ClickOnce Security Risk

[NickP]

Hi there,

I've discovered what I believe to be a security risk with ClickOnce. I
have only just started publishing my application using our own Trusted
certificate, before this I was using a test certificate.

The problem is that when I published a new build with the new
certificate and then updated the client on a separate machine, it didn't
even warn me that the signature did not match the previous version. Surely
this is a security risk? So basically I could create an application with
the same name / guid etc, use a test certificate with a similar company name
and then overwrite the app and the user would be none the wiser...

Unless I've missed the point somewhere along the lines of course.

Nick.

[Steve Gerrard]

NickP wrote:

Hi there,

I've discovered what I believe to be a security risk with
ClickOnce. I have only just started publishing my application using
our own Trusted certificate, before this I was using a test
certificate.
The problem is that when I published a new build with the new
certificate and then updated the client on a separate machine, it
didn't even warn me that the signature did not match the previous
version. Surely this is a security risk? So basically I could
create an application with the same name / guid etc, use a test
certificate with a similar company name and then overwrite the app
and the user would be none the wiser...
Unless I've missed the point somewhere along the lines of course.

I'm surprised, I have seen exactly the opposite, any change in certificate being
considered completely invalid. Did the user run the update from a shortcut on
their machine, or go to the web site again? You may have simply installed a new
program on their machine, not updated the old one.