902
Google's Web DRM is Worse than I Thought...
(www.youtube.com)
This is a most excellent place for technology news and articles.
i don't quite get why can't the attester just.. lie.. about who he is like if I'm using firefox on linux, why cant my linux attester claim to be actually windows attester and say I'm using chrome?
I am not an expert, but it's likely signed and cryptographically secured. Change a single byte in the be Browser executable and your browser goes on the naughty list. This is total lockdown of the browser, and in principle you can extend certification of both software and hardware all the way down through the OS into the hardware.
The same host could fake the payload to the attestation server. Cat and mouse game with security through obscurity.
If you are on android or ios the phone already cryptografically verifies that the operating system has not been tampered with on a hardware level. Since the operating system is then "trusted" it can verify anything you do on it
Doesn't work. It's possible to let many banking apps think they are running on a normal device although it is rooted.
Yup Play attestation is dead, even the new and shiny "secure" one is bypassed. It's now just a hinderence.
Attestation depends on a few things:
If you're on iOS or Android, there's already strong OS level protections that a browser attestation can plugin to (like SafetyNet.)
~~Web~~Chain of trust, the site only trusts certain attesters (yes this would be really bad for Linux).
EDIT: Used the wrong "of trust"
Every time somebody calls this "web of trust" I feel the need to remind that really Web of Trust is a system of, well, decentralized manual trust, like with PGP. Like in Retroshare or Freenet for some people.
Every such attempt at replacing the actually relevant meaning of a thing which is still good and needed is suspicious.
Gah, I actually meant chain of trust... Oops...