1

Anyone can purchase a code signing certificate. They are cheap and do not involve much validation. Yet Oracle must have determined that disabling execution of unsigned applications increases security.

Does it really, and what is the mechanism that leads to increased security? (other than the fact that any mechanism that blocks a random subset of applications will invariably block some malware too by pure chance)

Improve this question

1 Answer 1

Reset to default
2

A few reasons:

  • Buying a certificate would leave a paper trail, allowing malware to be more easily backtraced to the person that paid for the certificate.
  • It increases the barrier to entry for creating malicious Java applets, because of the cost.
  • I believe CAs (e.g. VeriSign) require you to provide evidence that you are a legitimate provider of software.

That being said, you're touching on a major problem with PKI: you have to rely on CAs being infallible and trustworthy.

Improve this answer
2
  • The other major problem is that the owners of the certificate get compromised. Trusted but stolen code signing certificates a regularly misused to sign malware.
    – Steffen Ullrich
    Mar 19, 2015 at 19:23
  • It appears to have been incredibly successful. The same should be done for JavaScript.
    – Tom Hawtin - tackline
    Mar 19, 2015 at 23:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .