💸💸 Help me contribute to KDE and do these videos: 💸💸Paypal: https://paypal.me/niccolovePatreon: https://www.patreon.com/niccoloveLiberapay: https://liber...
i don’t quite get why can’t the attester just… lie… about who he is
like if I’m using firefox on linux, why cant my linux attester claim to be actually windows attester and say I’m using chrome?
I am not an expert, but it’s likely signed and cryptographically secured. Change a single byte in the be Browser executable and your browser goes on the naughty list. This is total lockdown of the browser, and in principle you can extend certification of both software and hardware all the way down through the OS into the hardware.
If you are on android or ios the phone already cryptografically verifies that the operating system has not been tampered with on a hardware level. Since the operating system is then “trusted” it can verify anything you do on it
i don’t quite get why can’t the attester just… lie… about who he is like if I’m using firefox on linux, why cant my linux attester claim to be actually windows attester and say I’m using chrome?
I am not an expert, but it’s likely signed and cryptographically secured. Change a single byte in the be Browser executable and your browser goes on the naughty list. This is total lockdown of the browser, and in principle you can extend certification of both software and hardware all the way down through the OS into the hardware.
The same host could fake the payload to the attestation server. Cat and mouse game with security through obscurity.
If you are on android or ios the phone already cryptografically verifies that the operating system has not been tampered with on a hardware level. Since the operating system is then “trusted” it can verify anything you do on it
Doesn’t work. It’s possible to let many banking apps think they are running on a normal device although it is rooted.