are you sure that this is not opening to more attack vector ?????
Your logic only makes sense if the user is your enemy.
The vendor loses the right to decide how my things are used the minute they take my money.
Bonus points if it's during a fake job interview.
Which legitimate accounts get banned for use in a VM?
That seems like an incredibly important thing I should know as I use legitimate accounts in VMs.
If it has been so weak already, it can't be weaker.
Flashing the devices require direct UART/USB access which may involve soldering, if it even exists. This leak is gold for those because these devices will never get an updated CRL.
But what about python pip and node and bun which bundle their own certs?
And then you'll have a compiled binary like Claude Code, which was built with bun, and has its vulnerable certificates bundled in, ignoring the system certs.
The fix can only come from the tool shipping an updated bundle, or if there's some way you can point it at the OS store once that's updated.
Just change your WiFi password, don’t give them the new one and don’t update them lol.
The interesting question is, how many of these devices will have the compromised CA root certificate in place?
Oh and another thing is problematic, many a Java app ships with its own keystore.jks if it needs to trust some privately hosted endpoint, and that keystore.jks may or may not contain the compromised CA root certificate... updating the OS will not catch this kind of stuff.
I have two Google devices at home and both are compromised still. If Google can't handle pushing out a quick cert chain update, then I truly doubt other manufacturers can.