2 ms·
I don't understand how publishing cryptographic signatures of the software is a guarantee? How do they prove it isn't keeping a copy of the code to make signatu
by plagiarist 2y ago
I don't understand how publishing cryptographic signatures of the software is a guarantee? How do they prove it isn't keeping a copy of the code to make signatures from but actually running a malicious binary?
- dialup_sounds 2y agoThe client will only talk to servers that can prove they're running the same software as the published signatures. https://security.apple.com/documentation/private-cloud-compute/softwarelayering#Cloud-Attestation https://security.apple.com/documentation/private-cloud-compu...
- warkdarrior 2y agoAnd the servers prove that by relying on a key stored in secure hardware. And that secure hardware is designed by Apple, who has a specific interest in convincing users of that attestation/proof. Do you see the conflict of interest now?