316
Apple already shipped attestation on the web, and we barely noticed (httptoolkit.com)
submitted 3 years ago by to c/technology@lemmy.world
78 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 3 years ago (1 child)

What I don't understand is how does the attester check the device is not modified? Anything client side is just a matter of time until its get bypassed.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 9 points 3 years ago

    It needs integration with the TPM/secure element chip in the CPU and a device key issued by the manufacturer to sign an attestation that nothing in the software chain from kernel to browser has been modified .

    These schemes tends to get regularly broken, just look at SGX

  • permalink
  • fedilink
  • source
  • parent