4 ms·
An honest question; Due to the way developer keys are derivative from a root certificate in Apple's ecosystem, hasn't this been a possibility there as well sinc
by MrDresden 5y ago
An honest question; Due to the way developer keys are derivative from a root certificate in Apple's ecosystem, hasn't this been a possibility there as well since the beginning of the appstore?
I agree that this possibility exists, and personally wished it wasn't.
- csunbird 5y agoI am not familiar with Apple's app signing procedures, but from what you have said, it sounds like you create your own certificate and Apple cross signs your code bundle. In that case, Apple can not start publishing their own version but they can only remove their "blessing" by not signing your code anymore. Please correct me if I am wrong with this assumption.
- saurik 5y agoYou can change your developer certificate at any time though by getting a new one from Apple; so even if your signature is still in the resulting distribution somewhere (which I don't think it could be, but I mostly deal in creating forged signatures instead of parsing existing ones), it wouldn't have the end-to-end security properties Android has (well, "had" :/).
- csunbird 5y agoThat is very disappointing. Having a verified publisher signature is a good security measure, but Apple seem to not believe that.