Apple Reneged on OCSP Privacy

Re:Apple Reneged on OCSP Privacy by VogonPoetry on Thursday June 16, 2022 @08:42PM (#31772759)

Here is a thing. The endpoint gs.apple.com already supports HTTPS (and on port 433). In fact, a new cert was issued to that endpoint on 23rd Feb 2022 -- before the date of your article. Something was already afoot before you wrote about it. This new cert also contains a custom OID, which could be used for pinning.

It is possible, with an http proxy / pihole to upgrade all of your local network connections to https when speaking to gs.apple.com.

My guess is that a change is coming, but the pieces aren't all in place yet.

[ Parent | on HN ]

Re:Apple Reneged on OCSP Privacy by VogonPoetry on Thursday June 16, 2022 @09:09PM (#31772937)

So I decided to look at the code that implements talking to gs.apple.com on my Mac. It already supports using TLS. If I am reading this correctly, there are ways it could be enabled right now. Out of respect to Apple; as they are clearly not yet ready to enable this for everyone, I am declining to say how.

[ Parent | on HN ]