Dell was recently involved in its two major security breaches. The first threat was a customer support certificate found in some of its recently shipped laptops. The second, a security hole located on the device’s pre-installed programs, was in the form of a “self-signed root certificate” (a digital credential that authenticates websites). Both issues were equally comparable to the other, and the more recent certificate was found on both Dell Inspiron and Dell XPS models. The action has been considered a big security faux pas by the PC maker, who by pre-installing root certificates continues to prove the fact that no one really knows how those things work. Either way, the proof is in the pudding. Two security flaws have been threatening Dell laptops everywhere, and it looks like there were ways it could have been prevented.

The first certificate flaw wasn’t some sort of malware or adware issue, says Dell representative Laura Pevehouse Thomas. Instead, it involved a security certificate used for customer support, called eDellRoot, “intended to provide the system service tag to Dell online support, allowing us to quickly identify the computer model, making it easier and faster to service our customers”, said Thomas. Luckily, Dell has already released a removal utility that will delete the compromising certificate (Computer World).

The second flaw, discovered by LaptopMag barely a day after eDellRoot, also affected a certificate. This time, it was a default root certificate called DSDTestProvider, which was “installed through the Dell System Detect toll into the Trusted Root Certificate Store on newer systems”. Since this certificate comes with its very own “private key”, expert attackers could use a bit of reverse engineering to make fake certificates for threatening websites, and “trick affected Dell systems into trusting their HTTPS connection” (The Next Web).

At first, Dell did not release a fix, nor acknowledge the DSDTestProvider issue, and it had many parties wondering why the company wouldn’t be as quick to provide help as it did to the first threat. It wouldn’t even respond to a request for comment, says Computer World. Luckily, the company did in fact release a downloadable tool for removing the root certificate. In the end, both the eDellRoot and DSDTestProvider certificates were threats of the same color. Because they both installed inside the Windows root store for certificates and used “private keys”, it allowed any hacker to play house with the certificates, get on malicious websites, and steal personal data. We can only hope that these current events can draw some sort of recognition to the fact that much more has to be learned about certificates in order to protect the systems they encompass. This is 2015, technology can’t always speak for itself.