3 ms·
Right. Apple is perfectly capable of doing remote attestation properly. iOS has DCAppAttest which does everything needed. Unfortunately, it's never been brough
by mike_hearn 6mo ago
Right.
Apple is perfectly capable of doing remote attestation properly. iOS has DCAppAttest which does everything needed. Unfortunately, it's never been brought to macOS, as far as I know. Maybe this MDM hack is a back door to get RA capabilities, if so it'd certainly be intriguing, but if not as far as I know there's no way to get a Mac to cough up a cryptographic assertion that it's running a genuine macOS kernel/boot firmware/disk image/kernel args, etc.
It's a pity because there's a lot of unique and interesting apps that'd become possible if Apple did this. Darkbloom is just one example of what's possible. It'd be a huge boon to decentralization efforts if Apple activated this, and all the pipework is laid already so it's really a pity they don't go the extra mile here.
- woadwarrior01 6mo ago> iOS has DCAppAttest which does everything needed. Unfortunately, it's never been brought to macOS, as far as I know. Apple's docs claim it's been available on macOS since macOS 11. Am I missing something here? https://developer.apple.com/documentation/devicecheck/dcappattestservice https://developer.apple.com/documentation/devicecheck/dcappa...
- mike_hearn 6mo agoAll lies. They mean the symbols exist and can be linked against, but https://developer.apple.com/documentation/devicecheck/dcappattestservice/issupported https://developer.apple.com/documentation/devicecheck/dcappa... > If you read isSupported from an app running on a Mac device, the value is false. This includes Mac Catalyst apps, and iOS or iPadOS apps running on Apple silicon.
- woadwarrior01 6mo agoThat really sucks! TIL. So app attestation is iOS 14.0+, iPadOS 14.0+, tvOS 15.0+ and watchOS 9 only.