3 ms·

This has nothing to do with attestation servers. It's about who the corporations trust. Namely, each other. Your attestation server doesn't matter. The corpora

This has nothing to do with attestation servers. It's about who the corporations trust. Namely, each other. Your attestation server doesn't matter. The corporations are not gonna trust any attestation provided by your home server running open source software under your control. They're not gonna trust GrapheneOS's AOSP attestation where you provide your own keys. Simply because your open source software has the power to straight up wipe out their entire business models if left unchecked. They'll deny you service if you use it. Think about it. You can reverse engineer their apps and network protocols and build better software that doesn't advertise to users, that doesn't collect their information, that automates boring tasks, that copies data they don't want copied, that transmits data they want censored. This stuff directly impacts their bottom line and they absolutely want cryptographic proof that you are not doing anything of the sort. They're not gonna trust your keys. They're gonna trust Google's and Apple's. Because their interests are aligned with Google's and Apple's, and not with yours. They've set things up so that they own the computers. They're just generously letting us use them, so long as we follow their rules and policies. If we hack the computer to take control of what should be ours to begin with, they call it "tampering". And now they have hardware cryptographic evidence of this "tampering". This allows them to discriminate against us, exclude us. Since it's hardware cryptography, it's exceedingly difficult to fake or bypass. This is the future. Either you use a corporate pwned computer, or you're ostracized from digital society. Can't log into bank accounts. Can't exchange messages over popular services. Can't even play stupid video games. Can't do much of anything unless somehow hackers create a parallel society where none of this attestation business exists. What good is free software if you can't use it? It's worthless.

transpute 2y ago
> This has nothing to do with attestation servers. It's about who the corporations trust. Namely, each other. I'm glad the conversation has moved from attestation to trust :) If you look at inter-corporation contracts, it's clear that corporations don't trust each other. We're in a neolithic era of attestation, used primitively with wides collateral damage. More granular options exist, look at the architecture of QubesOS for one example. Android Virtualization Framework should enable more examples. Remember when SSL certs were monopolized by a small number of players? Then the push for HTTPS usage lead us to LetsEncrypt. There's no technical reason that a similar organization could not exist to improve tooling and coordination for decentralized and meaningful attestation of specific components (note NOT devices) and the security architecture by which components are composed into devices. All is not lost, these are only early contests of competing visions.
- matheusmoreira 2y ago
  The fact there are no technical reasons preventing things from being good is irrelevant: there are countless business and political reasons, and those are the ones that matter. It doesn't matter that better technology could theoretically exist. It matters that remote attestation almost perfectly serves the interests of corporations and governments. The better, more granular technology doesn't matter. The banks won't use them, they'll say it enables fraud and money laundering. WhatsApp won't use them, they'll say it enables spam and scams and abuse. Streaming apps won't use them, they'll say it enables copyright infringement. And so on, and so forth. The only technology they'll use is the one where they maintain control over the machine. They will not tolerate the machine being yours. Because if you own the computer, you can make it spam people and copy movies if you want to. They gotta own the machines. If they can't, they'll take their balls and go home.
  - transpute 2y ago
    Are banks blocking desktop web browsers? You can access bank websites using a desktop web browser in the Debian Linux VM that is running in parallel to the Android VM. No app store, attestation or DRM needs to be involved.
    - matheusmoreira 2y ago
      > Are banks blocking desktop web browsers? Absolutely. My bank does not allow many operations via web browser anymore. It directs me to use the mobile apps. "Fraud prevention". All banks in my country are like that. They only allow internet banking on a personal computer if you install their "security module". It's a kernel module that makes the computer incredibly slow. Once upon a time I tried to reverse engineer that thing to figure out why and I caught it intercepting every single network connection. That told me all I needed to know. They want to own our computers. They think it's justified. As if "fraud" excuses everything. There is no limit they wouldn't cross. It's about control. They want to have all the control while we have zero.
      - 2y ago

transpute 2y ago

> This has nothing to do with attestation servers. It's about who the corporations trust. Namely, each other. I'm glad the conversation has moved from attestation to trust :) If you look at inter-corporation contracts, it's clear that corporations don't trust each other. We're in a neolithic era of attestation, used primitively with wides collateral damage. More granular options exist, look at the architecture of QubesOS for one example. Android Virtualization Framework should enable more examples. Remember when SSL certs were monopolized by a small number of players? Then the push for HTTPS usage lead us to LetsEncrypt. There's no technical reason that a similar organization could not exist to improve tooling and coordination for decentralized and meaningful attestation of specific components (note NOT devices) and the security architecture by which components are composed into devices. All is not lost, these are only early contests of competing visions.

matheusmoreira 2y ago
The fact there are no technical reasons preventing things from being good is irrelevant: there are countless business and political reasons, and those are the ones that matter. It doesn't matter that better technology could theoretically exist. It matters that remote attestation almost perfectly serves the interests of corporations and governments. The better, more granular technology doesn't matter. The banks won't use them, they'll say it enables fraud and money laundering. WhatsApp won't use them, they'll say it enables spam and scams and abuse. Streaming apps won't use them, they'll say it enables copyright infringement. And so on, and so forth. The only technology they'll use is the one where they maintain control over the machine. They will not tolerate the machine being yours. Because if you own the computer, you can make it spam people and copy movies if you want to. They gotta own the machines. If they can't, they'll take their balls and go home.
- transpute 2y ago
  Are banks blocking desktop web browsers? You can access bank websites using a desktop web browser in the Debian Linux VM that is running in parallel to the Android VM. No app store, attestation or DRM needs to be involved.
  - matheusmoreira 2y ago
    > Are banks blocking desktop web browsers? Absolutely. My bank does not allow many operations via web browser anymore. It directs me to use the mobile apps. "Fraud prevention". All banks in my country are like that. They only allow internet banking on a personal computer if you install their "security module". It's a kernel module that makes the computer incredibly slow. Once upon a time I tried to reverse engineer that thing to figure out why and I caught it intercepting every single network connection. That told me all I needed to know. They want to own our computers. They think it's justified. As if "fraud" excuses everything. There is no limit they wouldn't cross. It's about control. They want to have all the control while we have zero.
    - 2y ago