5 ms·

This is especially rich coming from google's, who's 'safetynet' for android results in a significant reduction in security (contrary to its stated purpose): it

This is especially rich coming from google's, who's 'safetynet' for android results in a significant reduction in security (contrary to its stated purpose): it locks out 3rd-party up-to-date and secure ROMs while allowing horrificly insecure manufacturer-provided ROMs to still pass, because to disable those would cause a massive user outcry. So it functions as a vendor lock-in but no meaningful increase in security for the average user, while preventing more advanced users from improving their security without needing to buy more hardware. This needs to be called out more to push back against the claim that this kind of attestation somehow has a legitimate benefit for the users.

rezonant 3y ago
Fantastic point.
StingyJelly 3y ago
Exactly! Ironically it's a possible reduction in security on custom roms as well if one chooses to bypass it, which is trivial, but requires rooting the device.
lern_too_spel 3y ago
You're using it wrong. SafetyNet is able to assert that the build the device asserts is what it claims. After you know that, it's up to you to decide whether you trust communications from that build or not. If it's a known-insecure build, you can say that you don't. SafetyNet cannot assert that a third party ROM is what it claims to be, so you have to decide whether you trust communications from that device or not based on not knowing at all what build is on the device.
- realusername 3y ago
  Then you are back to square one pretty much since the safetynet result doesn't tell you anything about the security of the device.
- wmf 3y ago
  Does anyone use SafetyNet "right"? I assume not due to the user outcry issue.
  - lern_too_spel 3y ago
    Most (all?) corporate endpoint security systems use it right in my experience. Even when using it right, you would have to block third party builds and cause outcry. You would additionally block some builds that SafetyNet (or Play Integrity) attests.
    - franga2000 3y ago
      > Even when using it right, you would have to block third party builds Unless you have an obvious and accessible way of getting secure third party builds whitelisted, this is still a very anti-user approach, which is not justifiable unless the user of the device isn't its owner (like with company-owned work phones).
      - lern_too_spel 3y ago
        That's up to the service to decide on the appropriate level of security risk in whether they allow unknown builds. They already don't allow custom builds on any other mobile OS, so this is really the best you can get as a user. What is your proposed solution?
        justinclift 3y ago
        > They already don't allow custom builds on any other mobile OS ... Keep in mind that Pinephones and similar are a thing. Lots of people are hoping they don't fizzle out and die off like previous "open" phone projects. :)
        lern_too_spel 3y ago
        And Pinephones and similar don't have apps for these services that require attestation and never will. If some allow web access without build attestation, that works on custom Android builds as well.
- ori_b 3y ago
  In other words, it's virtually impossible to use right without also being the entity that hands out phones to users.
  - lern_too_spel 3y ago
    Potentially, a manufacturer could make a multibuild phone where the user could switch between an attested build and a non-attested build and have access to services whose security requires attestation with just a reboot. Otherwise, you would use different devices for different purposes, as I do today. It's unfortunate, but if you really need something that isn't supported by the existing Android APIs, that's the only way.
    - ori_b 3y ago
      Or, just don't do remote attestation. The cure is worse than the disease.
      - simbolit 3y ago
        That is viable in 2023. Think about "don't use a smartphone" in 2013. That was viable back then. It isn't anymore. What you can do is live smartphone-lite, using it only as a secondary device (as grandparent suggested). The same will be true in a couple years (if the big G is successful). Until, then, yea, don't use it, actively campaign against it.
        thefurdrake 3y ago
        If this happens the way google wants, I'll have to have a separate physical box set up specifically to access google's shiternet for things like banking and shopping. I'd be glad to stick to websites that have no need or interest for WEI otherwise. The internet was already going increasingly-downhill anyway. thisisfine.png
      - lern_too_spel 3y ago
        Good luck convincing corp security to allow you to use your device on your corporate network without remote attestation.
- deleted 3y ago
  [deleted]
- lxgr 3y ago
  > so you have to decide whether you trust communications from that device "You" in this scenario being, most likely, an engineer at a large, regulated, risk-averse corporation that might have to justify this choice during an audit. What would your decision be?
dcposch 3y ago
And speaking of user-hostile, locked-down phones... a galactic irony that Ben Wiser, the Googler who posted this proposal, has a blog where his most recent post is a rant about how he's being unfairly restricted and can't freely run the software he wants on his own device. https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-own-app-on-my-iPhone.html https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-... https://github.com/RupertBenWiser/Web-Environment-Integrity https://github.com/RupertBenWiser/Web-Environment-Integrity
- NetOpWibby 3y ago
  Haha, that’s incredible.
- userbinator 3y ago
  It's not clear when his most recent post is; the server says "Last-Modified: Wed, 26 Jul 2023 06:00:31 GMT" but I believe I saw references to this post before that in the current discussion. (What's with the trend of completely omitting any dates on a blog?)
  - Groxx 3y ago
    the RSS feed says 2022-03-04 fwiw: <item> <title>I just spent £700 to have my own app on my iPhone</title> <link> https://benwiser.com/blog/I-just-spent-£700-to-have-my-own-app-on-my-iPhone.html </link> <pubDate>2022-03-04T11:30:34.067Z</pubDate> </item>
    - jwilk 3y ago
      That's when it was submitted to HN: https://news.ycombinator.com/item?id=30553448 https://news.ycombinator.com/item?id=30553448 (5 comments)
  - Andrex 3y ago
    > (What's with the trend of completely omitting any dates on a blog?) I hate it so, so much. But it's been a thing for at least 5 or so years.
1vuio0pswjnm7 3y ago
"The term cognitive distortions has often been used as a general umbrella term to refer to pseudo-justifications and rationalizations for their deviant behavior, and pro-criminal or offense-supporting attitudes (Maruna & Copes, 2004; Maruna & Mann, 2006; Ciardha & Gannon, 2011)." Helmond et al., Criminal Justice and Behavior, 2015, Vol. 42, No. 3, March 2015, 245-262 It seems that almost any software/website can be framed as having a legitimate benefit for users, e.g., increased convenience and/or security.^1 The more pertinent inquiry is what benefit(s) does it have for its author(s). What does it do (as opposed to "what is it"). Let the user draw their own conclusions from the facts. 1. Arguably it could be a distortion to claim these are not mutually exclusive. We can use web clients that do not leak excessive data that might be collected and used for advertising and tracking by so-called "tech" companies. Google would prefer that we not use such clients. But why not. A so-called "tech" company might frame all non-approved web clients as "bots" and all web usage without disclosing excessive data about the computer user's setup^2 as relating to "fraud". It might frame all web usage as commercial in nature and thus all websites as receptacles for advertising. This "all or nothing" thinking is a classic cognitive distortion. 2. This was the norm in the eary days of the web.
ThePowerOfFuet 3y ago
This is especially rich coming from google's, who's 'safetynet' for android results in a significant reduction in security (contrary to its stated purpose): it locks out 3rd-party up-to-date and secure ROMs while allowing horrificly insecure manufacturer-provided ROMs to still pass, because to disable those would cause a massive user outcry. That's not the case with GrapheneOS: https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu... SafetyNet is deprecated anyway: https://developer.android.com/training/safetynet/deprecation-timeline https://developer.android.com/training/safetynet/deprecation...
- nneonneo 3y ago
  I think you’ve misunderstood both posts. SafetyNet is deprecated, but it’s just been rolled into Play Integrity which does all the same things. All the same concerns still apply to Play Integrity. GrapheneOS is asking developers not to use SafetyNet/Play Integrity (because they presumably block GrapheneOS), but instead to use the native hardware attestation API so they can specifically allow GrapheneOS keys. If a developer doesn’t allow their keys, they’ll be blocked.

rezonant 3y ago

Fantastic point.

StingyJelly 3y ago

Exactly! Ironically it's a possible reduction in security on custom roms as well if one chooses to bypass it, which is trivial, but requires rooting the device.

lern_too_spel 3y ago

You're using it wrong. SafetyNet is able to assert that the build the device asserts is what it claims. After you know that, it's up to you to decide whether you trust communications from that build or not. If it's a known-insecure build, you can say that you don't. SafetyNet cannot assert that a third party ROM is what it claims to be, so you have to decide whether you trust communications from that device or not based on not knowing at all what build is on the device.

realusername 3y ago
Then you are back to square one pretty much since the safetynet result doesn't tell you anything about the security of the device.
wmf 3y ago
Does anyone use SafetyNet "right"? I assume not due to the user outcry issue.
- lern_too_spel 3y ago
  Most (all?) corporate endpoint security systems use it right in my experience. Even when using it right, you would have to block third party builds and cause outcry. You would additionally block some builds that SafetyNet (or Play Integrity) attests.
  - franga2000 3y ago
    > Even when using it right, you would have to block third party builds Unless you have an obvious and accessible way of getting secure third party builds whitelisted, this is still a very anti-user approach, which is not justifiable unless the user of the device isn't its owner (like with company-owned work phones).
    - lern_too_spel 3y ago
      That's up to the service to decide on the appropriate level of security risk in whether they allow unknown builds. They already don't allow custom builds on any other mobile OS, so this is really the best you can get as a user. What is your proposed solution?
      - justinclift 3y ago
        > They already don't allow custom builds on any other mobile OS ... Keep in mind that Pinephones and similar are a thing. Lots of people are hoping they don't fizzle out and die off like previous "open" phone projects. :)
        lern_too_spel 3y ago
        And Pinephones and similar don't have apps for these services that require attestation and never will. If some allow web access without build attestation, that works on custom Android builds as well.
ori_b 3y ago
In other words, it's virtually impossible to use right without also being the entity that hands out phones to users.
- lern_too_spel 3y ago
  Potentially, a manufacturer could make a multibuild phone where the user could switch between an attested build and a non-attested build and have access to services whose security requires attestation with just a reboot. Otherwise, you would use different devices for different purposes, as I do today. It's unfortunate, but if you really need something that isn't supported by the existing Android APIs, that's the only way.
  - ori_b 3y ago
    Or, just don't do remote attestation. The cure is worse than the disease.
    - simbolit 3y ago
      That is viable in 2023. Think about "don't use a smartphone" in 2013. That was viable back then. It isn't anymore. What you can do is live smartphone-lite, using it only as a secondary device (as grandparent suggested). The same will be true in a couple years (if the big G is successful). Until, then, yea, don't use it, actively campaign against it.
      - thefurdrake 3y ago
        If this happens the way google wants, I'll have to have a separate physical box set up specifically to access google's shiternet for things like banking and shopping. I'd be glad to stick to websites that have no need or interest for WEI otherwise. The internet was already going increasingly-downhill anyway. thisisfine.png
    - lern_too_spel 3y ago
      Good luck convincing corp security to allow you to use your device on your corporate network without remote attestation.
deleted 3y ago
[deleted]
lxgr 3y ago
> so you have to decide whether you trust communications from that device "You" in this scenario being, most likely, an engineer at a large, regulated, risk-averse corporation that might have to justify this choice during an audit. What would your decision be?

dcposch 3y ago

And speaking of user-hostile, locked-down phones... a galactic irony that Ben Wiser, the Googler who posted this proposal, has a blog where his most recent post is a rant about how he's being unfairly restricted and can't freely run the software he wants on his own device. https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-own-app-on-my-iPhone.html https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-... https://github.com/RupertBenWiser/Web-Environment-Integrity https://github.com/RupertBenWiser/Web-Environment-Integrity

NetOpWibby 3y ago
Haha, that’s incredible.
userbinator 3y ago
It's not clear when his most recent post is; the server says "Last-Modified: Wed, 26 Jul 2023 06:00:31 GMT" but I believe I saw references to this post before that in the current discussion. (What's with the trend of completely omitting any dates on a blog?)
- Groxx 3y ago
  the RSS feed says 2022-03-04 fwiw: <item> <title>I just spent £700 to have my own app on my iPhone</title> <link> https://benwiser.com/blog/I-just-spent-£700-to-have-my-own-app-on-my-iPhone.html </link> <pubDate>2022-03-04T11:30:34.067Z</pubDate> </item>
  - jwilk 3y ago
    That's when it was submitted to HN: https://news.ycombinator.com/item?id=30553448 https://news.ycombinator.com/item?id=30553448 (5 comments)
- Andrex 3y ago
  > (What's with the trend of completely omitting any dates on a blog?) I hate it so, so much. But it's been a thing for at least 5 or so years.

1vuio0pswjnm7 3y ago

"The term cognitive distortions has often been used as a general umbrella term to refer to pseudo-justifications and rationalizations for their deviant behavior, and pro-criminal or offense-supporting attitudes (Maruna & Copes, 2004; Maruna & Mann, 2006; Ciardha & Gannon, 2011)." Helmond et al., Criminal Justice and Behavior, 2015, Vol. 42, No. 3, March 2015, 245-262 It seems that almost any software/website can be framed as having a legitimate benefit for users, e.g., increased convenience and/or security.^1 The more pertinent inquiry is what benefit(s) does it have for its author(s). What does it do (as opposed to "what is it"). Let the user draw their own conclusions from the facts. 1. Arguably it could be a distortion to claim these are not mutually exclusive. We can use web clients that do not leak excessive data that might be collected and used for advertising and tracking by so-called "tech" companies. Google would prefer that we not use such clients. But why not. A so-called "tech" company might frame all non-approved web clients as "bots" and all web usage without disclosing excessive data about the computer user's setup^2 as relating to "fraud". It might frame all web usage as commercial in nature and thus all websites as receptacles for advertising. This "all or nothing" thinking is a classic cognitive distortion. 2. This was the norm in the eary days of the web.

ThePowerOfFuet 3y ago

This is especially rich coming from google's, who's 'safetynet' for android results in a significant reduction in security (contrary to its stated purpose): it locks out 3rd-party up-to-date and secure ROMs while allowing horrificly insecure manufacturer-provided ROMs to still pass, because to disable those would cause a massive user outcry. That's not the case with GrapheneOS: https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu... SafetyNet is deprecated anyway: https://developer.android.com/training/safetynet/deprecation-timeline https://developer.android.com/training/safetynet/deprecation...

nneonneo 3y ago
I think you’ve misunderstood both posts. SafetyNet is deprecated, but it’s just been rolled into Play Integrity which does all the same things. All the same concerns still apply to Play Integrity. GrapheneOS is asking developers not to use SafetyNet/Play Integrity (because they presumably block GrapheneOS), but instead to use the native hardware attestation API so they can specifically allow GrapheneOS keys. If a developer doesn’t allow their keys, they’ll be blocked.