What fields does SmartScreen use?

Question

Does anyone know what all fields SmartScreen uses for indexing application 'reputation'? Is it just the public key? Common name as well, or...?

I am mostly interested as far as reputation continuity goes -- should I find a CA which lets me reuse the same public key at renewal, etc.

Thanks

James

Answer 1

This MSDN blog post doesn't directly answer the question, but suggests that there is no such thing as reputation continuity:

"Certificate rollover occurs when your old certificate expires and you begin signing your code with a new replacement certificate; all of your reputation was accumulated against the old certificate, and hence there may be a time lag for your new certificate to acquire a good reputation."

Perhaps they're using the certificate thumbprint itself? If they used the public key to identify a publisher, this wouldn't be a problem.