3 ms·
What do you mean Android doesn't have an analog? It has both secure boot and device attestation. It has multiple APIs that can be used to design applications re
by dcow 4y ago
What do you mean Android doesn't have an analog? It has both secure boot and device attestation. It has multiple APIs that can be used to design applications requiring varying levels of trusted computing context.
There's the high-level SafeyNet API which essentially lets you assert that you're running on a non-modified device running non-modified software in the context of a verified boot:
* https://developer.android.com/training/safetynet/attestation https://developer.android.com/training/safetynet/attestation
It also has the lower-level Keymaster 3 API (since 2017) which provides HSM-signed certificates with the device attestiation extension, including the system trust level and verified device identifiers:
* https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation
* https://datatracker.ietf.org/doc/draft-bweeks-acme-device-attest/ https://datatracker.ietf.org/doc/draft-bweeks-acme-device-at...
Microsoft is the one that's late to party... And your hypothesis seems pretty dependent on an argument that Apple can't build iMessaging on other platforms because they're the only platform with device attestation. That's simply not true.
If Apple wanted iMessage on other platforms, they've had at least 5 years to build it in the way you theorize must be required.
- execveat 4y agoThere are multiple public bypasses for SafetyNet. Many 3rd party roms provide them out-of-the-box. Granted, Apple's attestation is bypassable as well. Furthermore, others mentioned that a large portion of SMS-spam originates from the FluBot infected Android devices. Well, the only reason FluBot does not infect iPhones is laziness - it is perfectly doable at scale using custom configuration profiles.
- dcow 4y agoYep good point. Are there bypasses for the hsm-backed signed attestation?