←back to thread

Apple already shipped attestation on the web, and we barely noticed

(httptoolkit.com)
596 points pimterry | 4 comments | 25 Jul 23 14:10 UTC | HN request time: 0s | source
Show context
disposition2 ◴[25 Jul 23 14:23 UTC] No.36862681[source]▶
It looks like this can be disabled (on iOS)[1]:

- Go to Settings

- Select your user account at the top

- Go to 'Password & Security'

- Scroll down to Advanced and disable 'Automatic Verification'

1. https://blog.cloudflare.com/how-to-enable-private-access-tok...

replies(2): >>36862882 #>>36867033 #
thoughtsimple ◴[25 Jul 23 14:35 UTC] No.36862882[source]▶
You can turn it off in macOS 13 as well.

https://support.apple.com/en-us/HT213449

System Settings->iCloud Settings (your name)->Password & Security->Automatic Verification.

replies(1): >>36863494 #
1. philote ◴[25 Jul 23 15:12 UTC] No.36863494[source]▶
I guess that's only for Safari, but not Chrome if you have that installed as well? Also, what if you never signed into your iCloud account? Is it impossible to disable?
replies(2): >>36863768 #>>36865522 #
2. madeofpalk ◴[25 Jul 23 15:30 UTC] No.36863768[source]▶
It's specifically a Safari technology. Chrome does not implement this.
replies(1): >>36865701 #
3. lapcat ◴[25 Jul 23 17:00 UTC] No.36865522[source]▶
> Also, what if you never signed into your iCloud account? Is it impossible to disable?

If you're not signed in, then it's not enabled, because the iCloud account is essential to the process: "An Apple server validates your device and Apple ID."

4. kevincox ◴[25 Jul 23 17:12 UTC] No.36865701[source]▶
And can't without Apple's blessing as it isn't a "verified" browser.