News for hackers. Stuff that matters.

A comment on Does Apple really log every app you run? A technical look. Parent comment

Re:Does Apple really log every app you run? A technical look by est31 on Saturday November 14, 2020 @07:16PM (#25096899)
As the set of certificates is bounded and known by apple, they can also adopt crlite and just push all CRLs they have to all users, using CRLite.

https://github.com/mozilla/crlite

[ Parent | on HN ]
Re:Does Apple really log every app you run? A technical look by remram on Saturday November 14, 2020 @10:04PM (#25097857)
I assumed there were too many revoked certificates for something like this to be viable, but I'm not surprised it is.

You probably can't update the whole list that often though, compared to Apple's current OCSP revalidate time of 5 min. [edit: seems "delta patches" are supported by crlite so maybe that can work too]

[ Parent | on HN ]
Re:Does Apple really log every app you run? A technical look by est31 on Saturday November 14, 2020 @10:37PM (#25098021)
> I assumed there were too many revoked certificates for something like this to be viable, but I'm not surprised it is.

Given that Apple currently doesn't even encrypt the requests during transit, I think they just didn't pay much attention to the problem, which I think the main reason is why they haven't adopted it yet. As for the number of revoked certificates, I'm not sure it's larger than the number of revoked TLS certificates, given that there are way more websites out there than there are registered apple developers.

[ Parent | on HN ]