HackerTrans
TopNewTrendsCommentsPastAskShowJobs

vandalism

no profile record

Submissions

Game launcher installs Root CA certificate on your machine (2024)

github.com
61 points·by vandalism·10개월 전·22 comments

comments

vandalism
·10개월 전·discuss
There has been a new GitHub release in April of this year, however, it seems to have been made by a member of the community along with the commit it includes, instead of the original creator.

Edit: There seems to be activity on the author's account which points to the conclusion that they are aware of the issue and are making (still at least somewhat questionable) changes for a new (unreleased?) version of the launcher to address the problem.

https://github.com/Zacam/SBRW.Launcher.Net/commit/f09d911fca...

As far as I am aware the launcher repo I linked in the original post is still the main launcher players use for the game, meaning people are still getting the certificate permanently installed.
vandalism
·10개월 전·discuss
This assumes that all users are informed enough to make such decisions.

You cannot expect the average player of an online game to have the technical knowledge necessary to discern whether a piece of software is safe to use or not. Even if you could, you'd also be expecting them to take the time to do a proper analysis of such software, which I do not think is a reasonable premise.

What's more, this is open-source software we're talking about and you can actually relatively easily perform meaningful security checks; imagine if this were not the case.
vandalism
·10개월 전·discuss
The certificate is used for nothing more other than checking whether the launcher is "signed". The whole scheme is full of security holes, the certificate check mostly seems like it was a programming exercise for the author.

There is no need for the certificate installation with regards to any emulation functioning. Also, worth noting that this is an ongoing issue: this reboot of the game still has a decent daily player count and the CA installation concern has not been addressed, the launcher still does this.

(It's also not a server emulator, it's just a launcher for the game client, used by players of the game.)