Apple already shipped attestation on the web, and we barely noticed

• 28c3-doctorow

  3 110 10.0

  Transcription of Cory Doctorow's keynote from 28C3.

Cory Doctorow's keynote from 28C3 is prescient - "The coming war on general computation" [1]

[1] https://github.com/jwise/28c3-doctorow/blob/master/transcrip...

• challenge-bypass-extension

  36 1,241 5.0 JavaScript

  DEPRECATED - Client for Privacy Pass protocol providing unlinkable cryptographic tokens

  

The author is referring to this standard: https://privacypass.github.io/

Apple uses it for its iCloud Private Relay service. The blind token is used so that Cloudflare can verify that a given device pays for iCloud Private Relay without revealing their identity.

Attestation is when such a blind token is proving the integrity of the software running on the device, not proving arbitrary properties. Privacy Pass could actually enable a fast, semi-decentralized system of anonymizing proxies.

If Apple exposed the “is System Integrity Protection enabled” bit to the web, then that amounts to attestation to me, and yes: Apple can do it whenever it wants, and people want Apple to do it.

• SurveyJS

  surveyjs.io sponsored

  Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App. With SurveyJS form UI libraries, you can build and style forms in a fully-integrated drag & drop form builder, render them in your JS app, and store form submission data in any backend, inc. PHP, ASP.NET Core, and Node.js.

  

Suggest a related project