SN 1065: Attestation - Code Signing Gets Tough

How secure are your Chrome extensions and certificate signings really? This episode pulls back the curtain on a massive spyware discovery and exposes the convoluted hoops developers must jump through to prove their identity in 2026.

• Websites can place high demands upon limited CPU resources. • Microsoft appears to back away from its security commitment. • What's Windows 11 26H1 and where do I get it. • Chrome 145 brings Device Bound Session Credentials. • More countries are moving to ban underage social media use. • The return of Roskomnadzor. • Discord to require proof of adulthood for adult content. • Might you still be using WinRAR 7.12 -- I was. • Paragon's Graphite can definitely spy on all instant messaging. • 30 malicious Chrome Extensions. • 287 Chrome extensions from spying on 37.4 million users. • The first malicious Outlook add-in steals 4000 user's credentials. • Some AI "vibe" coding thoughts. • What I just went through to obtain a new code signing certificate

Show Notes - https://www.grc.com/sn/SN-1065-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

canary.tools/twit - use code: TWIT joindeleteme.com/twit promo code TWIT meter.com/securitynow zscaler.com/security hoxhunt.com/securitynow