You know captchas? They’re there because bot activity can be really hard to moderate. So those are there to test if there’s an actual human talking to the website: They try to give a test that only a human can do. The problem is, now that machine learning models can actually do some of those things, like read handwritten words and identify cars vs bikes, we need a new test that only humans can pass. Also, these captchas are annoying to users, and if you’re a website that runs off of clicks and ads, a captcha might piss off a user and they leave, and you get to show fewer ads.
So, the people running a website have a need to stave off bot traffic, but also not piss off real, legitimate human traffic. One solution is “attestation”, which basically means getting someone else to attest, or plead on your behalf, that you are running on an unmodified device. In a perfect world, Apple would like their phones to be so incredibly locked down that you can only do things that they allow. One of those things would be using an iPhone to do bot stuff. So, since Apple controls what software runs on your iPhone, they can (in theory) prevent you from running bot software. This means that iPhone users would be (in theory) guaranteed safe human traffic. But if you’re a website owner, how do you know that the request is actually coming from an iPhone? Simple. Request the device ID from the iPhone, and ask a question that only an iPhone would know the answer to. This is essentially what web attestation is. From the article: “a way that web servers can demand your device prove it is a sufficiently ‘legitimate’ device before browsing the web” and “your treatment on the web depends on whether Apple says your device, OS & browser configuration are legitimate & acceptable.”
This has significant implications for the openness of the device you use, as well as the control that you as a user have over how you use the web. The primary example would be adblockers. Apple and Google get to say whether you’re human or not, so if you have an adblocker, Google can just say “no, I won’t attest that this user is human” and you’ll get treated differently. It’s not difficult to imagine a world in which Youtube would just refuse to serve users who aren’t 100% trustworthy, given their recent adblocker experiment.
tl;dr: Instead of captchas, ask the device if it’s real and unmodified. See above for why this is bad.
Hypothetically, I wonder if it would be possible to spoof this if you also had an actual unmodified attested device. Something like a device in your home network that would, if you have an iPhone as well as an unattested computer that you actually want to use: get request for attestation from a website, send that request to your iphone instead, as if your iphone had opened the page and was receiving the request (or just have the iphone also try to load the page), intercept the signature the iphone sends to the website, and have your computer send it to the website instead.
You know captchas? They’re there because bot activity can be really hard to moderate. So those are there to test if there’s an actual human talking to the website: They try to give a test that only a human can do. The problem is, now that machine learning models can actually do some of those things, like read handwritten words and identify cars vs bikes, we need a new test that only humans can pass. Also, these captchas are annoying to users, and if you’re a website that runs off of clicks and ads, a captcha might piss off a user and they leave, and you get to show fewer ads.
So, the people running a website have a need to stave off bot traffic, but also not piss off real, legitimate human traffic. One solution is “attestation”, which basically means getting someone else to attest, or plead on your behalf, that you are running on an unmodified device. In a perfect world, Apple would like their phones to be so incredibly locked down that you can only do things that they allow. One of those things would be using an iPhone to do bot stuff. So, since Apple controls what software runs on your iPhone, they can (in theory) prevent you from running bot software. This means that iPhone users would be (in theory) guaranteed safe human traffic. But if you’re a website owner, how do you know that the request is actually coming from an iPhone? Simple. Request the device ID from the iPhone, and ask a question that only an iPhone would know the answer to. This is essentially what web attestation is. From the article: “a way that web servers can demand your device prove it is a sufficiently ‘legitimate’ device before browsing the web” and “your treatment on the web depends on whether Apple says your device, OS & browser configuration are legitimate & acceptable.”
This has significant implications for the openness of the device you use, as well as the control that you as a user have over how you use the web. The primary example would be adblockers. Apple and Google get to say whether you’re human or not, so if you have an adblocker, Google can just say “no, I won’t attest that this user is human” and you’ll get treated differently. It’s not difficult to imagine a world in which Youtube would just refuse to serve users who aren’t 100% trustworthy, given their recent adblocker experiment.
tl;dr: Instead of captchas, ask the device if it’s real and unmodified. See above for why this is bad.
Brilliant, thank you for this dark information. I appreciate the effort
Hypothetically, I wonder if it would be possible to spoof this if you also had an actual unmodified attested device. Something like a device in your home network that would, if you have an iPhone as well as an unattested computer that you actually want to use: get request for attestation from a website, send that request to your iphone instead, as if your iphone had opened the page and was receiving the request (or just have the iphone also try to load the page), intercept the signature the iphone sends to the website, and have your computer send it to the website instead.