4 ms·

> If Android wants to join the party, then Android phone builders need to implement secure boot with hardware-signed attestation of non-rooted-ness, in the styl

> If Android wants to join the party, then Android phone builders need to implement secure boot with hardware-signed attestation of non-rooted-ness, in the style of Apple T2 + macOS or Microsoft Pluton + Secure Boot. Until then, Apple iMessage will remain single platform. This exists and has existed for years, via the SafetyNet Attestation API [1]. [1]: https://developer.android.com/training/safetynet/attestation https://developer.android.com/training/safetynet/attestation

altairprime 4y ago
As indicated elsethread, that API doc expressly declares near the top that it is not usable for device identifiers. Without device identifiers, there is no way to stop spammers.
- dcow 4y ago
  1. No, you don't need device IDs to stop spammers. 2. I don't think you know what you're talking about. Android supports the device attestation: https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation > ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI. https://datatracker.ietf.org/doc/draft-bweeks-acme-device-attest/ https://datatracker.ietf.org/doc/draft-bweeks-acme-device-at... It feels like you've concocted some narrative to support your incredibly speculative original comment about how Apple does this because spam. You're clearly wrong. You can do attested compute on Android as others have been trying to point out.
  - altairprime 4y ago
    Okay, I’ll assume you’re right, which considerably worsens the case for RCS: Google could have given us device-signed messaging with RCS, so that users and carriers could block devices for spamming regardless of the source address. Google didn’t. They had the power to do so in RCS using their own APIs, and yet they chose not to offer an effective protection. How is this failure by Google a selling point for RCS? Why would anyone consider RCS at all without device attestation? We don’t need yet another abuse-laden, unidentifiable-source chat protocol. We need a material improvement in quality of life for users, not a veneer of fancy bells and whistles on top of the same plague of spam as today.
    - dcow 4y ago
      Maybe your hypothesis that device attestation is the answer to spam is just… wrong? Maybe Google doesn't think you need device attestation to manage spam on a messaging platform. There are numerous examples of apps today that don’t suffer from spam and don’t use device attestation. And there are examples of spam on iMessage. Furthermore, I can already receive messages on my iPhone from non-iMessage users so I don’t even understand how any of what you’re saying makes sense in the first place. RCS is a protocol (not a platform) that would make the experience of receiving those messages better. It does not add some new attack vector for spammers. Have you tried using a device with an RCS messenger app and been plagued with spam more-so than on iPhone? I switch between devices all the time and have not noticed any difference. It’s not about spam. It’s about Apple playing lazy/dirty. Hence the OP.
- tadfisher 4y ago
  I was replying to this assertion: > If Android wants to join the party, then Android phone builders need to implement secure boot with hardware-signed attestation of non-rooted-ness, in the style of Apple T2 + macOS or Microsoft Pluton + Secure Boot. You didn't mention device IDs.
  - dcow 4y ago
    OP clearly doesn't know what they're talking about either, because Android supports signed hardware ID attestation too.

altairprime 4y ago

As indicated elsethread, that API doc expressly declares near the top that it is not usable for device identifiers. Without device identifiers, there is no way to stop spammers.

dcow 4y ago
1. No, you don't need device IDs to stop spammers. 2. I don't think you know what you're talking about. Android supports the device attestation: https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation > ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI. https://datatracker.ietf.org/doc/draft-bweeks-acme-device-attest/ https://datatracker.ietf.org/doc/draft-bweeks-acme-device-at... It feels like you've concocted some narrative to support your incredibly speculative original comment about how Apple does this because spam. You're clearly wrong. You can do attested compute on Android as others have been trying to point out.
- altairprime 4y ago
  Okay, I’ll assume you’re right, which considerably worsens the case for RCS: Google could have given us device-signed messaging with RCS, so that users and carriers could block devices for spamming regardless of the source address. Google didn’t. They had the power to do so in RCS using their own APIs, and yet they chose not to offer an effective protection. How is this failure by Google a selling point for RCS? Why would anyone consider RCS at all without device attestation? We don’t need yet another abuse-laden, unidentifiable-source chat protocol. We need a material improvement in quality of life for users, not a veneer of fancy bells and whistles on top of the same plague of spam as today.
  - dcow 4y ago
    Maybe your hypothesis that device attestation is the answer to spam is just… wrong? Maybe Google doesn't think you need device attestation to manage spam on a messaging platform. There are numerous examples of apps today that don’t suffer from spam and don’t use device attestation. And there are examples of spam on iMessage. Furthermore, I can already receive messages on my iPhone from non-iMessage users so I don’t even understand how any of what you’re saying makes sense in the first place. RCS is a protocol (not a platform) that would make the experience of receiving those messages better. It does not add some new attack vector for spammers. Have you tried using a device with an RCS messenger app and been plagued with spam more-so than on iPhone? I switch between devices all the time and have not noticed any difference. It’s not about spam. It’s about Apple playing lazy/dirty. Hence the OP.
tadfisher 4y ago
I was replying to this assertion: > If Android wants to join the party, then Android phone builders need to implement secure boot with hardware-signed attestation of non-rooted-ness, in the style of Apple T2 + macOS or Microsoft Pluton + Secure Boot. You didn't mention device IDs.
- dcow 4y ago
  OP clearly doesn't know what they're talking about either, because Android supports signed hardware ID attestation too.