3 ms·
Your understanding is correct, I believe that a compromised software update would have to be issued to skim passwords out of users databases.
by ezfe 3y ago
Your understanding is correct, I believe that a compromised software update would have to be issued to skim passwords out of users databases.
- smileybarry 3y agoEssentially, yes. And that means duping a developer into adding your code somehow, since builds are digitally signed with a hardware token.
- dzikimarian 3y agoOr supply chain attack
- smileybarry 3y agoBut that requires it to be present before the build is signed, ergo, early in the supply chain. Otherwise, the signature breaks and the build isn’t trusted for the rest of it.