H&R Block tax software installs a TLS root certificate with bundled private key
Summary
A Hacker News post alleges that H&R Block's tax software installs a root certificate authority into the local trust store and includes the private key, enabling potential TLS traffic manipulation. The post includes a demonstration and suggests auditing trusted root certificates; the vendor reportedly acknowledges related findings but has not fixed the issue.