3 ms·

Couldn't someone just uhh... patch their macOS/kernel, mock these things out, then behold, you can now access all the data? If it's not running fully end to en

Couldn't someone just uhh... patch their macOS/kernel, mock these things out, then behold, you can now access all the data? If it's not running fully end to end in some secure enclave, then it's always just a best effort thing. Good marketing though.

saagarjha 5mo ago
Yes. Running attested workloads on macOS if you are not Apple is nontrivial.
- vrockdub 5mo ago
  [dead]
mike_hearn 5mo ago
Right. Apple is perfectly capable of doing remote attestation properly. iOS has DCAppAttest which does everything needed. Unfortunately, it's never been brought to macOS, as far as I know. Maybe this MDM hack is a back door to get RA capabilities, if so it'd certainly be intriguing, but if not as far as I know there's no way to get a Mac to cough up a cryptographic assertion that it's running a genuine macOS kernel/boot firmware/disk image/kernel args, etc. It's a pity because there's a lot of unique and interesting apps that'd become possible if Apple did this. Darkbloom is just one example of what's possible. It'd be a huge boon to decentralization efforts if Apple activated this, and all the pipework is laid already so it's really a pity they don't go the extra mile here.
- woadwarrior01 5mo ago
  > iOS has DCAppAttest which does everything needed. Unfortunately, it's never been brought to macOS, as far as I know. Apple's docs claim it's been available on macOS since macOS 11. Am I missing something here? https://developer.apple.com/documentation/devicecheck/dcappattestservice https://developer.apple.com/documentation/devicecheck/dcappa...
  - mike_hearn 5mo ago
    All lies. They mean the symbols exist and can be linked against, but https://developer.apple.com/documentation/devicecheck/dcappattestservice/issupported https://developer.apple.com/documentation/devicecheck/dcappa... > If you read isSupported from an app running on a Mac device, the value is false. This includes Mac Catalyst apps, and iOS or iPadOS apps running on Apple silicon.
    - woadwarrior01 5mo ago
      That really sucks! TIL. So app attestation is iOS 14.0+, iPadOS 14.0+, tvOS 15.0+ and watchOS 9 only.
jeroenhd 5mo ago
You can probably just tap the HTTP(S) connection to spy on the data coming through. I think it's a mistake to assume any kind of privacy for this service. The biggest argument for remote attestation I can think of is to make sure nobody is returning random bullshit and cashing in prompt money on a massive scale.

saagarjha 5mo ago

Yes. Running attested workloads on macOS if you are not Apple is nontrivial.

vrockdub 5mo ago
[dead]

mike_hearn 5mo ago

Right. Apple is perfectly capable of doing remote attestation properly. iOS has DCAppAttest which does everything needed. Unfortunately, it's never been brought to macOS, as far as I know. Maybe this MDM hack is a back door to get RA capabilities, if so it'd certainly be intriguing, but if not as far as I know there's no way to get a Mac to cough up a cryptographic assertion that it's running a genuine macOS kernel/boot firmware/disk image/kernel args, etc. It's a pity because there's a lot of unique and interesting apps that'd become possible if Apple did this. Darkbloom is just one example of what's possible. It'd be a huge boon to decentralization efforts if Apple activated this, and all the pipework is laid already so it's really a pity they don't go the extra mile here.

woadwarrior01 5mo ago
> iOS has DCAppAttest which does everything needed. Unfortunately, it's never been brought to macOS, as far as I know. Apple's docs claim it's been available on macOS since macOS 11. Am I missing something here? https://developer.apple.com/documentation/devicecheck/dcappattestservice https://developer.apple.com/documentation/devicecheck/dcappa...
- mike_hearn 5mo ago
  All lies. They mean the symbols exist and can be linked against, but https://developer.apple.com/documentation/devicecheck/dcappattestservice/issupported https://developer.apple.com/documentation/devicecheck/dcappa... > If you read isSupported from an app running on a Mac device, the value is false. This includes Mac Catalyst apps, and iOS or iPadOS apps running on Apple silicon.
  - woadwarrior01 5mo ago
    That really sucks! TIL. So app attestation is iOS 14.0+, iPadOS 14.0+, tvOS 15.0+ and watchOS 9 only.

jeroenhd 5mo ago

You can probably just tap the HTTP(S) connection to spy on the data coming through. I think it's a mistake to assume any kind of privacy for this service. The biggest argument for remote attestation I can think of is to make sure nobody is returning random bullshit and cashing in prompt money on a massive scale.