3 ms·

You're assuming the host/client relationship is one way, and that the parties are "independent". In many cases I've seen proposed in research, remote attestatio

You're assuming the host/client relationship is one way, and that the parties are "independent". In many cases I've seen proposed in research, remote attestation is used to secure a single-party app that is spread over multiple devices that the runs their app on. For example, if I run an app, which also requires me to run some code in a container in a data center, I as the client, want to remotely attest that the code in the data center is not running in a tampered fashion. Or perhaps I have my watch, AR glasses, and phone are collaborating, and these three devices come from different manufacturers, and are running different software, and I want to ensure that none of them has been tampered with. And let's not forget IoT devices, which are the killer application I've seen suggested for remote attestation. "with neutral protocols mediating between them". Protocols aren't implementations. There are cases when I am interacting with someone else and I want them to prove their identity to me, including the identity of their software. Maybe I'm running a supposedly secure chat client in an authoritarian state, and I want to know that the chat client they're running isn't a trojan they got from a government security service. You don't need remote attestation to get to the bad places you suggestion. App Stores have been like that for years without attestation. Consoles have been closed down for decades. Relatively simple, unsophisticated copy protection can prevent most people from running what they want, no fancy crypto protocols needed.

mindslight 5y ago
> You're assuming the host/client relationship is one way, and that the parties are "independent". Yes I am, because that is the alarming case. A main use of the "end to end" integrity you talk about will be from powerful centralized companies right to people's eyeballs and fingertips, thus computationally disenfranchising individuals. It's cute to be able to get better security properties out of a cloud host [0], but not really germane to the larger societal effects. And to be honest these things sound like a solution looking for problems. Clouds are for non-personal data only. Devices from different manufacturers should still be representing me and therefore not mutually suspicious. The Internet of Trash is a problem due to lack of updates and open protocols, not a lack of centralized control over those devices. > You don't need remote attestation to get to the bad places you suggest The ill effects you're describing are created by the original "innovation" of treacherous computing, the locked down platform. To solidify that regime of control, you need to keep non-locked-out devices out. That is where remote attestation comes in. Right now if a powerful party that I need to interact with demands to know what software my device is running, I can lie, and make sure my custom client follows what they're expecting so they don't know the difference. They can up the game and lock their client down more and more, but ultimately once someone gets it to spill its secrets, it's fair game for open access. Remote attestation is then a security vulnerability such that I cannot use a third party client and lie about it. In general authoritarianism always looks appealing and will always be framed in terms of the benefits it brings. But it's an anathema to open society that will inevitably be abused by bad actors. [0] furthermore you can never discount that as power coalesces, large businesses won't get exceptions to break various security properties for various necessary-sounding reasons. So independent actors won't even be able to rely on the claimed security properties.

mindslight 5y ago

> You're assuming the host/client relationship is one way, and that the parties are "independent". Yes I am, because that is the alarming case. A main use of the "end to end" integrity you talk about will be from powerful centralized companies right to people's eyeballs and fingertips, thus computationally disenfranchising individuals. It's cute to be able to get better security properties out of a cloud host [0], but not really germane to the larger societal effects. And to be honest these things sound like a solution looking for problems. Clouds are for non-personal data only. Devices from different manufacturers should still be representing me and therefore not mutually suspicious. The Internet of Trash is a problem due to lack of updates and open protocols, not a lack of centralized control over those devices. > You don't need remote attestation to get to the bad places you suggest The ill effects you're describing are created by the original "innovation" of treacherous computing, the locked down platform. To solidify that regime of control, you need to keep non-locked-out devices out. That is where remote attestation comes in. Right now if a powerful party that I need to interact with demands to know what software my device is running, I can lie, and make sure my custom client follows what they're expecting so they don't know the difference. They can up the game and lock their client down more and more, but ultimately once someone gets it to spill its secrets, it's fair game for open access. Remote attestation is then a security vulnerability such that I cannot use a third party client and lie about it. In general authoritarianism always looks appealing and will always be framed in terms of the benefits it brings. But it's an anathema to open society that will inevitably be abused by bad actors. [0] furthermore you can never discount that as power coalesces, large businesses won't get exceptions to break various security properties for various necessary-sounding reasons. So independent actors won't even be able to rely on the claimed security properties.