question

Sebastian-5089 avatar image
0 Votes"
Sebastian-5089 asked JuanMiguelMrquezRiquelme-6166 commented

Reputation with OV certificates and are EV certificates still the better option?

Hi, I'm an indie developer writing an Electron application. I've registered a cooperation in Canada a few months ago and I purchased an OV certificate for my software.

The poor wording of the Windows Smart Screen Defender makes most of my non-technical users think he just downloaded a malware application.

Windows Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.

Also the hidden "More Info" button in the dialog doesn't help at all. So my OV certificate is basically useless because it scares off the potential customers. At the same time I need a few hundred or thousand downloads for the message to disappear. That makes absolutely no sense. And I can't just sit this out because most customers will not come back a second time after that experience.

I understand the motivation but its poorly executed and indie developers like me are screwed because of this. I already submitted my application twice through the Windows "File Submission" form. So my questions are...

1) What can I do to speedup the process?
2) Are EV certificates still the better option? Do they still get the "instant" reputation these days? An agent at DigiCert mentioned this is not the case anymore.

Any help from the MS team is highly appreciated!

101216-windows10-smartscreenblocked1-e1577961749377.png


windows-serverwindows-10-generalwindows-10-security
· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

HI
I am researching your issue, thanks for your waiting.

1 Vote 1 ·

Hi @JiaYou-MSFT, Thanks for your help!

0 Votes 0 ·

@JiaYou-MSFT Are there any news on this? I still get the issue on small updates. This is really urgent for us. Thank you!

0 Votes 0 ·
JiaYou-MSFT avatar image
1 Vote"
JiaYou-MSFT answered JuanMiguelMrquezRiquelme-6166 commented

HI Sebastian-5089,

Thanks for your waiting.

1.I've registered a cooperation in Canada a few months ago
Do you mean you have registered a business company in Canada? If the answer is yes, I think EV certificate is available.


2.Are EV certificates still the better option?
yes. If there is signed driver file included in your electron application, EV code signing certificate is required to establish a Windows Hardware Dev Center dashboard account.

"Signing your code is not required to earn a SmartScreen reputation, but EV-signed code’s extra level of trust lets developers skip this hurdle altogether:

An EV code signing certificate offers an immediate reputation with Microsoft SmartScreen, so your users will never have to click through a SmartScreen warning in Windows.
With an OV certificate, SmartScreen reputation must be built organically, as users download and install your files. SmartScreen warnings may occur until enough software proves sufficiently popular with Windows users for SmartScreen to view it as “well known.”
Unfortunately, Microsoft does not publish guidelines on what constitutes enough downloads to eliminate SmartScreen warnings. Microsoft has also indicated in the past that signing code is a “best practice” that you “can follow to help establish and maintain reputation for your applications.”


Do they still get the "instant" reputation these days?
From below document and I think it will be come true, we can contact SSL third party certificate company.


Which Code Signing Certificate do I Need? EV or OV?
https://www.ssl.com/faqs/which-code-signing-certificate-do-i-need-ev-ov/


============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hey, sorry for the late reply! Despite my notification settings I didn't receive an update to this thread.

At the moment I plan ahead and submit my executables and installer to https://www.microsoft.com/en-us/wdsi/filesubmission a day prior to release. That seems to work fine.

Thanks for the reassurance about the EV certificates. In less than a year I will have to renew my current OV license so it's enough time to get the EV certificate requirements ready.

Thanks again!


0 Votes 0 ·

HI Sebastian-5089,

You are welcome! I hope everything goes well.

If there is any Answer is helpful, please click "Accept Answer".

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

1 Vote 1 ·

I have exactly the same problem as Sebastian.
It is unbelievable that after purchasing an OV certificate you still need thousands of downloads to clear the SmartScreen message.
How are these downloads supposed to actually happen? If a user gets this screen, they will most probably not proceed with it. This is a complete non-sense.
The idea of the certificate is to identify the software developer. Isn't the OV certificate enough for that purpose?
This is very frustrating. Windows is becoming a dictator. No wonder Mac users are increasing every day.
I do not want to believe that the idea of all this is that someone makes more money.
I will try to get an EV certificate to solve my problem (four times more expensive than an OV certificate) because the the other "reputation building" options are just unreal.
I guess I will have to say thank you for your help.

0 Votes 0 ·
JiaYou-MSFT avatar image
0 Votes"
JiaYou-MSFT answered JiaYou-MSFT edited

HI Sebastian-5089,

Is there anything to help you?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JiaYou-MSFT avatar image
0 Votes"
JiaYou-MSFT answered

HI Sebastian-5089,

Is there any progress on your question?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

PhillipKatete-5750 avatar image
1 Vote"
PhillipKatete-5750 answered Sebastian-5089 commented

I have been distributing apps signed with OV certificates for over a decade and can say that they are not meant to be a quick way to avoid SmartScreen warning.

  1. An OV certificate thumbprint takes a very long time to gain reputation (it could be years, plural!)

  2. Apps can also establish a reputation of their own, and according to Microsoft Security intelligence, once they've attained that reputation (through downloads) then SmartScreen should not flag them with a warning.

  3. An app that has established a (positive) reputation and is signed by an OV certificate whose thumbprint has not established a reputation WILL result in a SmartScreen warning.

  4. Any app, with or without an established reputation, signed with an OV certificate whose thumbprint has established a reputation will NOT result in a SmartScreen warning.

  5. Most importantly, apps establish a reputation based on downloads (and their hash), which means that updates to the app will not have the same hash (and therefore will not have /inherit a/the reputation).

By deduction, it is ideal to have an OV certificate whose thumbprint has established a reputation. Unfortunately, there is neither guidance on how build an OV certificate reputation nor on how to check OV certificate reputation.
EV certificates on the other hand have a reputation built in (usually takes a few days before SmartScreen recognizes the thumbprint as opposed to, probably, years for an OV).




· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks for your sharing! Seems there is no other way around and go with an EV certificate in the near future.

0 Votes 0 ·