3 ms·
I'd drop "hacking is cool" from this list and add "trusting the client". I've seen an increase in attempts to trust the client lately, from mobile apps demandi
by Zak 2y ago
I'd drop "hacking is cool" from this list and add "trusting the client".
I've seen an increase in attempts to trust the client lately, from mobile apps demanding proof the OS is unmodified to Google's recent attempt to add similar DRM to the web. If your network security model relies on trusting client software, it is broken.
- strangecharm2 2y agoIt's not about security, it's about control. Modified systems can be used for nefarious purposes, like blocking ads. And Google wouldn't like that.
- Zak 2y agoIt's about control for Google and friends. If your bank's app uses SafetyNet, it's probably about some manager's very confused concept of security.
- account42 2y ago> If your bank's app uses SafetyNet, it's probably about some manager's very confused concept of security. Or about making the auditor for the government-imposed security certification happy with the least amount of effort. It's always more work to come up with good answers why you are not doing the industry standard thing.
- Zak 2y agoIt only became a standard practice because of a misguided desire to rely on trusting the client.