Code Signing Certificate

Code Signing Certificate

The recent release of Launcher PRO 3.0, and the re-release Launcher 2.0 BFU_XODE edition, is digitally signed and conforms with Windows Authenticode. Why do I need it, or the better question is, why do you need it? Authenticode or digitally signing a file ensures that the file is exactly how I released it when it gets to end users. It ensures the integrity of a file.

This only works if the user actively checks it, though. I have been signing every releases, but it's only the last release where I actively check digital signatures.

I'm honestly surprised to learn that there's a good number of people who doesn't know what it is, how to check it, and what it is for. Along with those, there are also some people who casted doubt and hurled accusations as to what my real intentions were.

I find it both humorous and preposterous at the same time, that these people would even insinuate that I'm up to no good. I mean, I've been doing this for a while now, and starting something nefarious just doesn't make sense, and just not my style. They're trying to cast doubts, but really, they don't know a thing about digital signature.

Anyone can check for themselves. If you check the digital signature by right-clicking the executable:

First thing to check is where it says "This digital signature is OK". NOTE: This will say something else if the certificate is not trusted, even if the digital signature checks out.

If you click View Certificate, you'll see the following:

The intended purpose of the certificate is important. As you can see, it's sole purpose is limited to digital signature, nothing more, nothing less. It cannot be used for server identification, create or issue or sign another certificate, or server or client authentication, or encryption/decryption, or anything else for that matter.

In short, the certificate cannot be used for exploit such as Man in the Middle (MITM) Attack. It's just not possible. Besides, for MITM to succeed, you have to be really stupid and do several things before it even initiates. Things that Windows Defender or modern browsers will reject.

These talking heads just want to insinuate things, but don't know jack.But I'm glad, because it forces me to look for better alternatives.

The only reason I'm using a self-signed code signing certificate is that it costs a lot, $200-$400/year, with the Extended Validation costing twice as much. I'm not going to spend that much penny.

Having said that, I decided that installing the root certificate is now not required. I found a way to validate digital signatures without needing to trust the certificate first. Obvious drawback is that it's less accurate and slower, and not at par to the level of security I intended.

The installed certificate can be removed by following these instructions:

- Add The certificates Snap-In
- Delete a Certificate

Also, from the command line, type LauncherPro.exe -cert

The next version of Launcher PRO will incorporate this. The repacked Launcher 2.0 Build 162 already have it.

I hope I shed some light into this. And again, nefarious stuff are not my thing, matter of factly, it's the opposite. My Launchers don't load modified files, remember?