Hacker News Reader

Comment by acdha | Hacker News Reader

That’s overstating what happened there and what was sent. OCSP validation happened only for signed executables and the only bit of information is the hash of the developer certificate being verified, which was not logged in conjunction with your IP.

https://arstechnica.com/gadgets/2020/11/mac-certificate-chec...

Typically when there are concerns about phoning home it’s both more detailed information and something being traceable back to an individual.

View on HN

There are a lot of good explanations in my link why the current setup is outrageous, including the danger of deanonymization of Tor users by Apple.

There’s a lot of uninformed speculation, you mean. The Tor part, for example, was guessing which was not correct.

How is this not correct? Apple knows when I open Tor browser, which enables a timing attack.

Apple knows that a Mac user checked the revocation status of the TOR Project’s signing key. They don’t log your IP, your Mac caches the result so it’s not even every time you launch the browser, and if knowing when your browser was launched is a successful timing attack it means the TOR protocol is too broken to be used – which I rather doubt is true regardless of what random commenters may confidently assert.

If the App is delivered outside of the Mac App Store, then you could just verify the signature, then resign / replace it with a local one (using the "codesign" tool). Dealing with OTA updates after you've done this might take a bit more effort.

Resigning will appease Gatekeeper. As a result there will be no X.509 compliant OCSP checks made for the developer certificate - because it won't be there any more.

The Tor browser folks could do this as a privacy and security feature for you.

Reply on news.ycombinator.com