6 ms·

I attestation should be abolished altogether. An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has m

I attestation should be abolished altogether. An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. It is up to each individual to ensure the security of their own device. App developers should do no more than offer recommendations. If someone wants to use GrapheneOS, root their device (not recommended), or run the whole thing in an emulator, a homemade compatibility layer under Linux, or a custom port for MS-DOS, that should be possible.

reddalo 6mo ago
Exactly. It's my own device, I can do whatever I please with it. There shouldn't be an automated way for apps to check if my device has been blessed by the US tech giants or not.
- deleted 6mo ago
  [deleted]
- jurgenburgen 6mo ago
  It’s my own device so I should be allowed to let the manufacturer make it secure so I don’t need to worry about security. I don’t want _all_ my devices to behave like that but I definitely want my phone to be more trustworthy for banking and government service purposes.
  - like_any_other 6mo ago
    > I should be allowed to let the manufacturer make it secure so I don’t need to worry about security. You can still do this by simply not rooting your phone, or replacing the manufacturer's cryptographic key with your own, or altering whatever other 'security' measures are in place. What you're asking for is to have no other choice but to give the manufacturer control over your devices.
  - estimator7292 6mo ago
    That's not the problem at all. The problem is that manufacturers are forcing everyone into this scheme for the express purpose of mass surveillance and control. It has nothing to do with making your device "secure"
kodebach 6mo ago
I agree, you should be able to run anything you want, root your device, etc., but you also have to accept the consequences of that. If an app can no longer verify its own integrity, certain features are simply impossible to implement securely. Think of it this way: A physical ID (which is what we're trying to replace here) also has limitations, it looks a certain way, has a certain size, etc. Just because somebody wants a smaller ID or one with a larger font or a passport in a different colour or whatever, doesn't mean that this should be allowed or possible. Some limitations exist for a good reason
- applfanboysbgon 6mo ago
  Comparing being able to run the hardware and software of your choice to "wanting a passport in a different color or whatever" is so completely fucked, and it's beyond insane as a justification for giving two American tech companies with a well established track record for doing evil control over your citizens' ID. The world has gone absolutely mad, what the fuck am I even witnessing? It is quite literally becoming 1984 in front of my eyes, with people complying completely voluntarily and openly advocating for it, not even a threat of force to make it happen.
  - Avamander 6mo ago
    You keep lashing out at people in this thread. Demanding full control over something like an ID will fundamentally not happen. The same way you won't have full control over the way passports or paper bills are made. Take for example the expectation that some poor fool's ID can't be cloned and reused by malicious actors - full control directly contradicts that. It will not and must not be possible.
    - applfanboysbgon 6mo ago
      We don't need 'full control' over an ID. We need the status quo, where we have mostly have control over our devices, and where paper IDs are still the foundation of society. Things are fine the way they are. There are problems, sure, but no problems that are made better by an all-encompassing surveillance state. If I am lashing out, it is because this is perhaps the most dangerous thing I've ever seen proposed, and it is deeply distressing how people are sleepwalking into it. To be honest, if I were German, I would probably just kill myself the day I was legally mandated by my government to register my identity with Google. That might sound hyperbolic, but I'm really not kidding. I have lived with privacy, anonymity, and freedom for all of my life. If the future of this world is one where the government and Google have complete control over every single thing you do, I'd rather die having lived a satisfying life than witness the horrors that are to come.
no_time 6mo ago
This is the original sin of modern computing. Almost all anti user features are only made possible because we didn't pass laws against "secure elements" that serve the maker and not the owner when NGSCB got announced.
aenis 6mo ago
Exactly this. And whats more, the idea of device attestation makes people trust those devices, and the history of rooting consoles and phones proves that nothing holds, even tech backed by billions in commercial interest. The whole point in reducing the blast radius is valid - by all means make this optional and allow the user to elect to tie their identity to the device. For everyone else, implement validation of actual transactions, not just user secrets and device secrets.
viktorcode 6mo ago
> An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. and therefore the app cannot give a reasonable guarantee that it is not running in an adversarial environment that actively tries to break the app's integrity. Thus, the app cannot be used as a verified ID with governmental level of trust.
- pona-a 6mo ago
  If your app needs to be protected from harm, it cannot protect the user from said harm. I hoped software engineering culture was lucky to not have the same precepts that make lockpicking a crime in the real world, that we successfully make it into common knowledge that you can't grant any trust to the client, but it seems "trusted computing" is making some of us unlearn that lesson.
  - Grisu_FTP 6mo ago
    While this is HEAVILY off-topic i just have to say it. "common knowledge that you can't grant any trust to the client" is the exact reason it annoys me so much when peoples solution to cheaters in video games is basically just "Rootkit my pc please" As long as the anticheat is Client sided, you shouldnt put trust in it.
- Aachen 6mo ago
  There's a difference between needing to lock down the whole OS and just the secure element. The secure hardware component can sign a challenge and prove possession of a private key without you being able to extract it. Smartcards have done this for decades (most people here will know an implementation under the name Yubikey). Conveying authentic information across untrusted channels (your phone screen, say) has been a solved problem since asymmetric cryptography was invented back before I was born
- like_any_other 6mo ago
  > an adversarial environment that actively tries to break the app's integrity Can you elaborate on what this means? Who is the adversary? What kind of 'integrity'? This sounds like the kind of vague language DRM uses to try to obscure the fact that it sees the users as the enemy. An XBox is 'compromised' when it obeys its owner, not Microsoft.
surcap526 6mo ago
[dead]

reddalo 6mo ago

Exactly. It's my own device, I can do whatever I please with it. There shouldn't be an automated way for apps to check if my device has been blessed by the US tech giants or not.

deleted 6mo ago
[deleted]
jurgenburgen 6mo ago
It’s my own device so I should be allowed to let the manufacturer make it secure so I don’t need to worry about security. I don’t want _all_ my devices to behave like that but I definitely want my phone to be more trustworthy for banking and government service purposes.
- like_any_other 6mo ago
  > I should be allowed to let the manufacturer make it secure so I don’t need to worry about security. You can still do this by simply not rooting your phone, or replacing the manufacturer's cryptographic key with your own, or altering whatever other 'security' measures are in place. What you're asking for is to have no other choice but to give the manufacturer control over your devices.
- estimator7292 6mo ago
  That's not the problem at all. The problem is that manufacturers are forcing everyone into this scheme for the express purpose of mass surveillance and control. It has nothing to do with making your device "secure"

kodebach 6mo ago

I agree, you should be able to run anything you want, root your device, etc., but you also have to accept the consequences of that. If an app can no longer verify its own integrity, certain features are simply impossible to implement securely. Think of it this way: A physical ID (which is what we're trying to replace here) also has limitations, it looks a certain way, has a certain size, etc. Just because somebody wants a smaller ID or one with a larger font or a passport in a different colour or whatever, doesn't mean that this should be allowed or possible. Some limitations exist for a good reason

applfanboysbgon 6mo ago
Comparing being able to run the hardware and software of your choice to "wanting a passport in a different color or whatever" is so completely fucked, and it's beyond insane as a justification for giving two American tech companies with a well established track record for doing evil control over your citizens' ID. The world has gone absolutely mad, what the fuck am I even witnessing? It is quite literally becoming 1984 in front of my eyes, with people complying completely voluntarily and openly advocating for it, not even a threat of force to make it happen.
- Avamander 6mo ago
  You keep lashing out at people in this thread. Demanding full control over something like an ID will fundamentally not happen. The same way you won't have full control over the way passports or paper bills are made. Take for example the expectation that some poor fool's ID can't be cloned and reused by malicious actors - full control directly contradicts that. It will not and must not be possible.
  - applfanboysbgon 6mo ago
    We don't need 'full control' over an ID. We need the status quo, where we have mostly have control over our devices, and where paper IDs are still the foundation of society. Things are fine the way they are. There are problems, sure, but no problems that are made better by an all-encompassing surveillance state. If I am lashing out, it is because this is perhaps the most dangerous thing I've ever seen proposed, and it is deeply distressing how people are sleepwalking into it. To be honest, if I were German, I would probably just kill myself the day I was legally mandated by my government to register my identity with Google. That might sound hyperbolic, but I'm really not kidding. I have lived with privacy, anonymity, and freedom for all of my life. If the future of this world is one where the government and Google have complete control over every single thing you do, I'd rather die having lived a satisfying life than witness the horrors that are to come.

no_time 6mo ago

This is the original sin of modern computing. Almost all anti user features are only made possible because we didn't pass laws against "secure elements" that serve the maker and not the owner when NGSCB got announced.

aenis 6mo ago

Exactly this. And whats more, the idea of device attestation makes people trust those devices, and the history of rooting consoles and phones proves that nothing holds, even tech backed by billions in commercial interest. The whole point in reducing the blast radius is valid - by all means make this optional and allow the user to elect to tie their identity to the device. For everyone else, implement validation of actual transactions, not just user secrets and device secrets.

viktorcode 6mo ago

> An app should have absolutely no way of knowing what kind of device it’s running on or what changes the user has made to the system. and therefore the app cannot give a reasonable guarantee that it is not running in an adversarial environment that actively tries to break the app's integrity. Thus, the app cannot be used as a verified ID with governmental level of trust.

pona-a 6mo ago
If your app needs to be protected from harm, it cannot protect the user from said harm. I hoped software engineering culture was lucky to not have the same precepts that make lockpicking a crime in the real world, that we successfully make it into common knowledge that you can't grant any trust to the client, but it seems "trusted computing" is making some of us unlearn that lesson.
- Grisu_FTP 6mo ago
  While this is HEAVILY off-topic i just have to say it. "common knowledge that you can't grant any trust to the client" is the exact reason it annoys me so much when peoples solution to cheaters in video games is basically just "Rootkit my pc please" As long as the anticheat is Client sided, you shouldnt put trust in it.
Aachen 6mo ago
There's a difference between needing to lock down the whole OS and just the secure element. The secure hardware component can sign a challenge and prove possession of a private key without you being able to extract it. Smartcards have done this for decades (most people here will know an implementation under the name Yubikey). Conveying authentic information across untrusted channels (your phone screen, say) has been a solved problem since asymmetric cryptography was invented back before I was born
like_any_other 6mo ago
> an adversarial environment that actively tries to break the app's integrity Can you elaborate on what this means? Who is the adversary? What kind of 'integrity'? This sounds like the kind of vague language DRM uses to try to obscure the fact that it sees the users as the enemy. An XBox is 'compromised' when it obeys its owner, not Microsoft.

surcap526 6mo ago

[dead]