3 ms·
One technique that can help establishing "trusted client" on untrusted platform is TRCE (Trusted Remote Code Execution)[1] The client is required to download a
by vicaya 14y ago
One technique that can help establishing "trusted client" on untrusted platform is TRCE (Trusted Remote Code Execution)[1]
The client is required to download a piece of code from server to compute a result given a challenge from server. You can embed all sorts of logic to validate the client per connection! Think of this as using virus for good :)
[1] I'm getting good at inventing 4 letter security acronyms :)
- kalleboo 14y agoThis is what Blu-Ray's BD+ works. And yet, it's still possible to rip Blu-Ray disks. DRM doesn't work. I guess Twitter could start banning users who are detected running unauthorized clients (like Xbox Live), but that'll get really ugly PR-wise.
- vicaya 14y agoTRCE is fundamentally different from BD+ in that the the code is served remotely instead of locally. That means that the validation code can be changed per connection with unlimited variations. The only way to deal with TRCE is PSB (Perfect SandBox), which is not trivial to implement. Twitter doesn't need to ban unauthorized clients. They can use the detected client info for QoS to give preferential treatment to their own client and render the rest in the "best effort" service class, which could make unauthorized clients appear to work but unreliably.