8 ms·
OK, but remote attestation isn't really a thing on the web (right now). And you can script a browser UI, anyway. The point is to not get hung up on the client
by CameronNemo 3y ago
OK, but remote attestation isn't really a thing on the web (right now). And you can script a browser UI, anyway.
The point is to not get hung up on the client as a security boundary (it isn't, can't be, won't be), but to focus on the actual harm -- excessive use of the limited resources provided.
And you have to frame your security posture as rooted in the server side throttling, heuristics, et cetera. Flipping out because the client isn't what you expected isn't going to help (determined attackers can look like "vanilla" clients), and is just going to harm the long tail of actual users who are not bots.
- true_religion 3y agoIt will also harm the short tail of bots who aren’t run by dedicated attackers.
- jeroenhd 3y ago> OK, but remote attestation isn't really a thing on the web (right now) I mean, it's built into Safari and Cloudflare supposedly uses it for its CAPTCHAs: https://developer.apple.com/news/?id=huqjyh7k https://developer.apple.com/news/?id=huqjyh7k It's not as invasive as Google's attempt to circumvent ad blockers, but it's still a remote attestation system implemented in the wild already.
- Obscurity4340 3y ago> built into Safari Is it really built into Safari, or are you referring to the iCloud option that "privately" helps reduce Cloudflare demands?
- jeroenhd 3y agoPrivate Access Tokens are built into Safari. Apple gives their devices a certain amount of tokens, and Cloudflare validates them. If Apple doesn't like your device, you won't get any more tokens. Cloudflare also hands out tokens if you install their browser addon. The two companies are working together to make this an official web standard, but I haven't heard about it for a while. Maybe they're just laying low after seeing the blowback on Google's (worse) attempts at attesting devices.