3 ms·

In other words, it's virtually impossible to use right without also being the entity that hands out phones to users.

by ori_b 3y ago

lern_too_spel 3y ago
Potentially, a manufacturer could make a multibuild phone where the user could switch between an attested build and a non-attested build and have access to services whose security requires attestation with just a reboot. Otherwise, you would use different devices for different purposes, as I do today. It's unfortunate, but if you really need something that isn't supported by the existing Android APIs, that's the only way.
- ori_b 3y ago
  Or, just don't do remote attestation. The cure is worse than the disease.
  - simbolit 3y ago
    That is viable in 2023. Think about "don't use a smartphone" in 2013. That was viable back then. It isn't anymore. What you can do is live smartphone-lite, using it only as a secondary device (as grandparent suggested). The same will be true in a couple years (if the big G is successful). Until, then, yea, don't use it, actively campaign against it.
    - thefurdrake 3y ago
      If this happens the way google wants, I'll have to have a separate physical box set up specifically to access google's shiternet for things like banking and shopping. I'd be glad to stick to websites that have no need or interest for WEI otherwise. The internet was already going increasingly-downhill anyway. thisisfine.png
  - lern_too_spel 3y ago
    Good luck convincing corp security to allow you to use your device on your corporate network without remote attestation.
    - ori_b 3y ago
      I don't use personal devices on corporate networks. If they want a phone with remote attestation, they can pay for it to sit in a drawer. Though, at this point I am the founder of my own company. Any software we use will not require attestation. I would be willing to switch vendors over that. As for web attestation: the software I use regularly needs to run on OpenBSD. It's that simple.

In other words, it's virtually impossible to use right without also being the entity that hands out phones to users.

by ori_b 3y ago

In other words, it's virtually impossible to use right without also being the entity that hands out phones to users.

Potentially, a manufacturer could make a multibuild phone where the user could switch between an attested build and a non-attested build and have access to services whose security requires attestation with just a reboot. Otherwise, you would use different devices for different purposes, as I do today. It's unfortunate, but if you really need something that isn't supported by the existing Android APIs, that's the only way.

ori_b 3y ago
Or, just don't do remote attestation. The cure is worse than the disease.
- simbolit 3y ago
  That is viable in 2023. Think about "don't use a smartphone" in 2013. That was viable back then. It isn't anymore. What you can do is live smartphone-lite, using it only as a secondary device (as grandparent suggested). The same will be true in a couple years (if the big G is successful). Until, then, yea, don't use it, actively campaign against it.
  - thefurdrake 3y ago
    If this happens the way google wants, I'll have to have a separate physical box set up specifically to access google's shiternet for things like banking and shopping. I'd be glad to stick to websites that have no need or interest for WEI otherwise. The internet was already going increasingly-downhill anyway. thisisfine.png
- lern_too_spel 3y ago
  Good luck convincing corp security to allow you to use your device on your corporate network without remote attestation.
  - ori_b 3y ago
    I don't use personal devices on corporate networks. If they want a phone with remote attestation, they can pay for it to sit in a drawer. Though, at this point I am the founder of my own company. Any software we use will not require attestation. I would be willing to switch vendors over that. As for web attestation: the software I use regularly needs to run on OpenBSD. It's that simple.