A screenshot of the Rocket.Chat Windows app littered with dialogs each saying: "Do you trust certificate from 'your boss'?", the default answer is "Yes".

Notices where this attachment appears

1. Embed this notice
   Pluto (pluto@chaos.social)'s status on Monday, 01-Jul-2024 16:33:03 JST Pluto

   In 2022, I discovered that this is how the Rocket.Chat Desktop apps handle invalid #TLS certificates. Pressing Enter sets the certificate as trusted, clicking "No" may present you with more and more prompts during which you cannot close the app.

   Please don't press Enter in Rocket.Chat Desktop #zeroday
   please boost!
   Here's my responsible disclosure story (bear with me, I'm not a security researcher) 🧵

   #infosec #opensource #security