4 ms·
My point was that CAA's threat model is flexible based on your requirements. If your requirement is "an attacker with the ability to make arbitrary network requ
by insanitybit 4mo ago
My point was that CAA's threat model is flexible based on your requirements. If your requirement is "an attacker with the ability to make arbitrary network requests from the host can not pretend to be Chrome", CAA does not work unless you have OS/Hardware support (which ChromeOS provides).
I just don't think that matters much. CAA is policy enforcement, it is not a full MDM solution, nor is it antimalware.
- Brian_K_White 4mo agoIf it can't prove what it purports to prove, then it is not policy enforcement, because it is not anything enforcement. But someone thinks it is, which is harmful to them on top of being an annoyance to everyone else.
- insanitybit 4mo agoThat's just a misunderstanding of the threat model. It's like saying "if someone can just mitm TLS it's pointless" when that "someone" is in the position to run arbitrary code on the client. Mitigations map to specific attacker positions.