Reply to thread

Message

<blockquote data-quote="Freki123" data-source="post: 1035000" data-attributes="member: 11229">I can&#039;t answer that part. I can only tell you that I have some files (e.g game installer) that were counted as signed and after I applied the &quot;registry fix&quot; the &quot;digital signatures&quot; tab was gone. So before the &quot;tweak&quot; windows treated them as signed and afterwards they were not signed anymore for windows.[SPOILER=&quot;MS sec advisor&quot;][URL unfurl=&quot;true&quot;]https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2014/2915720?redirectedfrom=MSDN[/URL][/SPOILER]Quotes from it:However, as we worked with customers to adapt to this change, we determined that the impact to existing software could be high. Therefore, Microsoft no longer plans to enforce the stricter verification behavior as a default requirement. The underlying functionality for stricter verification remains in place, however, and can be enabled at customer discretion.Is there any possibility of a signature being recognized as non-compliant with the stricter verification process if I sign using non-Microsoft-provided signing tools?Yes. For customers opting to enable the stricter verification behavior, signing binaries with non-Microsoft-provided signing tools runs the risk of signatures being recognized as non-compliant with the stricter verification behavior. Using Microsoft products, or signature tools Microsoft provides, such as signtool.exe, helps to ensure that signatures are recognized as compliant.Tldr: My guess is the check is quite strict and some publisher never followed the recommendations to pass that strict checks.</blockquote>

[QUOTE="Freki123, post: 1035000, member: 11229"] I can't answer that part. I can only tell you that I have some files (e.g game installer) that were counted as signed and after I applied the "registry fix" the "digital signatures" tab was gone. So before the "tweak" windows treated them as signed and afterwards they were not signed anymore for windows. [SPOILER="MS sec advisor"][URL unfurl="true"]https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2014/2915720?redirectedfrom=MSDN[/URL][/SPOILER] Quotes from it: However, as we worked with customers to adapt to this change, [B]we determined that the impact to existing software could be high[/B]. Therefore, Microsoft no longer plans to enforce the stricter verification behavior as a default requirement. The underlying functionality for stricter verification remains in place, however, and can be enabled at customer discretion. Is there any possibility of a signature being recognized as[B] non-compliant [/B]with the stricter verification process if I sign using non-Microsoft-provided signing tools? Yes. [B]For customers opting to enable the stricter verification behavior, signing binaries with non-Microsoft-provided signing tools runs the risk of signatures being recognized as non-compliant with the stricter verification behavior.[/B] Using Microsoft products, or signature tools Microsoft provides, such as signtool.exe, helps to ensure that signatures are recognized as compliant. Tldr: My guess is the check is quite strict and some publisher never followed the recommendations to pass that strict checks. [/QUOTE]

Verification