3 ms·
Every request first goes through "trusted attesters" (read: Google and pretty much Google alone) along with some information about your device (hardware informa
by ohgodplsno 3y ago
Every request first goes through "trusted attesters" (read: Google and pretty much Google alone) along with some information about your device (hardware information, browser data, executable hash, etc) for them to sign it and decide whether or not you're legit. See the Play Integrity API on Android for similar implementations.
- Buttons840 3y agoSo there's some hardware level support for this? Could you man-in-the-middle the connection and alter the message to say whatever needs to be said to convince the other computer that my computer is working the way it expects?
- danielheath 3y agoNot without a machine key signed by a trusted (by google) manufacturer - which is held in the secure enclave, so you can’t just read it from your machine.
- ohgodplsno 3y agoIf they intend to copy the Play Integrity API, it indeed has different levels of attestation, going from software "should be alright" to hardware "actively signed in a secure enclave that the user will never have access to". >Could you man-in-the-middle the connection and alter the message to say whatever needs to be said to convince the other computer that my computer is working the way it expects? If you're willing to break modern cryptography for that to happen, sure. Also, requests include a hash and a timestamp to prevent replay attacks and delayed attacks too. So you better crack that cryptography _fast_