1

Anyone can purchase a code signing certificate. They are cheap and do not involve much validation. Yet Oracle must have determined that disabling execution of unsigned applications increases security.

Does it really, and what is the mechanism that leads to increased security? (other than the fact that any mechanism that blocks a random subset of applications will invariably block some malware too by pure chance)

2

A few reasons:

  • Buying a certificate would leave a paper trail, allowing malware to be more easily backtraced to the person that paid for the certificate.
  • It increases the barrier to entry for creating malicious Java applets, because of the cost.
  • I believe CAs (e.g. VeriSign) require you to provide evidence that you are a legitimate provider of software.

That being said, you're touching on a major problem with PKI: you have to rely on CAs being infallible and trustworthy.

  • The other major problem is that the owners of the certificate get compromised. Trusted but stolen code signing certificates a regularly misused to sign malware. – Steffen Ullrich Mar 19 '15 at 19:23
  • It appears to have been incredibly successful. The same should be done for JavaScript. – Tom Hawtin - tackline Mar 19 '15 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.