2 ms·

The application requires remote attestation, like any serious financial application handling money probably should, and unfortunately there are no alternatives

by jeroenhd 10mo ago

The application requires remote attestation, like any serious financial application handling money probably should, and unfortunately there are no alternatives to Apple or Google on this front at the moment. However, this payment system also comes with physical dedicated bank cards that can be used with the new system. There is no need to run an app.

vrighter 10mo ago
I can't use my banking app. Because of some apps I installed from f-droid, and because I modified my open source keyboard and built my own. Therefore I am the only person in the world running this specific application, since I tailored it for myself. No other system has ever seen that application, so attestation fails on my device. It's not even rooted. Meanwhile, on my linux PC with full root access, because I am the admin, this somehow isn't an issue. No, attestation is not needed. It never was before, and it still isn't, especially because it is NOT required on systems that have way more chance of being set up insecurely. There's nothing stopping me from viewing the source code of the page. There is nothing stopping me from taking a screenshot. There is nothing stopping me from doing anything. I am root on my machine, and that's ok there. Why is remote attestation required? Why the hell would I even want google to "vouch for me" as a european?
- ben_w 10mo ago
  > Meanwhile, on my linux PC with full root access, because I am the admin, this somehow isn't an issue. No, attestation is not needed. It never was before, and it still isn't, especially because it is NOT required on systems that have way more chance of being set up insecurely. There's nothing stopping me from viewing the source code of the page. There is nothing stopping me from taking a screenshot. There is nothing stopping me from doing anything. I am root on my machine, and that's ok there. Why is remote attestation required? Why the hell would I even want google to "vouch for me" as a european? Swiss-cheese security sprinkled upon grandfathering in PCs. The former: there's no such thing as perfect security. The latter: PC security model is awful, but we always had it and it would break stuff to get rid of it entirely.
  - vrighter 10mo ago
    I neither need nor want protection from myself, though

vrighter 10mo ago

I can't use my banking app. Because of some apps I installed from f-droid, and because I modified my open source keyboard and built my own. Therefore I am the only person in the world running this specific application, since I tailored it for myself. No other system has ever seen that application, so attestation fails on my device. It's not even rooted. Meanwhile, on my linux PC with full root access, because I am the admin, this somehow isn't an issue. No, attestation is not needed. It never was before, and it still isn't, especially because it is NOT required on systems that have way more chance of being set up insecurely. There's nothing stopping me from viewing the source code of the page. There is nothing stopping me from taking a screenshot. There is nothing stopping me from doing anything. I am root on my machine, and that's ok there. Why is remote attestation required? Why the hell would I even want google to "vouch for me" as a european?

ben_w 10mo ago
> Meanwhile, on my linux PC with full root access, because I am the admin, this somehow isn't an issue. No, attestation is not needed. It never was before, and it still isn't, especially because it is NOT required on systems that have way more chance of being set up insecurely. There's nothing stopping me from viewing the source code of the page. There is nothing stopping me from taking a screenshot. There is nothing stopping me from doing anything. I am root on my machine, and that's ok there. Why is remote attestation required? Why the hell would I even want google to "vouch for me" as a european? Swiss-cheese security sprinkled upon grandfathering in PCs. The former: there's no such thing as perfect security. The latter: PC security model is awful, but we always had it and it would break stuff to get rid of it entirely.
- vrighter 10mo ago
  I neither need nor want protection from myself, though