5 ms·

> Remote attestation enables discrimination against free computers owned by users rather than corporations. Not when my mobile device is attesting to my home s

> Remote attestation enables discrimination against free computers owned by users rather than corporations. Not when my mobile device is attesting to my home server with OSS attestation software, or my USB Armory with OSS firmware for local "remote" attestation. GrapheneOS can attest to a 2nd mobile device running GrapheneOS, or a web verifier. This is not rocket science. Provide a mobile setting for attestation server URL. > Every major service is going to use it. Guaranteed. Hence there must be a mandatory option to define your attestation server. Advocating for the right to specify and/or host your arbiter of device trust (including firmware RoT) will do infinitely more for freedom than arguing against cryptography.

LoganDark 2y ago
> Not when my mobile device is attesting to my home server with OSS attestation software, or my USB Armory with OSS firmware for local "remote" attestation. GrapheneOS can attest to a 2nd mobile device running GrapheneOS, or a web verifier. This is not rocket science. Provide a mobile setting for attestation server URL. No, dude. Look at Google SafetyNet / Play Integrity. It's used by banking apps, streaming apps, certain games, and much, much more, to lock out devices that don't pass. I believe one of the last Android devices that will ever be able to pass SafetyNet while rooted is the OnePlus 7 Pro. Not that I'm ever going to tweak on Android again until TWRP adds a setting to disable OpenRecoveryScript, since a complete lack of prompting for consent is how I had my last major data loss. (Apparently it would kill them to add anything like a "script execution in 5 seconds, cancel?" popup.)
- thunderfork 2y ago
  [dead]
- transpute 2y ago
  Fully open Debian Linux VMs (and possibly Windows VMs via GrapheneOS) are coming to Android 16, which can run desktop GUI apps in those VMs. Already shipping in Android 15 on Pixel devices. ISV/app misuse of remote attestation does not preclude valid use cases under device owner control. Android Virtualization Framework is the first step in reducing the over-broad conflation of device measurements with "security". It can lead to narrower measurements and attestation of specific OS components , while opening up other components to user modification without "breaking" device verification.
  - LoganDark 2y ago
    > Android Virtualization Framework is the first step in reducing the over-broad conflation of device measurements with "security". It can lead to narrower measurements and attestation of specific OS components , while opening up other components to user modification without "breaking" device verification. Okay... and then someone releases some new "security" library with an all-or-nothing philosophy that contains every possible check under the sun for any kind of rooting, modification, customization or even unlocking - and then all the banking apps start using this. You can't win against security theater. You just can't.
    - transpute 2y ago
      > then someone releases some new "security" library with an all-or-nothing philosophy Don't be demoralized by PTSD :) AVF/pKVM is not security theater, especially if "apps" are incorrectly using attestation. pKVM provides strong isolation between Android and other VMs, using CPU support for nested (2-level) virtualization. The Android "host" VM can be isolated from the Debian Linux VM. Search for pKVM technical videos. Implementation code was upstreamed to mainline Linux around 2021 and is public. Banking websites work on desktop Linux browsers, which can be run in the isolated Debian Linux VM.
      - LoganDark 2y ago
        > Don't be demoralized by PTSD :) Hah, you kidding? PTSD rules my life~ > AVF/pKVM is not security theater I said the banking apps are full of security theater. That's why they do root checks and such. AVF/pKVM will not prevent apps from incorrectly using attestation. If there's a way for an app to check for root or any possible deviation from fully trusted and unmodified, then it will be checked by certain types of apps, like banking apps, that rely on security theater. To be clear, the checking everything possible and completely locking you out if anything is even slightly off is the security theater. Not AVF/pKVM itself.
        transpute 2y ago
        > checking everything possible and completely locking you out if anything is even slightly off is the security theater Sadly not the first or last time that technology is wielded imprecisely or carelessly. Improvement options include: 1. Marketing and rewarding non-theatrical attestation 2. Open training content for attestation best practices. 3. Symmetrical 2-way attestation of open components. 4. Automated CI/CD detection of over-broad attestation. 5. IETF or other advocacy to improve attestation protocols. 6. Legal/regulatory mechanisms. There's an attestation track at OC3 in 2 days, online and in Berlin, https://www.oc3.dev/speakers-and-talks https://www.oc3.dev/speakers-and-talks
- matheusmoreira 2y ago
  Due to hardware remote attestation that cannot be bypassed, there is no longer any point to using Android. We used to own our devices. Not anymore. Might as well get an iPhone and enjoy the better kept garden. I wonder if there's a Termux equivalent for iPhone.
  - deleted 2y ago
    [deleted]
matheusmoreira 2y ago
This has nothing to do with attestation servers. It's about who the corporations trust. Namely, each other. Your attestation server doesn't matter. The corporations are not gonna trust any attestation provided by your home server running open source software under your control. They're not gonna trust GrapheneOS's AOSP attestation where you provide your own keys. Simply because your open source software has the power to straight up wipe out their entire business models if left unchecked. They'll deny you service if you use it. Think about it. You can reverse engineer their apps and network protocols and build better software that doesn't advertise to users, that doesn't collect their information, that automates boring tasks, that copies data they don't want copied, that transmits data they want censored. This stuff directly impacts their bottom line and they absolutely want cryptographic proof that you are not doing anything of the sort. They're not gonna trust your keys. They're gonna trust Google's and Apple's. Because their interests are aligned with Google's and Apple's, and not with yours. They've set things up so that they own the computers. They're just generously letting us use them, so long as we follow their rules and policies. If we hack the computer to take control of what should be ours to begin with, they call it "tampering". And now they have hardware cryptographic evidence of this "tampering". This allows them to discriminate against us, exclude us. Since it's hardware cryptography, it's exceedingly difficult to fake or bypass. This is the future. Either you use a corporate pwned computer, or you're ostracized from digital society. Can't log into bank accounts. Can't exchange messages over popular services. Can't even play stupid video games. Can't do much of anything unless somehow hackers create a parallel society where none of this attestation business exists. What good is free software if you can't use it? It's worthless.
- transpute 2y ago
  > This has nothing to do with attestation servers. It's about who the corporations trust. Namely, each other. I'm glad the conversation has moved from attestation to trust :) If you look at inter-corporation contracts, it's clear that corporations don't trust each other. We're in a neolithic era of attestation, used primitively with wides collateral damage. More granular options exist, look at the architecture of QubesOS for one example. Android Virtualization Framework should enable more examples. Remember when SSL certs were monopolized by a small number of players? Then the push for HTTPS usage lead us to LetsEncrypt. There's no technical reason that a similar organization could not exist to improve tooling and coordination for decentralized and meaningful attestation of specific components (note NOT devices) and the security architecture by which components are composed into devices. All is not lost, these are only early contests of competing visions.

LoganDark 2y ago

> Not when my mobile device is attesting to my home server with OSS attestation software, or my USB Armory with OSS firmware for local "remote" attestation. GrapheneOS can attest to a 2nd mobile device running GrapheneOS, or a web verifier. This is not rocket science. Provide a mobile setting for attestation server URL. No, dude. Look at Google SafetyNet / Play Integrity. It's used by banking apps, streaming apps, certain games, and much, much more, to lock out devices that don't pass. I believe one of the last Android devices that will ever be able to pass SafetyNet while rooted is the OnePlus 7 Pro. Not that I'm ever going to tweak on Android again until TWRP adds a setting to disable OpenRecoveryScript, since a complete lack of prompting for consent is how I had my last major data loss. (Apparently it would kill them to add anything like a "script execution in 5 seconds, cancel?" popup.)

thunderfork 2y ago
[dead]
transpute 2y ago
Fully open Debian Linux VMs (and possibly Windows VMs via GrapheneOS) are coming to Android 16, which can run desktop GUI apps in those VMs. Already shipping in Android 15 on Pixel devices. ISV/app misuse of remote attestation does not preclude valid use cases under device owner control. Android Virtualization Framework is the first step in reducing the over-broad conflation of device measurements with "security". It can lead to narrower measurements and attestation of specific OS components , while opening up other components to user modification without "breaking" device verification.
- LoganDark 2y ago
  > Android Virtualization Framework is the first step in reducing the over-broad conflation of device measurements with "security". It can lead to narrower measurements and attestation of specific OS components , while opening up other components to user modification without "breaking" device verification. Okay... and then someone releases some new "security" library with an all-or-nothing philosophy that contains every possible check under the sun for any kind of rooting, modification, customization or even unlocking - and then all the banking apps start using this. You can't win against security theater. You just can't.
  - transpute 2y ago
    > then someone releases some new "security" library with an all-or-nothing philosophy Don't be demoralized by PTSD :) AVF/pKVM is not security theater, especially if "apps" are incorrectly using attestation. pKVM provides strong isolation between Android and other VMs, using CPU support for nested (2-level) virtualization. The Android "host" VM can be isolated from the Debian Linux VM. Search for pKVM technical videos. Implementation code was upstreamed to mainline Linux around 2021 and is public. Banking websites work on desktop Linux browsers, which can be run in the isolated Debian Linux VM.
    - LoganDark 2y ago
      > Don't be demoralized by PTSD :) Hah, you kidding? PTSD rules my life~ > AVF/pKVM is not security theater I said the banking apps are full of security theater. That's why they do root checks and such. AVF/pKVM will not prevent apps from incorrectly using attestation. If there's a way for an app to check for root or any possible deviation from fully trusted and unmodified, then it will be checked by certain types of apps, like banking apps, that rely on security theater. To be clear, the checking everything possible and completely locking you out if anything is even slightly off is the security theater. Not AVF/pKVM itself.
      - transpute 2y ago
        > checking everything possible and completely locking you out if anything is even slightly off is the security theater Sadly not the first or last time that technology is wielded imprecisely or carelessly. Improvement options include: 1. Marketing and rewarding non-theatrical attestation 2. Open training content for attestation best practices. 3. Symmetrical 2-way attestation of open components. 4. Automated CI/CD detection of over-broad attestation. 5. IETF or other advocacy to improve attestation protocols. 6. Legal/regulatory mechanisms. There's an attestation track at OC3 in 2 days, online and in Berlin, https://www.oc3.dev/speakers-and-talks https://www.oc3.dev/speakers-and-talks
matheusmoreira 2y ago
Due to hardware remote attestation that cannot be bypassed, there is no longer any point to using Android. We used to own our devices. Not anymore. Might as well get an iPhone and enjoy the better kept garden. I wonder if there's a Termux equivalent for iPhone.
- deleted 2y ago
  [deleted]

matheusmoreira 2y ago

This has nothing to do with attestation servers. It's about who the corporations trust. Namely, each other. Your attestation server doesn't matter. The corporations are not gonna trust any attestation provided by your home server running open source software under your control. They're not gonna trust GrapheneOS's AOSP attestation where you provide your own keys. Simply because your open source software has the power to straight up wipe out their entire business models if left unchecked. They'll deny you service if you use it. Think about it. You can reverse engineer their apps and network protocols and build better software that doesn't advertise to users, that doesn't collect their information, that automates boring tasks, that copies data they don't want copied, that transmits data they want censored. This stuff directly impacts their bottom line and they absolutely want cryptographic proof that you are not doing anything of the sort. They're not gonna trust your keys. They're gonna trust Google's and Apple's. Because their interests are aligned with Google's and Apple's, and not with yours. They've set things up so that they own the computers. They're just generously letting us use them, so long as we follow their rules and policies. If we hack the computer to take control of what should be ours to begin with, they call it "tampering". And now they have hardware cryptographic evidence of this "tampering". This allows them to discriminate against us, exclude us. Since it's hardware cryptography, it's exceedingly difficult to fake or bypass. This is the future. Either you use a corporate pwned computer, or you're ostracized from digital society. Can't log into bank accounts. Can't exchange messages over popular services. Can't even play stupid video games. Can't do much of anything unless somehow hackers create a parallel society where none of this attestation business exists. What good is free software if you can't use it? It's worthless.

transpute 2y ago
> This has nothing to do with attestation servers. It's about who the corporations trust. Namely, each other. I'm glad the conversation has moved from attestation to trust :) If you look at inter-corporation contracts, it's clear that corporations don't trust each other. We're in a neolithic era of attestation, used primitively with wides collateral damage. More granular options exist, look at the architecture of QubesOS for one example. Android Virtualization Framework should enable more examples. Remember when SSL certs were monopolized by a small number of players? Then the push for HTTPS usage lead us to LetsEncrypt. There's no technical reason that a similar organization could not exist to improve tooling and coordination for decentralized and meaningful attestation of specific components (note NOT devices) and the security architecture by which components are composed into devices. All is not lost, these are only early contests of competing visions.