4 ms·
According to the article, it would be difficult to tie any request to a user: > Target diffusion starts with the request metadata, which leaves out any persona
by a2128 2y ago
According to the article, it would be difficult to tie any request to a user:
> Target diffusion starts with the request metadata, which leaves out any personally identifiable information about the source device or user, and includes only limited contextual data about the request that’s required to enable routing to the appropriate model
If this is the case, I wonder how the authentication would work. Is it a security through obscurity sort of situation? Wouldn't it be possible for someone, through extensive reverse engineering, to write a client in Python that gives you a nice free chat API and Apple would be none the wiser?
- filleokus 2y agoDon't know if they use it (or if it would somehow weaken/break the privacy claims you cited), but Apple has an SDK called DeviceCheck[0]. Essentially, your server send a nonce which the client signs using a key pair derived from the Secure Enclave. The server can then verify the signature by an API provided by Apple's servers, and they respond whether it was signed by a Secure Enclave resident key or not. I'm guessing this could be helpful to make it hard(er) to write a Python client. [0]: https://developer.apple.com/documentation/devicecheck/establishing-your-app-s-integrity https://developer.apple.com/documentation/devicecheck/establ...