3 ms·

Because it can snowball from "you may not access Widevine content on an unapproved device", which is of little significance to "you may not connect to the inter

Because it can snowball from "you may not access Widevine content on an unapproved device", which is of little significance to "you may not connect to the internet on a non government approved device" which is extremely dangerous.

Arch-TK 4y ago
It's good to know that other people can see the writing on the wall too. I've told people that this is being made possible. While it is not a guarantee that the availability of the technology will lead to the use of the technology in such a manner, the fact that it will be possible means it's just a matter of time before someone insists on doing this under the pretext of security. The saving grace is that attestations can be forwarded but I'm sure even this will eventually get solved. (And the sheer fact they can be forwarded doesn't diminish the dangers of this use of the technology.)
- no_time 4y ago
  >The saving grace is that attestations can be forwarded That would require you to have root on a "trusted" device so you can extract the challenge-response that proves you are indeed "trusted". Which is becoming increasingly harder with each iteration.
TeMPOraL 4y ago
To preempt the "but slippery slope!" counters, where we're currently at is "you may not use your bank's mobile app on a phone that isn't running genuine, unmodded, unrooted version of the hardware and OS it came with". This is the reality of modern Android devices. And it's not worse only because, like with any API, adoption of new-and-improved Safenet / Play $forgot-the-name APIs takes time. The slippery slope is not a fallacy if the slope is, in fact, slippery.
- Arch-TK 4y ago
  At least so far my bank hasn't prevented me from using my web browser on linux to access the banking website. But I am certain they will once Windows 11 gets enough traction in a few years.
  - TeMPOraL 4y ago
    Yes, websites are still the one place where users have some degree of parity with the vendors. They are, however, being actively phased out. It's a long process, but it's clear. New banks and quasi-banks often don't even have a web portal. Old-school banks have been actively pushing apps as the primary interface. In recent years, they've been pushing apps as preferred auth mechanism for confirming logins and transactions initiated off-app. How long before it'll become the only mechanism?
  - account42 4y ago
    Can you use your web browser for all functions of the banking app? E.g. for my bank the app is the only 2FA option that doesn't come with additional costs.
    - Arch-TK 4y ago
      Yes, I can do everything via the website. But I must use a secure key dongle pinpad thing to log in.
  - vetinari 4y ago
    However, my bank requires second factor for authenticating, when using the banking website. And that second factor used to be SMS, but nowadays it is their banking app on a mobile device. Exactly that one that has to run on "genuine, unmodded, unrooted version of the hardware and OS it came with".
jeroenhd 4y ago
Windows and AMD/Intel doe remote attestation already. This is not a theoretical development, Windows does this. Practically nobody uses Linux as their daily driver and even then the government wouldn't care. DRM and "trust" solutions are already a problem on free operating systems (like the 720p cap on Netflix content). This isn't a slippery slope, this is a vertical surface that was erected over seven years ago when SGX hit the market, just standing there. Luckily the content I watch on Netflix is also freely available through torrents so I don't usually notice the difference, but the DRM fight was lost long ago. Whatever evil things the government is planning on enacting won't be beaten by someone telling the police officers that they use Arch btw.

Arch-TK 4y ago

It's good to know that other people can see the writing on the wall too. I've told people that this is being made possible. While it is not a guarantee that the availability of the technology will lead to the use of the technology in such a manner, the fact that it will be possible means it's just a matter of time before someone insists on doing this under the pretext of security. The saving grace is that attestations can be forwarded but I'm sure even this will eventually get solved. (And the sheer fact they can be forwarded doesn't diminish the dangers of this use of the technology.)

no_time 4y ago
>The saving grace is that attestations can be forwarded That would require you to have root on a "trusted" device so you can extract the challenge-response that proves you are indeed "trusted". Which is becoming increasingly harder with each iteration.

TeMPOraL 4y ago

To preempt the "but slippery slope!" counters, where we're currently at is "you may not use your bank's mobile app on a phone that isn't running genuine, unmodded, unrooted version of the hardware and OS it came with". This is the reality of modern Android devices. And it's not worse only because, like with any API, adoption of new-and-improved Safenet / Play $forgot-the-name APIs takes time. The slippery slope is not a fallacy if the slope is, in fact, slippery.

Arch-TK 4y ago
At least so far my bank hasn't prevented me from using my web browser on linux to access the banking website. But I am certain they will once Windows 11 gets enough traction in a few years.
- TeMPOraL 4y ago
  Yes, websites are still the one place where users have some degree of parity with the vendors. They are, however, being actively phased out. It's a long process, but it's clear. New banks and quasi-banks often don't even have a web portal. Old-school banks have been actively pushing apps as the primary interface. In recent years, they've been pushing apps as preferred auth mechanism for confirming logins and transactions initiated off-app. How long before it'll become the only mechanism?
- account42 4y ago
  Can you use your web browser for all functions of the banking app? E.g. for my bank the app is the only 2FA option that doesn't come with additional costs.
  - Arch-TK 4y ago
    Yes, I can do everything via the website. But I must use a secure key dongle pinpad thing to log in.
- vetinari 4y ago
  However, my bank requires second factor for authenticating, when using the banking website. And that second factor used to be SMS, but nowadays it is their banking app on a mobile device. Exactly that one that has to run on "genuine, unmodded, unrooted version of the hardware and OS it came with".

jeroenhd 4y ago

Windows and AMD/Intel doe remote attestation already. This is not a theoretical development, Windows does this. Practically nobody uses Linux as their daily driver and even then the government wouldn't care. DRM and "trust" solutions are already a problem on free operating systems (like the 720p cap on Netflix content). This isn't a slippery slope, this is a vertical surface that was erected over seven years ago when SGX hit the market, just standing there. Luckily the content I watch on Netflix is also freely available through torrents so I don't usually notice the difference, but the DRM fight was lost long ago. Whatever evil things the government is planning on enacting won't be beaten by someone telling the police officers that they use Arch btw.