5 ms·

> It's funny that the EU uses all this mobile attestation BS more than the US does Attestation in on itself isn't unwarranted which (to me) is an important sec

> It's funny that the EU uses all this mobile attestation BS more than the US does Attestation in on itself isn't unwarranted which (to me) is an important security measure. Attestation as commonly implemented on Android via Play Integrity (the way banking apps are known to do) is restrictive, sure: https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu... / https://archive.is/snGEu https://archive.is/snGEu

xyzzy123 8mo ago
An important security measure for who, though? The servers at the bank should "never trust the client" in case the attestation is bypassed or compromised, which is always a risk at scale. If it's an important safety measure _for me_, shouldn't I get to decide whether I need it based on context? I think it's fair for banks to apply different risk scores based on the signals they have available (including attestation state), but I also don't want the financial system, government & big tech platforms to have a hard veto on what devices I compute with.
- miki123211 8mo ago
  It's an anti-brute-force mechanism. It's not for you, it's for all the other accounts that an unattested phone (or a bot posing as an unattested phone that just stole somebody's credentials via some 0-day data exfiltration exploit) may be trying to access. Sure, banks could probably build a mechanism that lets some users opt out of this, just as they could add a Klingon localization to their apps. There just isn't enough demand.
  - xyzzy123 8mo ago
    If you work on mobile apps you will notice that full attestation is too slow to put in the login path. [This might be better than it used to be, now in 2026]. I don't think a good security engineer would rely on atty as "front line" anti brute force control since bypasses are not that rare. But yeah you might incorporate it into the flow. Just like captchas, rate limiting, fingerprints etc and all the other controls you need for web, anyway. I know I'm quibbling. My concern is that future where banks can "trust the client" is a future of total big tech capture of computing platforms, and I know banks and government don't really care, but I do.
    - digiown 8mo ago
      > total big tech capture of computing platforms Correct. And the end of ownership, privacy, and truth too. If something can betray you on someone else's orders, it's not yours in the first place. You'll own nothing and if you aren't happy, good luck living in the woods.
    - ignoramous 8mo ago
      > you work on mobile apps you will notice that full attestation is too slow to put in the login path Hm, Play Integrity isn't that slow on Android, from my experience. > don't think a good security engineer would rely on atty as "front line" anti brute force control since bypasses are not that rare I'm not privy to device-wide bypasses of Play Integrity that ship with Trusted Execution Environment (which is pretty much all ARM based Androids), Secure Element, and/or Hardware Root of Trust, but I'd appreciate if you have some significant exploit writeups (on Pixels, preferably) for me to look at? > My concern is that future where banks can "trust the client" is a future of total big tech capture of computing platforms A valid concern. In the case of smart & personal devices like Androids though, the security is warranted due to the nature of the workloads it tends to support (think Pacemaker / Insulin monitoring apps; government-issued IDs; financial instruments like credit cards; etc) and the ubiquity & proliferation of the OS (more than half of all humanity) itself.
      - digiown 8mo ago
        > Insulin monitoring apps A monitoring app doesn't even interact with systems you don't own. Just put a liability disclaimer for running modified versions. > warranted Decided by whom? And why is Google trusted, not me? At minimum, I shouldn't face undue hardship with the government due to refusing to deal with a third party, unless we first remove most of Google's rights to set the terms.
        ignoramous 8mo ago
        > A monitoring app doesn't even interact with systems you don't own. Just put a liability disclaimer for running modified versions. This is unserious when Insulin overdose can be fatal. > And why is Google trusted, not me? (Hardware-assisted) Attestation on Android doesn't require apps to "trust Google".
digiown 8mo ago
> important security measure It's a security measure against the owner of the device, in other words, an attack. Would you be okay with me using a remote control to forcibly slow down your car so I can merge? Using attestation this way is fundamentally incompatible with ownership. If the bank wants some assurance about a device, they need to sell or issue one to me, like credit cards or point of sale machines, which are explicitly not your property. The fact that the assurance is provided by a third party you have little recourse against just adds insult to injury.
- ignoramous 8mo ago
  > If the bank wants some assurance about a device, they need to sell or issue one to me, like credit cards or point of sale machines, which are explicitly not your property. In this example, a banking app is not making the entire Android device non functional when it refuses to work when remote attestation like Play Integrity fails.
  - digiown 8mo ago
    It is colluding with a third party to increase their power. What devices pass Play Integrity? Yeah, the same ones with all the telemetry and spying that you can't remove. I thought the government is supposed to protect consumer rights, not to tilt the playing field even further. Like I said, I'd be fine if they offer a viable alternative, like a card or a physical authentication dongle (which doesn't require spyware to use).
  - modo_mario 8mo ago
    I don't want to depend on google and android for EU mobile attestation or the like. I didn't think anyone wants government enforced duopolies.
- JambalayaJimbo 8mo ago
  >against the owner of the device Would you consider MFA to be a measure against you, the owner of the device, because it makes it harder for you to login? >If the bank wants some assurance about a device, they need to sell or issue one to me They are offering you free software and are operating under a security model tied to these specific devices. You're still free to walk into their branches, or use their physical cards, if you prefer not use their limited selection of devices. >Would you be okay with me using a remote control to forcibly slow down your car Car manufacturers do this as well though. Some of this is for the benefit of their customers (preventing theft from easily cloned keys). Some of this is not for customer benefit, like locking down infotainment systems. Banks however are only interested in preventing fraud.

xyzzy123 8mo ago

An important security measure for who, though? The servers at the bank should "never trust the client" in case the attestation is bypassed or compromised, which is always a risk at scale. If it's an important safety measure _for me_, shouldn't I get to decide whether I need it based on context? I think it's fair for banks to apply different risk scores based on the signals they have available (including attestation state), but I also don't want the financial system, government & big tech platforms to have a hard veto on what devices I compute with.

miki123211 8mo ago
It's an anti-brute-force mechanism. It's not for you, it's for all the other accounts that an unattested phone (or a bot posing as an unattested phone that just stole somebody's credentials via some 0-day data exfiltration exploit) may be trying to access. Sure, banks could probably build a mechanism that lets some users opt out of this, just as they could add a Klingon localization to their apps. There just isn't enough demand.
- xyzzy123 8mo ago
  If you work on mobile apps you will notice that full attestation is too slow to put in the login path. [This might be better than it used to be, now in 2026]. I don't think a good security engineer would rely on atty as "front line" anti brute force control since bypasses are not that rare. But yeah you might incorporate it into the flow. Just like captchas, rate limiting, fingerprints etc and all the other controls you need for web, anyway. I know I'm quibbling. My concern is that future where banks can "trust the client" is a future of total big tech capture of computing platforms, and I know banks and government don't really care, but I do.
  - digiown 8mo ago
    > total big tech capture of computing platforms Correct. And the end of ownership, privacy, and truth too. If something can betray you on someone else's orders, it's not yours in the first place. You'll own nothing and if you aren't happy, good luck living in the woods.
  - ignoramous 8mo ago
    > you work on mobile apps you will notice that full attestation is too slow to put in the login path Hm, Play Integrity isn't that slow on Android, from my experience. > don't think a good security engineer would rely on atty as "front line" anti brute force control since bypasses are not that rare I'm not privy to device-wide bypasses of Play Integrity that ship with Trusted Execution Environment (which is pretty much all ARM based Androids), Secure Element, and/or Hardware Root of Trust, but I'd appreciate if you have some significant exploit writeups (on Pixels, preferably) for me to look at? > My concern is that future where banks can "trust the client" is a future of total big tech capture of computing platforms A valid concern. In the case of smart & personal devices like Androids though, the security is warranted due to the nature of the workloads it tends to support (think Pacemaker / Insulin monitoring apps; government-issued IDs; financial instruments like credit cards; etc) and the ubiquity & proliferation of the OS (more than half of all humanity) itself.
    - digiown 8mo ago
      > Insulin monitoring apps A monitoring app doesn't even interact with systems you don't own. Just put a liability disclaimer for running modified versions. > warranted Decided by whom? And why is Google trusted, not me? At minimum, I shouldn't face undue hardship with the government due to refusing to deal with a third party, unless we first remove most of Google's rights to set the terms.
      - ignoramous 8mo ago
        > A monitoring app doesn't even interact with systems you don't own. Just put a liability disclaimer for running modified versions. This is unserious when Insulin overdose can be fatal. > And why is Google trusted, not me? (Hardware-assisted) Attestation on Android doesn't require apps to "trust Google".

digiown 8mo ago

> important security measure It's a security measure against the owner of the device, in other words, an attack. Would you be okay with me using a remote control to forcibly slow down your car so I can merge? Using attestation this way is fundamentally incompatible with ownership. If the bank wants some assurance about a device, they need to sell or issue one to me, like credit cards or point of sale machines, which are explicitly not your property. The fact that the assurance is provided by a third party you have little recourse against just adds insult to injury.

ignoramous 8mo ago
> If the bank wants some assurance about a device, they need to sell or issue one to me, like credit cards or point of sale machines, which are explicitly not your property. In this example, a banking app is not making the entire Android device non functional when it refuses to work when remote attestation like Play Integrity fails.
- digiown 8mo ago
  It is colluding with a third party to increase their power. What devices pass Play Integrity? Yeah, the same ones with all the telemetry and spying that you can't remove. I thought the government is supposed to protect consumer rights, not to tilt the playing field even further. Like I said, I'd be fine if they offer a viable alternative, like a card or a physical authentication dongle (which doesn't require spyware to use).
- modo_mario 8mo ago
  I don't want to depend on google and android for EU mobile attestation or the like. I didn't think anyone wants government enforced duopolies.
JambalayaJimbo 8mo ago
>against the owner of the device Would you consider MFA to be a measure against you, the owner of the device, because it makes it harder for you to login? >If the bank wants some assurance about a device, they need to sell or issue one to me They are offering you free software and are operating under a security model tied to these specific devices. You're still free to walk into their branches, or use their physical cards, if you prefer not use their limited selection of devices. >Would you be okay with me using a remote control to forcibly slow down your car Car manufacturers do this as well though. Some of this is for the benefit of their customers (preventing theft from easily cloned keys). Some of this is not for customer benefit, like locking down infotainment systems. Banks however are only interested in preventing fraud.