5 ms·

I'm sorry, but the idea that it's about allowing me to attest to the security of my device is not correct. I can make all the attestations I like about the secu

by wzdd 3y ago

I'm sorry, but the idea that it's about allowing me to attest to the security of my device is not correct. I can make all the attestations I like about the security of my device, but if they're not backed by a confirmation from Google then it's quite likely that nobody will care. The issue is that making modifications to anything in the chain of trust requires approval from a trusted third party.

charcircuit 3y ago
>the idea that it's about allowing me to attest to the security of my device is not correct I was oversimplifying. A service doesn't have to trust every attestation and a service does not need to do anything with the attestation if it doesn't want to. >The issue is that making modifications to anything in the chain of trust requires approval from a trusted third party. That is by design because it means untrusted people can't make changes while remaining trusted.
- wzdd 3y ago
  Yes, you are correct that preventing users from making modifications to anything in the chain of trust without being approved by an already-trusted third party, likely the company who certified the device, is by design.
- zb3 3y ago
  The problem is that the owner of the device is considered "untrusted" here. While that sometimes makes sense (for law enforcement purposes), using this for business purposes is anticompetitive. It shouldn't be possible for companies to do whatever they want.
  - charcircuit 3y ago
    >using this for business purposes is anticompetitive Businesses not trusting every random person is not anticompetitive. Doing that is how businesses make bad deals, get hacked, or make bad decisions.
    - zb3 3y ago
      Of course it is anticompetitive, if a given service (which is defacto mandatory) strikes a deal with select few hardware vendors to artificially make it impossible to access the service using different hardware (for purely business reasons), then it obviously is anticompetitive.
      - charcircuit 3y ago
        >strikes a deal with select few hardware vendors That isn't what is happening. Anyone can become a manufacturer for Windows PCs or Android certified phones.
        daurentius523 3y ago
        Right because Microsoft and Google don't mandate what can and cannot be installed by manufacturer… oh wait.
        charcircuit 3y ago
        The whole point of Android certification is that you are following Google's rules. If you make something that is not certified you can not get play services.
        daurentius523 3y ago
        >The whole point of Android certification is that you are following Google's rules. Whole point of WEI is that you are following Google's rules. You essentially acknowledged that YOU CANNOT become manufacturer - you become subcontractor for corporation that dictates what you can and cannot do. Which from point of trust is precisely that - anticompetitive behaviour.
        charcircuit 3y ago
        >Whole point of WEI is that you are following Google's rules. That would be the point of the Google Play attestor. With WEI sites can use anyone as an attestor. It is up for attestors to compete in providing a valuable signal to sites. It's not anticompetitive because you can come up with your own standard of a secure device and get sites to trust your attestor.

by wzdd 3y ago

charcircuit 3y ago

>the idea that it's about allowing me to attest to the security of my device is not correct I was oversimplifying. A service doesn't have to trust every attestation and a service does not need to do anything with the attestation if it doesn't want to. >The issue is that making modifications to anything in the chain of trust requires approval from a trusted third party. That is by design because it means untrusted people can't make changes while remaining trusted.

wzdd 3y ago
Yes, you are correct that preventing users from making modifications to anything in the chain of trust without being approved by an already-trusted third party, likely the company who certified the device, is by design.
zb3 3y ago
The problem is that the owner of the device is considered "untrusted" here. While that sometimes makes sense (for law enforcement purposes), using this for business purposes is anticompetitive. It shouldn't be possible for companies to do whatever they want.
- charcircuit 3y ago
  >using this for business purposes is anticompetitive Businesses not trusting every random person is not anticompetitive. Doing that is how businesses make bad deals, get hacked, or make bad decisions.
  - zb3 3y ago
    Of course it is anticompetitive, if a given service (which is defacto mandatory) strikes a deal with select few hardware vendors to artificially make it impossible to access the service using different hardware (for purely business reasons), then it obviously is anticompetitive.
    - charcircuit 3y ago
      >strikes a deal with select few hardware vendors That isn't what is happening. Anyone can become a manufacturer for Windows PCs or Android certified phones.
      - daurentius523 3y ago
        Right because Microsoft and Google don't mandate what can and cannot be installed by manufacturer… oh wait.
        charcircuit 3y ago
        The whole point of Android certification is that you are following Google's rules. If you make something that is not certified you can not get play services.
        daurentius523 3y ago
        >The whole point of Android certification is that you are following Google's rules. Whole point of WEI is that you are following Google's rules. You essentially acknowledged that YOU CANNOT become manufacturer - you become subcontractor for corporation that dictates what you can and cannot do. Which from point of trust is precisely that - anticompetitive behaviour.
        charcircuit 3y ago
        >Whole point of WEI is that you are following Google's rules. That would be the point of the Google Play attestor. With WEI sites can use anyone as an attestor. It is up for attestors to compete in providing a valuable signal to sites. It's not anticompetitive because you can come up with your own standard of a secure device and get sites to trust your attestor.