zlacker

[parent] [thread] 1 comments
1. person+(OP)[view] [source] 2023-07-25 07:21:33
This won't even work to solve the problem they're trying to solve. If I'm a scraper or someone that wants to drive fake ad impressions, what stops me from faking the attestation info? There's some mention in the original article about the attester validating the attestation data is signed on the client, but that just pushes the problem down the stack a bit. Someone could still spin up VMs, and just automate the scraping in a real environment that passes attestation. The author is claiming this will ensure only humans are viewing said data, but it doesn't really ensure that, it only adds a couple steps.

I also find it funny that the authors point to mobile platforms as an example of how this will work well. Last time I worked with ad tech, mobile ads were flooded with fake impressions, and I highly doubt that has changed. The funny thing about players like Google is that they want to be able to tell advertisers they're doing a lot to prevent fake impressions to get them to buy ads, but they don't really want to solve the problem because it would cost them a lot of money. So they kinda play the line and develop tech like this that sounds fancy but doesn't actually stop the problem in practice.

replies(1): >>chromo+na1
2. chromo+na1[view] [source] 2023-07-25 15:15:14
>>person+(OP)
I failed to learn how this exactly works, but you're looking for the term 'remote attestation'. This aims to prove that your computer is only running the approved software by having the TPM look into the computer's memory, hash the running software and its configuration and signing the hash with a unique private key burned into the TPM that is impossible to extract without physically invading the chip.
[go to top]