3 ms·
Apple has solved this pretty elegantly using just the machine id. When you purchase an app on the appstore apple creates a receipt that contains a hash of your
by seanalltogether 16y ago
Apple has solved this pretty elegantly using just the machine id. When you purchase an app on the appstore apple creates a receipt that contains a hash of your machine id as well as other meta data. The receipt is then signed with Apples certificate.
When you launch an app you verify the receipt was signed by Apple and that the hash of the current machine id matches the hash of the machine id in the receipt.
Dropbox could generate the same sort of receipt serverside when you first sign in. From then on each time the dropbox client launches it just validates the receipt against the current machine.
- tptacek 16y agoThis works because Apple is in the reversing arms race. Does it make sense for Dropbox to go down this path? Note that Google and your bank don't.
- seanalltogether 16y agoBanks absolutely do this once they have the ability to talk to the OS. I've built 3 banking apps for iphone/ipad now and client side verification was involved in all of them after first login. The problem is browsers just don't have a good standard way of accomplishing this.
- mason55 16y agoAll my banks do. If they detect a browser/IP that I haven't used before they ask me for another piece of authentication (secret question)
- tptacek 16y agoI think we're talking past each other here. I thought we were talking about embedding secrets in machines. If you want a button in the Dropbox UI that tells it to freak out when your IP changes, that's fine; I think there's a good reason Gmail doesn't default that way though.
- towelrod 16y agoBlizzard freaks out about changing IP addresses when you sign in to World of Warcraft. I have two internet connections at home and sometimes I switch back and forth, and back when I was playing WoW, it would lock me out after each switch. I had to login to my account via the battle.net website and stell it that everything was ok. It was extremely annoying. The last few times it happened I just didn't play for a while because I didn't want to bother with reauthenticating; that's when I realized that I didn't enjoy the game that much any more and cancelled my account.
- riffraff 16y agofor the sake of counter-example: facebook does. E.g. if you try to log in from a different country than ones it already knows you have to go through a long process of reauthentication by inputting your friends' names based on pictures. At least, it happened to me twice.
- pmjordan 16y agoAgain, the machine ID is easily faked by an attacker.