4 ms·

As I understand it, Google wants to add some signal to http requests which tell the server that the user is using a system made from some specific software. For

by TekMol 3y ago

As I understand it, Google wants to add some signal to http requests which tell the server that the user is using a system made from some specific software. For example an unaltered stock Android phone. What would be the one-sentence technical explanation of how Google wants to achieve this?

ohgodplsno 3y ago
Every request first goes through "trusted attesters" (read: Google and pretty much Google alone) along with some information about your device (hardware information, browser data, executable hash, etc) for them to sign it and decide whether or not you're legit. See the Play Integrity API on Android for similar implementations.
- Buttons840 3y ago
  So there's some hardware level support for this? Could you man-in-the-middle the connection and alter the message to say whatever needs to be said to convince the other computer that my computer is working the way it expects?
  - danielheath 3y ago
    Not without a machine key signed by a trusted (by google) manufacturer - which is held in the secure enclave, so you can’t just read it from your machine.
  - ohgodplsno 3y ago
    If they intend to copy the Play Integrity API, it indeed has different levels of attestation, going from software "should be alright" to hardware "actively signed in a secure enclave that the user will never have access to". >Could you man-in-the-middle the connection and alter the message to say whatever needs to be said to convince the other computer that my computer is working the way it expects? If you're willing to break modern cryptography for that to happen, sure. Also, requests include a hash and a timestamp to prevent replay attacks and delayed attacks too. So you better crack that cryptography _fast_
danielheath 3y ago
Most chips have a TPM which holds a key. You can’t access the key without expensive and specialised equipment. The key is signed by the manufacturer’s key (google, in this case). The TPM has an API that returns a signature of the running OS code. If you tamper with the OS, you get a signature mismatch.
est 3y ago
> What would be the one-sentence technical explanation of how Google wants to achieve this? Denuvo for browsers. Rootkit disguised as a browser from your favorite Ads service provider.
deleted 3y ago
[deleted]

by TekMol 3y ago

ohgodplsno 3y ago

Every request first goes through "trusted attesters" (read: Google and pretty much Google alone) along with some information about your device (hardware information, browser data, executable hash, etc) for them to sign it and decide whether or not you're legit. See the Play Integrity API on Android for similar implementations.

Buttons840 3y ago
So there's some hardware level support for this? Could you man-in-the-middle the connection and alter the message to say whatever needs to be said to convince the other computer that my computer is working the way it expects?
- danielheath 3y ago
  Not without a machine key signed by a trusted (by google) manufacturer - which is held in the secure enclave, so you can’t just read it from your machine.
- ohgodplsno 3y ago
  If they intend to copy the Play Integrity API, it indeed has different levels of attestation, going from software "should be alright" to hardware "actively signed in a secure enclave that the user will never have access to". >Could you man-in-the-middle the connection and alter the message to say whatever needs to be said to convince the other computer that my computer is working the way it expects? If you're willing to break modern cryptography for that to happen, sure. Also, requests include a hash and a timestamp to prevent replay attacks and delayed attacks too. So you better crack that cryptography _fast_

danielheath 3y ago

Most chips have a TPM which holds a key. You can’t access the key without expensive and specialised equipment. The key is signed by the manufacturer’s key (google, in this case). The TPM has an API that returns a signature of the running OS code. If you tamper with the OS, you get a signature mismatch.

est 3y ago

> What would be the one-sentence technical explanation of how Google wants to achieve this? Denuvo for browsers. Rootkit disguised as a browser from your favorite Ads service provider.

deleted 3y ago

[deleted]