3 ms·
As I understand it, the Apple devices have a secure element with initialization keys written at time of manufacture, which are then personalized to the user wit
by motohagiography 5y ago
As I understand it, the Apple devices have a secure element with initialization keys written at time of manufacture, which are then personalized to the user with a new/unique set as part of a registration, but verifiable as having being provisioned, so there is a cryptgraphic chain of trust going back to the manufacture of the secure element.
Android is an operating system for a bunch of OEMs who don't have secure elements in their devices, and even ones who do still exist in a fragmented ecosystem where their verification doesn't include ones outside their models. Modern chips have a similar feature, but the key management between manufacturers is an unsolved business problem. There are technical ways to solve it, but higher level interoperability beyond enforced standards has never a high priority for OEMs. The economics haven't been there.
You could make an inferior one for Android devices, but it likely wouldn't be sufficiently secure to handle payments, credit, taxation, fines, social compliance scores, and other use cases for identity. Identity security needs to be strong enough to be used as a stick, and the only carrots it offers are those whose scarcity is artificially managed.
Realistically, if you are attending a university, the cost of an Apple device can just be priced into your loan, and strategically, making university student products consolidate Apple's dominance of the middle class market and up, and as a status symbol of societal membership, sort of how Facebook started in the college system.
I'm skeptical of digital identity companies (as distinct from authentication services) because to me their entire business model reduces to Hollerith machines as a service, so YMMV on this view.
- echelon 5y agoIt sounds like you're advocating for an Apple monopoly here. I'm also laughing that you say Android isn't secure enough to handle payments. Millions of people use it to do so every day.
- motohagiography 5y agoIt's been a few years since I looked at it, but I'd be interested to see the workaround the EMV partners finally used to do tokenization. Last I saw it some years ago, they were persisting what should have been single use keys (SUKs) for multiple transactions (calling them limited LUKs) so that they could handle an offline payment mode. Apple didn't have that problem because of their SE. I'm sure there are lots of Android pay solutions, but the risk profile is very different, the solutions for it are limited, and keys in software has a catastrophic failure mode. What's very likely is Android payment solutions are taking a fraud management approach with some kind of government backstop, as from a technical security perspective, software has hard limits. It's not a monopoly if it's only for university educated people who get access to exclusive services. You can start your own managerialist economy.