> I am sympathetic to the reasons why orgs like banks want things like remote-device attestation I'm not. I mean, I am in theory; being able to warn a user the

> I am sympathetic to the reasons why orgs like banks want things like remote-device attestation I'm not. I mean, I am in theory; being able to warn a user their device might have some sort of malware upon trying to log into a banking website is useful, but we've already seen how banks handle these things in practice with mobile devices having attestation capabilities. The result is some banking apps refuse to run on my phone with a very up-to-date and definitely not compromised LineageOS, but will happily run on devices several years out of date. Google SafetyNet can tell that the bootloader is locked and the system partition hasn't been modified, but can't tell that some malware has gained root access by privilege escalation. I don't want them doing that to their websites as well. This technology should not be let loose on the world.