4 ms·

On the face of it they're just security features, and I don't deny they are, but the industry as a whole are using those features to implement device verificati

On the face of it they're just security features, and I don't deny they are, but the industry as a whole are using those features to implement device verification systems that are being used to lock down their platforms and centralize control over their software ecosystems. Being able to install another OS isn't much good if critical applications and websites refuse to run on it.

gruez 1y ago
>Being able to install another OS isn't much good if critical applications and websites refuse to run on it. The battle has already been lost on this. Just look at all the companies that are app-only and don't offer a web version.
- cam_l 1y ago
  I honestly have only come across one company that is app only. That was because I was with them when they changed over, otherwise I would never have signed up. This was my local gym which sacked their front desk staff and moved to app access only, and with an app infested with trackers at that. Needless to say I don't go to that gym anymore.
  - gruez 1y ago
    It's popular with fintechs, especially new ones. Robinhood for instance was app-only for a few years before they got their web version. Revolut theoretically has a web version but it has far less features than the mobile app. Restaurant "apps" (for ordering and offers) are often app-only as well.
    - chromehearts 1y ago
      Honest question: What does TPM have to do with this? I mean, Revolut developers don't need to check for TPM or similar to serve other functionalities just because you're on browser or mobile app. Am I getting something wrong?
      - gruez 1y ago
        There might not be "TPMs" exactly on smartphones, but both Android and iOS have device attestation APIs that does the same thing that TPMs do, ie. cryptographically prove to a remote party that you're running some particular version of software. https://developer.android.com/google/play/integrity https://developer.android.com/google/play/integrity https://developer.apple.com/documentation/devicecheck https://developer.apple.com/documentation/devicecheck >I mean, Revolut developers don't need to check for TPM or similar to serve other functionalities just because you're on browser or mobile app. Some features are simply not available in the web version. You can try running the app in an emulator to get past that limitation, but an emulator won't be able to spoof device attestations, so if they bother checking for it you're screwed.
  - rixed 1y ago
    Want another exemple as fresh as yesterday? I'm on a move, had to pay some transport company to move some stuff for me, pick-up date tomorrow. Paid online, website asked for a confirmation from my bank's app (N26), fair enough. Opened the app, just to be greated with "Please Update. The latest app version includes new features, enhancements and stability improvements" with the only choice: "Update now". Being confronted with an app designed to refuse to work was irritating enough (for context, I'm from a generation were we used to own our devices), but I clicked on "Update" anyway, just to be told by apple store that there was no update for my iPhone 7. Ok, the writting was on the wall. You know, I own one iphone and 2 android phones already, all of them several years old but in pristine condition. That's how I am, I care for things. I'm not going to buy yet another one, if only because I hate waste and fear mismanagement of natural resources. That's how I am, I care for things. Now you are mandating me to add more e-waste? There is no way I'm going to do that, so I decided to connect to N26's wensite, but guess what? You need the app to login. Well, if you insist you can also login with a short message, which I did, just to check that there was no way to confirm a paiement on the website. But you can contact "support", so I tried that. To their credit, the robot bouncer was quick to admit incompetence and to connect me with a friendly fellow human, who was unfortunately only allowed to lecture me about why those "new features and enhancements" were essential to my account's security, while being unable to tell me exaclty what they were or what was the problem with the current version, and suggested I login from someone else's phone instead. Security? Whose security? To anyone working in tech, let me remind you what an actual threat model is. My actual threat model in the actual world is that your company might stole my money, or prevent me from access it which amount to the same thing. Data points: Despite all the stories on the news about mischievous hackerz from russia and china, I've been stolen money only twice in my life, not a lot of but at the time I needed it, and twice by banks. My threat model is that the electronic gadget that I bought and carry with me all the time stops obeying me and starts obeying some adversarial company. And that, in perfect novlang mastery, you want me to call this a "trusted device". My threat model is that our civilization might drown in e-waste. Want another exemple of app only service? Wait for a days or two, as I'm confident I will face the same issue soon.
    - encom 1y ago
      Yes, your bank is shit, but this is also Apple's fault to a large degree. There is absolutely no reason to release a new major version of your OS every year, and there is no reason to arbitrarily drop support for older devices (except extremely contrived ones, that I'm sure will be posted below). I made the mistake of acquiring an Ipad once. Its only job was playing YouTube videos in bed (yes I know), until Apple and Google in unison decided that it should be thrown into a landfill, because its OS was unsupported and the YouTube app, for no reason at all, would no longer work. Was the device suddenly unable to decode H.264 video or playing audio? Nope. But please just throw it in the trash and buy a new one - what are you, poor?!
- scheeseman486 1y ago
  I wouldn't say it's lost, but the trendlines aren't good.
- wkat4242 1y ago
  That the battle is lost doesn't mean we should stop fighting. Even the war being lost isn't a reason to. The equivalent in the real world is resistance.
- dahrkael 1y ago
  its even worse when you discover the app itself is just a webview

gruez 1y ago

>Being able to install another OS isn't much good if critical applications and websites refuse to run on it. The battle has already been lost on this. Just look at all the companies that are app-only and don't offer a web version.

cam_l 1y ago
I honestly have only come across one company that is app only. That was because I was with them when they changed over, otherwise I would never have signed up. This was my local gym which sacked their front desk staff and moved to app access only, and with an app infested with trackers at that. Needless to say I don't go to that gym anymore.
- gruez 1y ago
  It's popular with fintechs, especially new ones. Robinhood for instance was app-only for a few years before they got their web version. Revolut theoretically has a web version but it has far less features than the mobile app. Restaurant "apps" (for ordering and offers) are often app-only as well.
  - chromehearts 1y ago
    Honest question: What does TPM have to do with this? I mean, Revolut developers don't need to check for TPM or similar to serve other functionalities just because you're on browser or mobile app. Am I getting something wrong?
    - gruez 1y ago
      There might not be "TPMs" exactly on smartphones, but both Android and iOS have device attestation APIs that does the same thing that TPMs do, ie. cryptographically prove to a remote party that you're running some particular version of software. https://developer.android.com/google/play/integrity https://developer.android.com/google/play/integrity https://developer.apple.com/documentation/devicecheck https://developer.apple.com/documentation/devicecheck >I mean, Revolut developers don't need to check for TPM or similar to serve other functionalities just because you're on browser or mobile app. Some features are simply not available in the web version. You can try running the app in an emulator to get past that limitation, but an emulator won't be able to spoof device attestations, so if they bother checking for it you're screwed.
- rixed 1y ago
  Want another exemple as fresh as yesterday? I'm on a move, had to pay some transport company to move some stuff for me, pick-up date tomorrow. Paid online, website asked for a confirmation from my bank's app (N26), fair enough. Opened the app, just to be greated with "Please Update. The latest app version includes new features, enhancements and stability improvements" with the only choice: "Update now". Being confronted with an app designed to refuse to work was irritating enough (for context, I'm from a generation were we used to own our devices), but I clicked on "Update" anyway, just to be told by apple store that there was no update for my iPhone 7. Ok, the writting was on the wall. You know, I own one iphone and 2 android phones already, all of them several years old but in pristine condition. That's how I am, I care for things. I'm not going to buy yet another one, if only because I hate waste and fear mismanagement of natural resources. That's how I am, I care for things. Now you are mandating me to add more e-waste? There is no way I'm going to do that, so I decided to connect to N26's wensite, but guess what? You need the app to login. Well, if you insist you can also login with a short message, which I did, just to check that there was no way to confirm a paiement on the website. But you can contact "support", so I tried that. To their credit, the robot bouncer was quick to admit incompetence and to connect me with a friendly fellow human, who was unfortunately only allowed to lecture me about why those "new features and enhancements" were essential to my account's security, while being unable to tell me exaclty what they were or what was the problem with the current version, and suggested I login from someone else's phone instead. Security? Whose security? To anyone working in tech, let me remind you what an actual threat model is. My actual threat model in the actual world is that your company might stole my money, or prevent me from access it which amount to the same thing. Data points: Despite all the stories on the news about mischievous hackerz from russia and china, I've been stolen money only twice in my life, not a lot of but at the time I needed it, and twice by banks. My threat model is that the electronic gadget that I bought and carry with me all the time stops obeying me and starts obeying some adversarial company. And that, in perfect novlang mastery, you want me to call this a "trusted device". My threat model is that our civilization might drown in e-waste. Want another exemple of app only service? Wait for a days or two, as I'm confident I will face the same issue soon.
  - encom 1y ago
    Yes, your bank is shit, but this is also Apple's fault to a large degree. There is absolutely no reason to release a new major version of your OS every year, and there is no reason to arbitrarily drop support for older devices (except extremely contrived ones, that I'm sure will be posted below). I made the mistake of acquiring an Ipad once. Its only job was playing YouTube videos in bed (yes I know), until Apple and Google in unison decided that it should be thrown into a landfill, because its OS was unsupported and the YouTube app, for no reason at all, would no longer work. Was the device suddenly unable to decode H.264 video or playing audio? Nope. But please just throw it in the trash and buy a new one - what are you, poor?!
scheeseman486 1y ago
I wouldn't say it's lost, but the trendlines aren't good.
wkat4242 1y ago
That the battle is lost doesn't mean we should stop fighting. Even the war being lost isn't a reason to. The equivalent in the real world is resistance.
dahrkael 1y ago
its even worse when you discover the app itself is just a webview