Hey,

I've seen it being talked about a bit here and there already. But no one has really said what the actual dangers are of "blindly" trusting r2r and installing there root certificate that is needed for Cubase? Im on the edge on if I should install it or go with the TC release of Cubase. I trust r2r but I dont want to open too many doors. Are MIM attacks possible or worse? Looking forward to someone who could shine some light onto this topic. Thank you in advance.

 

The certificate is for code protection only.


P.S. And the resale of R2R releases

 

Last edited: Jul 30, 2022

that's the beauty of it! nobody knows! It's always better to live dangerously and die young.

 

Yes while its true that its needed mostly for the installation you have to keep it on your pc for the program to work. Im also not talking about what other people could do with it but more so what r2r (IF they had malicious intent) could do with such access to my pc.

 

Yes Ive read already that its used mostly to be able to identify the right releases and check that its a legitimate r2r release and not something that has been tempered with. For the cubase release you have to have it on your pc however. And Ive read that if they have a root certificate on your pc that they can read and redirect your internet traffic. Im just worried and interested in what r2r (if they had malicious intent) could do with such access.

 

Lol, wise words to live by.

Also realizing now I should have used the multiquote tool.

 

If you think that after so much free software, R2R will do something to your computer, you should not install it..

 

You can turn on firewall. In most cases Their software actually blocked from network access.

 

V.R also install certificate. But it installed silently without you knowing.

 

It is all about knowing who to trust, in what ways, and to what degrees.
I trust people to be human and try to avoid unfair expectations.
I trust r2r with software.
Do i trust them with my girlfriend?
Maybe not...

 

Etc..

 

I was curious myself, so I did some snooping around on the interweb. From what I saw, Trusted Root Certificates should only be activated, under Intended Purposes, for one or a few things only, unless it's Microsoft then it can say <All>. I hadn't realized TeamVR had installed a certificate. Not only that, but it said <All>! That would give the bearer of the certificate free rein to worm its way through your computer as it saw fit, that's why an outgoing firewall is important. I use Tiny Wall. R2R's certificate is R2RCA and, under Intended Purposes, it says Code Signing alone. That puts my mind at ease.

To access the trusted root page on Windows: Windows key + R, Trusted Root Certification Authorities, Certificates.

 

V.R

 

Wrong question. Do you trust your girlfriend is the right question.

 

Bankruptcy.

 

This is very very useful information. I didnt realize it had only signing as the written intended purpose. But it also looks like this field doesnt really matter to what the certificate really does. Couldnt you just put whatever in there and then use it to decrypt internet traffic? I never installed TeamVR and I realized that the TC release is similar to the VR one? Atleast people in the comments have been saying that.

I dont doubt that r2r wont use it maliciously but at the same time my mind just is not at ease as long as I dont exactly know what can be done with a root certificate. I saw a paper that talked about it making unlegitimate software look like legitimate one to the user of the pc but that wouldnt really matter as much. Ive also read that it can decrypt and read your traffic but then there is also difference between browser root certificates and machine ones. Its all super confusing.

 

That came before already .

 

Yes that has some truth to it. Especially since it would probably be much easier to hide something in the software itself then letting the user install a root certificate.

 

I trust R2R more than Facebook and Google. Damn, man... all those apps installed at your computer and cellphone are doing sh*t to your privacy, so i suggest stop using those algorithms and start making keygen music