Apple Addresses Privacy Concerns Surrounding App Authentication in macOS

Re:Apple Addresses Privacy Concerns Surrounding App Authenti... by tgv on Monday November 16, 2020 @05:54AM (#25110312)

There is a very large list of binaries that can potentially be downloaded, each of which can have hundreds or thousands of versions, while the number of known virus fingerprints is relatively small.

[ Parent | on HN ]

Re:Apple Addresses Privacy Concerns Surrounding App Authenti... by aequitas on Monday November 16, 2020 @07:06AM (#25110692)

Apple doesn't check binary hashes but developer certificates these binaries are signed with. Which there are a lot less of (ie. firefox and thunderbird share the same certificate).

[ Parent | on HN ]

Re:Apple Addresses Privacy Concerns Surrounding App Authenti... by tgv on Monday November 16, 2020 @08:20AM (#25111286)

From what I understood, Gatekeeper still sends an application specific hash/ticket when an application is opened, not just a dev certificate (e.g. https://lapcatsoftware.com/articles/catalina-executables.htm...). Did that change in Big Sur?

[ Parent | on HN ]

Re:Apple Addresses Privacy Concerns Surrounding App Authenti... by _qulr on Monday November 16, 2020 @08:47AM (#25111537)

The notarization check is on first launch of an app, but it doesn't occur on subsequent launches, unlike the certificate revocation check.

[ Parent | on HN ]

Re:Apple Addresses Privacy Concerns Surrounding App Authenti... by tgv on Monday November 16, 2020 @10:50AM (#25113114)

But the first lookup would have to stay, with all the implications that the proposed alternative (download a list of all certs/tickets) was meant to overcome.

[ Parent | on HN ]