3 ms·

I can't use my banking app. Because of some apps I installed from f-droid, and because I modified my open source keyboard and built my own. Therefore I am the o

by vrighter 10mo ago

I can't use my banking app. Because of some apps I installed from f-droid, and because I modified my open source keyboard and built my own. Therefore I am the only person in the world running this specific application, since I tailored it for myself. No other system has ever seen that application, so attestation fails on my device. It's not even rooted. Meanwhile, on my linux PC with full root access, because I am the admin, this somehow isn't an issue. No, attestation is not needed. It never was before, and it still isn't, especially because it is NOT required on systems that have way more chance of being set up insecurely. There's nothing stopping me from viewing the source code of the page. There is nothing stopping me from taking a screenshot. There is nothing stopping me from doing anything. I am root on my machine, and that's ok there. Why is remote attestation required? Why the hell would I even want google to "vouch for me" as a european?

ben_w 10mo ago
> Meanwhile, on my linux PC with full root access, because I am the admin, this somehow isn't an issue. No, attestation is not needed. It never was before, and it still isn't, especially because it is NOT required on systems that have way more chance of being set up insecurely. There's nothing stopping me from viewing the source code of the page. There is nothing stopping me from taking a screenshot. There is nothing stopping me from doing anything. I am root on my machine, and that's ok there. Why is remote attestation required? Why the hell would I even want google to "vouch for me" as a european? Swiss-cheese security sprinkled upon grandfathering in PCs. The former: there's no such thing as perfect security. The latter: PC security model is awful, but we always had it and it would break stuff to get rid of it entirely.
- vrighter 9mo ago
  I neither need nor want protection from myself, though

ben_w 10mo ago

> Meanwhile, on my linux PC with full root access, because I am the admin, this somehow isn't an issue. No, attestation is not needed. It never was before, and it still isn't, especially because it is NOT required on systems that have way more chance of being set up insecurely. There's nothing stopping me from viewing the source code of the page. There is nothing stopping me from taking a screenshot. There is nothing stopping me from doing anything. I am root on my machine, and that's ok there. Why is remote attestation required? Why the hell would I even want google to "vouch for me" as a european? Swiss-cheese security sprinkled upon grandfathering in PCs. The former: there's no such thing as perfect security. The latter: PC security model is awful, but we always had it and it would break stuff to get rid of it entirely.

vrighter 9mo ago
I neither need nor want protection from myself, though