3 ms·

You aren't responding to the scenario that was posed. You're assuming an isolated compromised app on an otherwise clean device. GP is assuming a compromised dev

You aren't responding to the scenario that was posed. You're assuming an isolated compromised app on an otherwise clean device. GP is assuming a compromised device. Of course attestation does nothing to improve the "single compromised app" case since (assuming Android) that goes nowhere either way. The only thing attestation does is meddle in end user affairs.

charcircuit 1y ago
>if the phone isn't compromised then the owner having root isn't a security problem The scenario is the phone isn't compromised. Having root means you, or an app you run can bypass the security protecting the authentication token.
- fc417fc802 1y ago
  And now you're being intentionally difficult. Please interpret things in the most plausible manner. Beyond common decency, it's part of the site guidelines. By "not compromised" GP clearly meant a scenario where no malicious apps are present. I agree that's a serious omission. I responded to your scenario (a nonzero number of malicious apps) in my earlier comment. Any Android device will defend against that regardless of the presence of attestation. Any non-android device can still use online banking and thus attestation doesn't appear to accomplish anything legitimate. Building out proper support for hardware tokens would provide superior security in approximately all cases. The specific "root on android" scenario isn't generally a concern. Typical implementations require explicitly granting the capability to a given app. A malicious app can't gain it without fooling the user, at which point it could more easily phish the credentials and possibly even proxy an entire session.
  - charcircuit 1y ago
    >Please interpret things in the most plausible manner. Your suggestion is not plausible as every security feature has 0 security value if there is nothing malicous. It would be like someone saying that antivirus is useless because if someone doesn't have a virus then it doesn't do anything. >Any Android device will defend against that regardless of the presence of attestation. Rooted android devices can be set up in a way that malicous apps can gain root and then read it. >Any non-android device can still use online banking But this comes with a different risk profile. A bank can reduce risk for a subset of their customers. >Building out proper support for hardware tokens would provide superior security in approximately all cases. I think usually the hardware token gains you access to an authentication token. You don't sign every request you are making with a hardware only key. >Typical implementations require explicitly granting the capability to a given app. And the majority of users have no clue what an app is able to do. If root is given to it then it can do anything. This is in contrast to when root isn't available and users are protected by the sandbox the app is in.
    - AnthonyMouse 1y ago
      > It would be like someone saying that antivirus is useless because if someone doesn't have a virus then it doesn't do anything. Suppose you have an "antivirus" program that works like this: The system makes a list of every program that runs as root during boot and then at the end of boot the antivirus program checks the list for unexpected programs and if it finds any it displays an error and refuses to display the login prompt to prevent the user from typing their password into a compromised device. That "antivirus" system is useless, because if a malicious program did run as root during boot then it could just reconfigure the system to display the login prompt unconditionally. The way attestation is nominally supposed to work is that a remote system cryptographically verifies the state of the local machine before giving it some secret. But that doesn't work in this case because the secret -- the thing that allows the user to sign in -- is coming from the local user rather than a remote machine. The attacker doesn't need to perform attestation or retrieve anything from a remote machine in order to display a local login prompt and collect the user's credentials, and that's the end of the game. > Rooted android devices can be set up in a way that malicous apps can gain root and then read it. So can PCs, or various non-rooted android devices that bank apps run on even though they have known unpatched vulnerabilities. > But this comes with a different risk profile. A bank can reduce risk for a subset of their customers. How is it reducing risk for anyone? Each person still has the same risk profile as before. The person with a locked Android device still has a locked Android device, the person with an unlocked Android device is now forced to use a PC which is an inconvenience with no security advantage.
      - charcircuit 1y ago
        Just because an antivirus isn't perfect that doesn't mean it's useless. A bank may not want to put in the extra effort of supporting 3 platforms of secure phones, insecure phones, and insecure web and would prefer to support less and potentially dropping features from the web platform.
        AnthonyMouse 1y ago
        > Just because an antivirus isn't perfect that doesn't mean it's useless. If the security of your system depends on the attacker not doing something the attacker can easily do, it's useless. > A bank may not want to put in the extra effort of supporting 3 platforms of secure phones, insecure phones, and insecure web and would prefer to support less and potentially dropping features from the web platform. So now we've gone from some kind of hypothetical security benefit to "banks don't support that because they're lazy". Except that adding support for attestation is work they do for no reason, because the people using locked phones are still using locked phones and preventing people with unlocked phones from using them instead of the web page is paying to do work only in order to cause customers trouble.

charcircuit 1y ago

>if the phone isn't compromised then the owner having root isn't a security problem The scenario is the phone isn't compromised. Having root means you, or an app you run can bypass the security protecting the authentication token.

fc417fc802 1y ago
And now you're being intentionally difficult. Please interpret things in the most plausible manner. Beyond common decency, it's part of the site guidelines. By "not compromised" GP clearly meant a scenario where no malicious apps are present. I agree that's a serious omission. I responded to your scenario (a nonzero number of malicious apps) in my earlier comment. Any Android device will defend against that regardless of the presence of attestation. Any non-android device can still use online banking and thus attestation doesn't appear to accomplish anything legitimate. Building out proper support for hardware tokens would provide superior security in approximately all cases. The specific "root on android" scenario isn't generally a concern. Typical implementations require explicitly granting the capability to a given app. A malicious app can't gain it without fooling the user, at which point it could more easily phish the credentials and possibly even proxy an entire session.
- charcircuit 1y ago
  >Please interpret things in the most plausible manner. Your suggestion is not plausible as every security feature has 0 security value if there is nothing malicous. It would be like someone saying that antivirus is useless because if someone doesn't have a virus then it doesn't do anything. >Any Android device will defend against that regardless of the presence of attestation. Rooted android devices can be set up in a way that malicous apps can gain root and then read it. >Any non-android device can still use online banking But this comes with a different risk profile. A bank can reduce risk for a subset of their customers. >Building out proper support for hardware tokens would provide superior security in approximately all cases. I think usually the hardware token gains you access to an authentication token. You don't sign every request you are making with a hardware only key. >Typical implementations require explicitly granting the capability to a given app. And the majority of users have no clue what an app is able to do. If root is given to it then it can do anything. This is in contrast to when root isn't available and users are protected by the sandbox the app is in.
  - AnthonyMouse 1y ago
    > It would be like someone saying that antivirus is useless because if someone doesn't have a virus then it doesn't do anything. Suppose you have an "antivirus" program that works like this: The system makes a list of every program that runs as root during boot and then at the end of boot the antivirus program checks the list for unexpected programs and if it finds any it displays an error and refuses to display the login prompt to prevent the user from typing their password into a compromised device. That "antivirus" system is useless, because if a malicious program did run as root during boot then it could just reconfigure the system to display the login prompt unconditionally. The way attestation is nominally supposed to work is that a remote system cryptographically verifies the state of the local machine before giving it some secret. But that doesn't work in this case because the secret -- the thing that allows the user to sign in -- is coming from the local user rather than a remote machine. The attacker doesn't need to perform attestation or retrieve anything from a remote machine in order to display a local login prompt and collect the user's credentials, and that's the end of the game. > Rooted android devices can be set up in a way that malicous apps can gain root and then read it. So can PCs, or various non-rooted android devices that bank apps run on even though they have known unpatched vulnerabilities. > But this comes with a different risk profile. A bank can reduce risk for a subset of their customers. How is it reducing risk for anyone? Each person still has the same risk profile as before. The person with a locked Android device still has a locked Android device, the person with an unlocked Android device is now forced to use a PC which is an inconvenience with no security advantage.
    - charcircuit 1y ago
      Just because an antivirus isn't perfect that doesn't mean it's useless. A bank may not want to put in the extra effort of supporting 3 platforms of secure phones, insecure phones, and insecure web and would prefer to support less and potentially dropping features from the web platform.
      - AnthonyMouse 1y ago
        > Just because an antivirus isn't perfect that doesn't mean it's useless. If the security of your system depends on the attacker not doing something the attacker can easily do, it's useless. > A bank may not want to put in the extra effort of supporting 3 platforms of secure phones, insecure phones, and insecure web and would prefer to support less and potentially dropping features from the web platform. So now we've gone from some kind of hypothetical security benefit to "banks don't support that because they're lazy". Except that adding support for attestation is work they do for no reason, because the people using locked phones are still using locked phones and preventing people with unlocked phones from using them instead of the web page is paying to do work only in order to cause customers trouble.