Comment

Comment on Google's Web DRM is Worse than I Thought...

SparkyLight@lemmy.world ⁨10⁩ ⁨months⁩ ago

i don’t quite get why can’t the attester just… lie… about who he is like if I’m using firefox on linux, why cant my linux attester claim to be actually windows attester and say I’m using chrome?

source

Sort:hotnew top

chaospatterns@lemmy.world ⁨10⁩ ⁨months⁩ ago
Attestation depends on a few things:

The website has to choose to trust a given attestation provider. If Open Source Browser Attestation Provider X is known for freely handing out attestations then websites will just ignore them

The browser’s self-attestation. This is tricky part to implement. I haven’t looked at the WEI spec to see how this works, but ultimately it depends on code running on your machine identifying when it’s been modified. In theory, you can modify the browser however you want, but it’s likely that this code will be thoroughly obfuscated and regularly changing to make it hard to reverse engineer. In addition, there are CPU level systems like Intel SGX that provide secure enclaves to run code and a remote entity can verify that the code that ran in SGX was the same code that the remote entity intended to run.

If you’re on iOS or Android, there’s already strong OS level protections that a browser attestation can plugin to (like SafetyNet.)
source
Dark_Arc@lemmy.world ⁨10⁩ ⁨months⁩ ago
Web of trust, the site only trusts certain attesters (yes this would be really bad for Linux).

source
- vacuumflower@lemmy.sdf.org ⁨10⁩ ⁨months⁩ ago
  Every time somebody calls this “web of trust” I feel the need to remind that really Web of Trust is a system of, well, decentralized manual trust, like with PGP. Like in Retroshare or Freenet for some people.
  
  Every such attempt at replacing the actually relevant meaning of a thing which is still good and needed is suspicious.
  
  source
  - Dark_Arc@lemmy.world ⁨10⁩ ⁨months⁩ ago
    Gah, I actually meant chain of trust… Oops…
    
    source