developers.smarttv-alliance.org Developers forum 2014-11-24T00:12:43-07:00 https://developers.smarttv-alliance.org/forum/feed.php?f=8&t=240 2014-11-24T00:12:43-07:00 2014-11-24T00:12:43-07:00 https://developers.smarttv-alliance.org/forum/viewtopic.php?t=240&p=355#p355 <![CDATA[Severely broken handling of SSL/TLS certificates?]]>
We had sent this information to related person.
Please wait for a while.

Regards.

Statistics: Posted by Support_STA — Mon Nov 24, 2014 12:12 am

]]> 2014-11-20T09:08:34-07:00 2014-11-20T09:08:34-07:00 https://developers.smarttv-alliance.org/forum/viewtopic.php?t=240&p=354#p354 <![CDATA[Severely broken handling of SSL/TLS certificates?]]>
I have tried to connect to several HTTPS web site using the web browser included in the SmartTV simulator (part of the SDK).

To my astonishment, I found that the SmartTV web browser happily connects to any HTTPS web site regardless of the SSL Server certificate being untrusted, revoked, or even expired.

Unless this behaviour is a known limitation of the SDK, not found on real Smart TVs, this is a huge security hole that should be fixed quickly.

Can anybody explain what trusted CAs are embedded in the SDK (and in real TVs, if those are different) ?

And how come the SmartTV specification does not address this issue?

-- Adriano

Statistics: Posted by adriano.santoni_1 — Thu Nov 20, 2014 9:08 am

]]>