3 ms·
There are over a billion Idevices out there. Malware on just 1% of them can make and control 10 million spam accounts on every site using device attestation,
by londons_explore 3y ago
There are over a billion Idevices out there. Malware on just 1% of them can make and control 10 million spam accounts on every site using device attestation, and they're indistinguishable from real users.
- mrtksn 3y agoCaptcha or Attestation doesn't remove the need of moderation. In case of a botnet, an elevated complaints of user device engaging in fraudulent activity can lead to disabling attestation and trigger an investigation. Every iDevice being a member of your site can happen only if you are Google, other than that what you'll see is that some users will engage in shady stuff and blocking them will be enough to keep them out since they wouldn't be able to just sign in with a new account. These things are always cat and mouse games.
- gruez 3y agoAttestation covers much more than the device itself. The whole point is that it establishes there's a chain of trust from the hardware itself to the software being executed. Your average malicious flashlight app might be able to generate valid attestation tokens, but it'll be differentiable from attestation tokens from safari. If you can somehow break this chain of trust, there's way better ways of monetizing this (eg. selling spyware to nation states) than creating a bunch of fake accounts.