4 ms·
I guess you missed the "not" Google proposal for the Browser Attestation API? No need to put too many respurces fighting for a single site when you can just loc
by deadbunny 3y ago
I guess you missed the "not" Google proposal for the Browser Attestation API? No need to put too many respurces fighting for a single site when you can just lock it down to blessed browsers.
- armchairhacker 3y agoIn order for web DRM to be feasible, it has to work without issues for 99% of average users while blocking the few who will go to great lengths to simulate attestation. That’s a hard goal. TPM1.2 (used up until a few years back) is already broken because it uses SHA-1. If someone finds an exploit for TPM2.0, a dedicated team could manipulate the entire sandbox down to the hardware to simulate a “blessed browser”, making it even harder for google to detect until nearly everyone moves to devices which don’t even exist yet.
- withinboredom 3y agoLast I heard, sha-1 isn’t broken for any arbitrary hash.