zlacker

Apple already shipped attestation on the web, and we barely noticed

submitted by pimter+(OP) on 2023-07-25 14:10:12 | 596 points 408 comments
[view article] [source] [go to bottom]

NOTE: showing posts with links only show all posts
4. gjsman+p2[view] [source] 2023-07-25 14:20:35
>>pimter+(OP)
Called it out a year ago: >>32282305
5. dispos+13[view] [source] 2023-07-25 14:23:42
>>pimter+(OP)
It looks like this can be disabled (on iOS)[1]:

- Go to Settings

- Select your user account at the top

- Go to 'Password & Security'

- Scroll down to Advanced and disable 'Automatic Verification'

1. https://blog.cloudflare.com/how-to-enable-private-access-tok...

◧◩◪◨
8. cj+L3[view] [source] [discussion] 2023-07-25 14:26:36
>>superk+S1
https://www.smashingmagazine.com/2021/08/http3-core-concepts...

> While TLS 1.3 can still run independently on top of TCP, QUIC instead sort of encapsulates TLS 1.3. Put differently, there is no way to use QUIC without TLS; QUIC (and, by extension, HTTP/3) is always fully encrypted.

Basically there is no HTTP/3 without a TLS certificate.

I'm not sure what "problems that might arise from centralization" might be. There are many different TLS certificate providers from different CA roots.

Is your gripe that you don't like TLS? Judging by how long the migration from TLS 1.1 to 1.2 took, I assume we're at least 10-15 years away from a world where everything is encrypted by default without backwards compatibility (if we ever get there at all).

◧◩◪◨⬒⬓⬔
20. capabl+S5[view] [source] [discussion] 2023-07-25 14:34:41
>>packet+15
https://zerossl.com/ is a popular alternative. https://www.buypass.com/ is another one I haven't personally tried.
◧◩
25. though+g6[view] [source] [discussion] 2023-07-25 14:35:40
>>dispos+13
You can turn it off in macOS 13 as well.

https://support.apple.com/en-us/HT213449

System Settings->iCloud Settings (your name)->Password & Security->Automatic Verification.

◧◩
26. capabl+r6[view] [source] [discussion] 2023-07-25 14:36:36
>>gooob+05
Pretty clear from the announcement ("Challenge: Private Access Tokens" - June 9, 2022 - https://developer.apple.com/news/?id=huqjyh7k):

> Private Access Tokens are powerful tools that prove when HTTP requests are coming from legitimate devices without disclosing someone's identity

The value add is pretty clear and good, but the downsides are probably bigger than the value add, so personally I wouldn't say the compromise is worth it.

◧◩
45. shuckl+b9[view] [source] [discussion] 2023-07-25 14:47:13
>>Santos+94
So far, Private Access Tokens are not widely adopted so you can get a feel for the potential Linux experience by browsing the web with iCloud Private Relay enabled. This flags almost every website's anti-spam classifiers, and you end up having to do 3-5 captchas to access anything protected by one. Wikipedia also blocks you from editing: https://meta.wikimedia.org/wiki/Talk:Apple_iCloud_Private_Re....
◧◩◪◨⬒⬓
53. foul+R9[view] [source] [discussion] 2023-07-25 14:49:47
>>superk+T5
Security measures like Cloudflare anti-DDOS reverse proxy rely precisely on widespread TLS, can deny access to any client not performing sanctioned TLS handshake (like curl, scrapers, or even old browsers which by chance can do TLS 1.2).

https://github.com/lwthiker/curl-impersonate

◧◩
59. agwa+ga[view] [source] [discussion] 2023-07-25 14:51:29
>>superk+h1
There are two reasons this is not comparable to the remote attestation proposal that Google is currently proposing:

1. The only things that WebPKI CAs are required to attest to is that domain validation was properly completed and that the private key is not compromised. The system is designed (in both intent and practice) for any website to be able to easily get a certificate, and even the most untrustworthy, undesirable websites can and do get certificates on the regular. In contrast, Google's remote attestation proposal is clearly intended to assess the trustworthiness/desirability of the client.

2. The TLS requirement imposes a burden on website operators but provides a clear benefit for end users, which is totally in line with the Internet's Priority of Constituencies[1]. In contrast, Google's attestation proposal places a burden on end uses for the benefit of website operators, which violates the Priority of Constituencies.

Additionally, I must note that Firefox also requires a TLS certificate for HTTP/3 (as they did for HTTP/2). Not sure why you'd omit Mozilla from your list of browser makers doing this, but it's a misrepresentation to imply that this is something only "mega-corp browsers" do, when there is actually broad agreement that this is a good thing.

[1] https://datatracker.ietf.org/doc/html/rfc8890

65. chrjxn+za[view] [source] 2023-07-25 14:52:24
>>pimter+(OP)
Does Microsoft already do this with Edge,Safari, and Chrome?

https://learn.microsoft.com/en-us/azure/active-directory/con...

◧◩◪
67. kiratp+Ba[view] [source] [discussion] 2023-07-25 14:52:34
>>dangus+F8
Explanation in relatively straightforward form: https://developer.apple.com/wwdc22/10077

Don’t shoot the messenger!

◧◩◪◨⬒
102. bongob+8f[view] [source] [discussion] 2023-07-25 15:08:36
>>N19PED+vb
https://en.wikipedia.org/wiki/Web_compatibility_issues_in_So...

https://web.archive.org/web/20230309020227/https://www.nytim...

https://www.theregister.com/2020/12/10/south_korea_activex_c... (2020)

> South Korea knew it had an ActiveX problem way back in 2015, because even then the need to use ActiveX to do business on local websites irked outsiders.

> For locals, the requirement to run the code was so annoying that getting rid of it became an election promise at the nation’s 2017 presidential election.

> That promise has now been delivered: the nation’s Ministry of Science and ICT today (2020) annnouced the service’s planned demise.

Banks might not, but the governments may come to a similar idea, and tell the banks to tell you.

◧◩◪
138. Mayeul+Zj[view] [source] [discussion] 2023-07-25 15:28:02
>>daniel+kf
It reminds me of the "cozy web" concept, which is defined as walled gardens with community gatekeepers, such as group chats. Small bubbles where you feel safe and not exposed to outside trolls, corporate or advertisers.

https://maggieappleton.com/cozy-web

◧◩
140. tamimi+ck[view] [source] [discussion] 2023-07-25 15:28:54
>>fxtent+zc
ahmm, I did the robot arm already in a previous project where you can control all the fingers remotely over the the internet, we just need to figure out the streaming part and we got ourselves a startup :)

>https://tamim.io/random_shares/robot_arm_over_internet_tamim...

◧◩
146. VoxPel+Mk[view] [source] [discussion] 2023-07-25 15:31:12
>>tamimi+1g
It is an open standard: https://datatracker.ietf.org/doc/html/draft-ietf-privacypass...

"Privacy Pass tokens are unlinkable, one-time-use authenticators that can be used to anonymously authorize a client"

People from Apple, Google and Cloudflare are all editors of the spec and eg Fastly has also blogged about it: https://www.fastly.com/blog/private-access-tokens-stepping-i...

Excerpt from Fastly's article above:

> When you put this together, no one entity can link client identity to website activity. And yet, this authorizes access to a website – all while eliminating human interactions.

◧◩
175. wyldfi+Cr[view] [source] [discussion] 2023-07-25 15:54:25
>>Santos+94
Cory Doctorow's keynote from 28C3 is prescient - "The coming war on general computation" [1]

[1] https://github.com/jwise/28c3-doctorow/blob/master/transcrip...

◧◩◪
224. kccqzy+tM[view] [source] [discussion] 2023-07-25 16:59:24
>>acedTr+HH
PATs are a draft standard with participation by companies other than Apple (such as Fastly and Cloudflare and Google): https://www.ietf.org/archive/id/draft-private-access-tokens-...
257. conrad+o21[view] [source] 2023-07-25 17:53:46
>>pimter+(OP)
The author is referring to this standard: https://privacypass.github.io/

Apple uses it for its iCloud Private Relay service. The blind token is used so that Cloudflare can verify that a given device pays for iCloud Private Relay without revealing their identity.

Attestation is when such a blind token is proving the integrity of the software running on the device, not proving arbitrary properties. Privacy Pass could actually enable a fast, semi-decentralized system of anonymizing proxies.

If Apple exposed the “is System Integrity Protection enabled” bit to the web, then that amounts to attestation to me. But yes, Apple can do this whenever it wants, and companies want Apple to do it, and it’s scary. They’ve already done this for Apple Pay, Widevine and HDCP.

◧◩
261. isodev+a61[view] [source] [discussion] 2023-07-25 18:05:52
>>modele+nD
It’s really not the same intention or implementation.

We should also consider that Apple’s solution is a way to distinguish between human vs. Non human users on an Apple device. It doesn’t allow a service to randomly lockout browsers and/or OS (which Google’s proposal does), just that if you’re already on your Apple device, you don’t have to do a “verify I’m a human” captcha.

cf. https://developer.apple.com/wwdc22/10077

◧◩
283. saurik+8e1[view] [source] [discussion] 2023-07-25 18:35:47
>>conrad+o21
FWIW, Cloudflare also seems confused, so it is no wonder that we are? :(

https://blog.cloudflare.com/private-attestation-token-device...

> At WWDC 2022, Apple announced Private Attestation Tokens. Today, we’re announcing that Cloudflare Access will support verifying a Private Attestation token. This means that security teams that rely on Cloudflare Access can verify a user’s Apple device before they access a sensitive application — no additional software required.

> Private Attestation Tokens do not require any additional software to be installed on the user’s device. This is because the “attestation” of device health and validity is attested directly by the device operating system’s manufacturer — in this case, Apple.

> This means that a security team can use Cloudflare Access and Private Attestation Tokens to verify if a user is accessing from a “healthy” Apple device before allowing access to a sensitive corporate application. Some checks as part of the attestation include:

> Is the device on the latest OS version?

> Is the device jailbroken?

> Is the window attempting to log in, in focus?

> And much more.

◧◩◪◨
332. howint+M32[view] [source] [discussion] 2023-07-25 22:17:32
>>bachme+CA1
Apple captures 85% of the profit share of the worldwide phone market, as Apple websites love to trumpet: https://appleinsider.com/articles/23/02/03/apple-collects-ne...
◧◩
334. bsder+g72[view] [source] [discussion] 2023-07-25 22:34:44
>>modele+nD
1) Not being an Apple user for exactly this kind of reason means I had no idea Apple had done this.

2) Apple users being willing to sell themselves down the drain is nothing new.

However, this is shit irrespective of who does it. Period.

Obligatory repost of "The Right to Read": https://www.gnu.org/philosophy/right-to-read.en.html

◧◩◪◨
335. consum+S82[view] [source] [discussion] 2023-07-25 22:42:50
>>mander+vG1
I thought DJI required sideloading on Android. Is this not the case anymore?

https://old.reddit.com/r/dji/comments/w8mkdd/why_must_the_dj...

◧◩◪◨
348. agwa+al2[view] [source] [discussion] 2023-07-26 00:15:50
>>superk+dX1
Mozilla was the first browser maker to announce an intent to deprecate non-secure HTTP[1]. Even if they keep HTTP/1.1 support, at some point they will require TLS for it, just as they already do for HTTP/2. This is not something new with HTTP/3 nor is it some big-corp conspiracy.

[1] https://blog.mozilla.org/security/2015/04/30/deprecating-non...

357. icantb+ND2[view] [source] 2023-07-26 03:09:20
>>pimter+(OP)
Apropos of nothing, TIL some Apple iOS devices have a “Lockdown Mode” to be used in critical circumstances.

https://support.apple.com/en-ca/HT212650

“Lockdown Mode is an optional, extreme protection that’s designed for the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats. Most people are never targeted by attacks of this nature.”

However evil they are, privacy/security appears to be a case of putting their money where their mouth is. Interesting.

◧◩◪◨
365. pmontr+mU2[view] [source] [discussion] 2023-07-26 06:10:13
>>philis+Da2
That lasted only 5 years. According to Wikipedia the first release was on June 11 2007 and the last one was on May 9 2012.

https://en.wikipedia.org/wiki/Safari_version_history

I found this press release from 2007 https://www.apple.com/uk/newsroom/2007/06/11Apple-Introduces...

“We think Windows users are going to be really impressed when they see how fast and intuitive web browsing can be with Safari”, said Steve Jobs, Apple's CEO. “Hundreds of millions of Windows users already use iTunes, and we look forward to turning them on to Safari's superior browsing experience too”.

History demonstrates that actually they didn't and Apple gave up quickly.

Interestingly they also have some benchmark

> [Safari] now it's the fastest browser on Windows, loading and drawing web pages up to twice as fast as Microsoft Internet Explorer 7 and up to 1.6 times faster than Mozilla Firefox 2 (*)

but by reading the more we learn that they benchmarked Safari on a Mac and the other two browsers on a Windows machine.

◧◩◪◨
368. mike_h+D53[view] [source] [discussion] 2023-07-26 07:52:45
>>rat998+Wp1
Just read this thread: >>36854114

A few choice comments:

"I recommend finding everyone responsible for this and exercising your right to free speech on them. It works for politicians, and it should work on this other flavour of bastard too."

"I believe both of these users are acting in very-bad-faith, and not correctly observing any ethical codes of conduct in Engineering."

"As far as I am concerned the reputation of this Ben Wiser guy is so far down the toilet that there’s practically nothing he can do or say to recover it. Like the old joke goes “you screw a goat once…”"

"The people involved in this concept/idea/proposal should be shamed into retirement. They should never work in the tech sector again. They should be afraid to use their names before first knowing their audience (an agricultural audience would likely be OK)."

"sometimes I don't think constructive replies are appropriate or possible. "

"Magnitude of the malfeasance is so great they deserve to be held to account for it"

And lots more.

I'm pretty sure beyond the personalization of the issue, 90% of the difference here can be explained by ad blockers. There's no deep technical or philosophical principle at work in most of those comments but what's clearly shining through is that tech people block ads a lot, feel they have a right to do so and will get furious at any attempt to stop them. Apple doesn't care about click fraud, ad blocking or spam on the web because those are other people's problems so they limit their remote attestation to the CAPTCHA reduction use case. This use case has the advantage that it improves the browsing experience for Apple users only. HN posters dislike CAPTCHAs as much as the next guy, so nobody cares. But Google want there to be lots of web content that's free to access so also concerns itself with the publisher side of the web, not just the consumer side. They list more use cases and ask for feedback, there are more consumers than creators, so surprise surprise, they get a lot of hate.

◧◩◪◨
372. lioete+pp3[view] [source] [discussion] 2023-07-26 10:57:38
>>xorcis+922
https://media.ccc.de/v/22C3-920-en-we_lost_the_war
377. Alifat+oQ3[view] [source] 2023-07-26 13:24:41
>>pimter+(OP)
Oh, it's not only on iOS [1]. It's Android too [2].

1. https://developer.apple.com/documentation/devicecheck/valida...

2. https://developer.android.com/google/play/integrity

◧◩◪
384. meandm+A14[view] [source] [discussion] 2023-07-26 14:07:20
>>dahwol+BP1
It actually does, that's entirely it's purpose.. I know it takes a little effort to actually go and research yourself, but here you go https://developer.apple.com/videos/play/wwdc2022/10077/
◧◩◪
386. meandm+034[view] [source] [discussion] 2023-07-26 14:13:14
>>helloj+lE1
Again, you need only research and find they are designed independently not to allow this https://developer.apple.com/videos/play/wwdc2022/10077/
◧◩◪◨
397. fsflov+6f7[view] [source] [discussion] 2023-07-27 07:52:33
>>philwe+XJ3
They both collect a lot of "telemetry" [0] and sell ads [1].

[0] >>26639261

[1] >>32461690 , >>28897027 .

[go to top]