3 ms·
There’s a lot of uninformed speculation, you mean. The Tor part, for example, was guessing which was not correct.
by acdha 2y ago
There’s a lot of uninformed speculation, you mean. The Tor part, for example, was guessing which was not correct.
- fsflover 2y agoHow is this not correct? Apple knows when I open Tor browser, which enables a timing attack.
- acdha 2y agoApple knows that a Mac user checked the revocation status of the TOR Project’s signing key. They don’t log your IP, your Mac caches the result so it’s not even every time you launch the browser, and if knowing when your browser was launched is a successful timing attack it means the TOR protocol is too broken to be used – which I rather doubt is true regardless of what random commenters may confidently assert.
- VogonPoetry 2y agoIf the App is delivered outside of the Mac App Store, then you could just verify the signature, then resign / replace it with a local one (using the "codesign" tool). Dealing with OTA updates after you've done this might take a bit more effort. Resigning will appease Gatekeeper. As a result there will be no X.509 compliant OCSP checks made for the developer certificate - because it won't be there any more. The Tor browser folks could do this as a privacy and security feature for you.