6 ms·

That’s overstating what happened there and what was sent. OCSP validation happened only for signed executables and the only bit of information is the hash of th

by acdha 2y ago

That’s overstating what happened there and what was sent. OCSP validation happened only for signed executables and the only bit of information is the hash of the developer certificate being verified, which was not logged in conjunction with your IP. https://arstechnica.com/gadgets/2020/11/mac-certificate-check-stokes-fears-apple-logs-every-app-you-run/ https://arstechnica.com/gadgets/2020/11/mac-certificate-chec... Typically when there are concerns about phoning home it’s both more detailed information and something being traceable back to an individual.

fsflover 2y ago
There are a lot of good explanations in my link why the current setup is outrageous, including the danger of deanonymization of Tor users by Apple.
- acdha 2y ago
  There’s a lot of uninformed speculation, you mean. The Tor part, for example, was guessing which was not correct.
  - fsflover 2y ago
    How is this not correct? Apple knows when I open Tor browser, which enables a timing attack.
    - acdha 2y ago
      Apple knows that a Mac user checked the revocation status of the TOR Project’s signing key. They don’t log your IP, your Mac caches the result so it’s not even every time you launch the browser, and if knowing when your browser was launched is a successful timing attack it means the TOR protocol is too broken to be used – which I rather doubt is true regardless of what random commenters may confidently assert.
    - VogonPoetry 2y ago
      If the App is delivered outside of the Mac App Store, then you could just verify the signature, then resign / replace it with a local one (using the "codesign" tool). Dealing with OTA updates after you've done this might take a bit more effort. Resigning will appease Gatekeeper. As a result there will be no X.509 compliant OCSP checks made for the developer certificate - because it won't be there any more. The Tor browser folks could do this as a privacy and security feature for you.

by acdha 2y ago

fsflover 2y ago

There are a lot of good explanations in my link why the current setup is outrageous, including the danger of deanonymization of Tor users by Apple.

acdha 2y ago
There’s a lot of uninformed speculation, you mean. The Tor part, for example, was guessing which was not correct.
- fsflover 2y ago
  How is this not correct? Apple knows when I open Tor browser, which enables a timing attack.
  - acdha 2y ago
    Apple knows that a Mac user checked the revocation status of the TOR Project’s signing key. They don’t log your IP, your Mac caches the result so it’s not even every time you launch the browser, and if knowing when your browser was launched is a successful timing attack it means the TOR protocol is too broken to be used – which I rather doubt is true regardless of what random commenters may confidently assert.
  - VogonPoetry 2y ago
    If the App is delivered outside of the Mac App Store, then you could just verify the signature, then resign / replace it with a local one (using the "codesign" tool). Dealing with OTA updates after you've done this might take a bit more effort. Resigning will appease Gatekeeper. As a result there will be no X.509 compliant OCSP checks made for the developer certificate - because it won't be there any more. The Tor browser folks could do this as a privacy and security feature for you.