this post was submitted on 09 Aug 2023
636 points (97.5% liked)

Technology

60079 readers
3332 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
 

This video as a text article: https://blog.nicco.love/google-drms-the-web/

you are viewing a single comment's thread
view the rest of the comments
[–] SparkyLight@lemmy.world 22 points 1 year ago (3 children)

i don't quite get why can't the attester just.. lie.. about who he is like if I'm using firefox on linux, why cant my linux attester claim to be actually windows attester and say I'm using chrome?

[–] SkyNTP@lemmy.ml 22 points 1 year ago (1 children)

I am not an expert, but it's likely signed and cryptographically secured. Change a single byte in the be Browser executable and your browser goes on the naughty list. This is total lockdown of the browser, and in principle you can extend certification of both software and hardware all the way down through the OS into the hardware.

[–] sloppy_diffuser@sh.itjust.works 9 points 1 year ago (1 children)

The same host could fake the payload to the attestation server. Cat and mouse game with security through obscurity.

[–] Anafabula@discuss.tchncs.de 7 points 1 year ago (1 children)

If you are on android or ios the phone already cryptografically verifies that the operating system has not been tampered with on a hardware level. Since the operating system is then "trusted" it can verify anything you do on it

[–] l0v9ZU5Z@feddit.de 7 points 1 year ago (1 children)

Doesn't work. It's possible to let many banking apps think they are running on a normal device although it is rooted.

[–] Koffiato@lemmy.ml 6 points 1 year ago

Yup Play attestation is dead, even the new and shiny "secure" one is bypassed. It's now just a hinderence.

[–] chaospatterns@lemmy.world 19 points 1 year ago

Attestation depends on a few things:

  1. The website has to choose to trust a given attestation provider. If Open Source Browser Attestation Provider X is known for freely handing out attestations then websites will just ignore them
  2. The browser's self-attestation. This is tricky part to implement. I haven't looked at the WEI spec to see how this works, but ultimately it depends on code running on your machine identifying when it's been modified. In theory, you can modify the browser however you want, but it's likely that this code will be thoroughly obfuscated and regularly changing to make it hard to reverse engineer. In addition, there are CPU level systems like Intel SGX that provide secure enclaves to run code and a remote entity can verify that the code that ran in SGX was the same code that the remote entity intended to run.

If you're on iOS or Android, there's already strong OS level protections that a browser attestation can plugin to (like SafetyNet.)

[–] Dark_Arc@lemmy.world 15 points 1 year ago* (last edited 1 year ago) (1 children)

~~Web~~Chain of trust, the site only trusts certain attesters (yes this would be really bad for Linux).

EDIT: Used the wrong "of trust"

[–] vacuumflower@lemmy.sdf.org 7 points 1 year ago (1 children)

Every time somebody calls this "web of trust" I feel the need to remind that really Web of Trust is a system of, well, decentralized manual trust, like with PGP. Like in Retroshare or Freenet for some people.

Every such attempt at replacing the actually relevant meaning of a thing which is still good and needed is suspicious.

[–] Dark_Arc@lemmy.world 6 points 1 year ago

Gah, I actually meant chain of trust... Oops...