that re-routed all your phone calls through my office (a MITM attack). The phone still works ok, except now calls to your favorite pizza deliver restaurant seem seem to be re-routed to the competitor across town. Some time later a neighbor complains that he can sometimes when he checks his voicemail, he gets your phone conversations instead.&lt;p&gt;After finishing with the phone, the robot does the same thing to your cable TV.&lt;p&gt;Some days, the robot would go through your (physical) mail and place stickers with new advertisements into your magazines. Occasionally one of those stickers would end up on your electric bill, obscuring important information. The power company has a similar logo to one of the sticker-ads, so the robot probably confused the two logos. Even if the robot didn&amp;#x27;t have any stickers to place, it would still open your mail and leave it (opened) on the ground near your mailbox for anybody to see.&lt;p&gt;If I rand a business that did this - possibly as my main (or only) product - &lt;i&gt;how long would I be able to run this scam before someone threw me jail?&lt;/i&gt;&lt;p&gt;--&lt;p&gt;Intentionally breaking TLS with a MITM attack goes &lt;i&gt;way&lt;/i&gt; beyond the usual scam&amp;#x2F;trojan. This isn&amp;#x27;t even the usual negligence that we see in the &amp;quot;security&amp;quot; of a lot of products. Creating a certificate that lets you MITM any domain is &lt;i&gt;very obviously&lt;/i&gt; a willful act.</text></comment>
<story><title>Download.com and Others Bundle Superfish-Style HTTPS Breaking Adware</title><url>http://www.howtogeek.com/210265/download.com-and-others-bundle-superfish-style-https-breaking-adware/</url></story><parent_chain></parent_chain><comment><author>michaelmrose</author><text>If only Microsoft had run with the idea of package management and trusted repos that has existed in open source for decades without restrictions that inspire people NOT to use it.  Example to release a debian repo to share your software with your users you have the option to handle hosting&amp;#x2F;payment if any yourself and keep 100% of the revenue not 70%.&lt;p&gt;Their position in the market is such that had they started pushing this around the time apt-get started to be a thing they would have had near 100% adoption and users would be used to installing everything that way and would be naturally suspicious of manual installation.&lt;p&gt;Bad actors could end up on a blacklist that users would opt to enable.  You would even have multiple black list sources from people like antivirus vendors etc.</text></comment>