5 ms·

> The ability for us as users to lie to the apps is actually essential to preserving our agency. Without that we're screwed, as now to connect ourselves to the

> The ability for us as users to lie to the apps is actually essential to preserving our agency. Without that we're screwed, as now to connect ourselves to the fabric of the society we'll need to find and exploit vulnerabilities that are going to be patched as soon as they become public. The same freedom is being abused by malicious actors. Even on Windows (like BlackLotus), but also on pre-infected phones emptying people's bank accounts. This is an incredibly unfortunate outcome, but what's the solution? I see no other potential outcome than that free computing and trusted computing are going to be totally separate. Possibly even on the same device, but not in a way that lets anyone tamper with it.

seba_dos1 6mo ago
A lot of other freedoms are being abused and always have been, but somehow we don't go and ban kitchen knives, as having them around is valuable. This is a false dichotomy. Systems can be secure and trusted by the user without having to cede control, and some risks are just not worth eliminating. Most importantly - it's the user who needs to know whether their system has been tampered with, not apps.
- Avamander 6mo ago
  > but somehow we don't go and ban kitchen knives, as having them around is valuable Some countries do :) Though I think physical analogies are misleading in a lot of ways here. > Systems can be secure and trusted by the user without having to cede control, and some risks are just not worth eliminating. Secure, yes, trustworthy to a random developer looking at your device, no. They're entirely separate concepts. > Most importantly - it's the user who needs to know whether their system has been tampered with, not apps. Expecting users to know things does a lot of heavy lifting here.
  - seba_dos1 6mo ago
    I never mentioned users having to know things (what you quoted was about the user getting informed whether their system is compromised, which is the job of a secure boot chain). The user being in control means that the user can decide who to trust. The user may end up choosing Google, Apple, Microsoft etc. and it's fine as long as they have a choice. Most users won't even be bothered to choose and that's fine too, but with remote attestation, it's not the user who decides even if they want to. And we don't need random developers looking at our devices to consider them trustworthy, it's none of their business and it's a big mistake to let them.
    - Avamander 6mo ago
      > what you quoted was about the user getting informed whether their system is compromised, which is the job of a secure boot chain User being informed means they have to know what a compromised system would entail. That alone is a huge and frankly impossible thing to expect from regular people. > Most users won't even be bothered to choose and that's fine too, but with remote attestation, it's not the user who decides even if they want to. > And we don't need random developers looking at our devices to consider them trustworthy, it's none of their business and it's a big mistake to let them. Then you can't demand those developers trust your device.
      - seba_dos1 6mo ago
        > That alone is a huge and frankly impossible thing to expect from regular people. The systems used by regular people could just refuse to boot further when detecting a compromise, so I'm not sure where this comes from. We have prior art for that too. This is still orthogonal to letting users who want to patch things patch them, and not letting the apps verify what environment they run in. It's all compatible with each other, and with both regular and power users. > Then you can't demand those developers trust your device. Somehow we could for decades. Whether we'll still be able to in the future depends only on how much noise and friction we'll make about it now.
        Avamander 6mo ago
        > This is still orthogonal to letting users who want to patch things patch them, and not letting the apps verify what environment they run in. It's all compatible with each other, and with both regular and power users. No, they're fundamentally opposed to each other. The entire point is that developers don't want their apps patched by just anyone, especially not malicious actors. Small minority of power users will inevitably get caught in the crossfire. > Somehow we could for decades. Whether we'll still be able to in the future depends only on how much noise and friction we'll make about it now. No, you really couldn't. Past lack of technical means doesn't mean anyone trusted your device nor that we had use-cases where this was important. (It was also usually solved with external hardware, physical dongles and whatnot.)
- goblin89 6mo ago
  > somehow we don't go and ban kitchen knives False analogy. You can’t have your kitchen knife exploited by a hacker team in North Korea, who shotgun attacks half of the public Internet infrastructure and uses the proceeds to fund the national nuclear program, can you? (I somewhat exaggerate, but you get the idea.) > Systems can be secure and trusted by the user without having to cede control In an ideal world where users have infinite information and infinite capability to process and internalize it to become an infosec expert, sure. I don’t know about you, but most of us don’t live in that world. I agree it’s not perfect. Having to use liquid glass and being unable to install custom watch faces is ridiculous. There’s probably an opportunity for a hardened OS which can be trusted by interested parties to not be maliciously altered, and also not force so many constraints onto users like current walled gardens do. But a fully open OS, plus an ordinary user who has no time or willingness to casually become a tptacek on the side, in addition to completely unrelated full-time job that’s getting more competitive due to LLMs and whatnot, seems more like a disaster than utopia.
  - ruszki 6mo ago
    > You can’t have your kitchen knife exploited by a hacker team in North Korea, who shotgun attacks half of the public Internet infrastructure and uses the proceeds to fund the national nuclear program, can you? (I somewhat exaggerate, but you get the idea.) Isn’t the status quo, that you need to intentionally choose to allow this?
    - seba_dos1 6mo ago
      Yes (well, kinda - attested systems can be and are vulnerable too), and remote attestation is completely orthogonal to that threat anyway. Securing the boot chain does not involve letting apps verify the environment they run in, it's an extra (anti-)feature that's built on top of secure boot chains. It's also really incredible how people can see "user being in control" and just immediately jump to "user having to be an infosec expert", as if one implied the other. You can't really discuss things in good faith in such climate :(
      - 6mo ago
ruszki 6mo ago
How large is this preinfected phones problem? Is it large enough to sacrifice freedom?
- Avamander 6mo ago
  We have had a large discovery of pre-installed malware every year for the past decade so far. Seems like a fairly big problem.
  - seba_dos1 6mo ago
    And how exactly did attestation help there? Securing apps from the user does not secure the user from malware.
    - Avamander 6mo ago
      Now you can't bundle malware deep within the system "ROM" unless you want to break SafetyNet's attestation. It's a big change in that aspect.
      - ruszki 6mo ago
        Custom ROMs tell you that this is not true at all.
        Avamander 6mo ago
        Custom ROMs no longer pass SafetyNet attestation, which apps such as banking ones (or streaming service ones) check.
        ruszki 6mo ago
        I hope you mean Play Integrity, since there is no SafetyNet attestation anymore. And for that: https://github.com/osm0sis/PlayIntegrityFork https://github.com/osm0sis/PlayIntegrityFork But there were similar things for SafetyNet attestation until it existed.

seba_dos1 6mo ago

A lot of other freedoms are being abused and always have been, but somehow we don't go and ban kitchen knives, as having them around is valuable. This is a false dichotomy. Systems can be secure and trusted by the user without having to cede control, and some risks are just not worth eliminating. Most importantly - it's the user who needs to know whether their system has been tampered with, not apps.

Avamander 6mo ago
> but somehow we don't go and ban kitchen knives, as having them around is valuable Some countries do :) Though I think physical analogies are misleading in a lot of ways here. > Systems can be secure and trusted by the user without having to cede control, and some risks are just not worth eliminating. Secure, yes, trustworthy to a random developer looking at your device, no. They're entirely separate concepts. > Most importantly - it's the user who needs to know whether their system has been tampered with, not apps. Expecting users to know things does a lot of heavy lifting here.
- seba_dos1 6mo ago
  I never mentioned users having to know things (what you quoted was about the user getting informed whether their system is compromised, which is the job of a secure boot chain). The user being in control means that the user can decide who to trust. The user may end up choosing Google, Apple, Microsoft etc. and it's fine as long as they have a choice. Most users won't even be bothered to choose and that's fine too, but with remote attestation, it's not the user who decides even if they want to. And we don't need random developers looking at our devices to consider them trustworthy, it's none of their business and it's a big mistake to let them.
  - Avamander 6mo ago
    > what you quoted was about the user getting informed whether their system is compromised, which is the job of a secure boot chain User being informed means they have to know what a compromised system would entail. That alone is a huge and frankly impossible thing to expect from regular people. > Most users won't even be bothered to choose and that's fine too, but with remote attestation, it's not the user who decides even if they want to. > And we don't need random developers looking at our devices to consider them trustworthy, it's none of their business and it's a big mistake to let them. Then you can't demand those developers trust your device.
    - seba_dos1 6mo ago
      > That alone is a huge and frankly impossible thing to expect from regular people. The systems used by regular people could just refuse to boot further when detecting a compromise, so I'm not sure where this comes from. We have prior art for that too. This is still orthogonal to letting users who want to patch things patch them, and not letting the apps verify what environment they run in. It's all compatible with each other, and with both regular and power users. > Then you can't demand those developers trust your device. Somehow we could for decades. Whether we'll still be able to in the future depends only on how much noise and friction we'll make about it now.
      - Avamander 6mo ago
        > This is still orthogonal to letting users who want to patch things patch them, and not letting the apps verify what environment they run in. It's all compatible with each other, and with both regular and power users. No, they're fundamentally opposed to each other. The entire point is that developers don't want their apps patched by just anyone, especially not malicious actors. Small minority of power users will inevitably get caught in the crossfire. > Somehow we could for decades. Whether we'll still be able to in the future depends only on how much noise and friction we'll make about it now. No, you really couldn't. Past lack of technical means doesn't mean anyone trusted your device nor that we had use-cases where this was important. (It was also usually solved with external hardware, physical dongles and whatnot.)
goblin89 6mo ago
> somehow we don't go and ban kitchen knives False analogy. You can’t have your kitchen knife exploited by a hacker team in North Korea, who shotgun attacks half of the public Internet infrastructure and uses the proceeds to fund the national nuclear program, can you? (I somewhat exaggerate, but you get the idea.) > Systems can be secure and trusted by the user without having to cede control In an ideal world where users have infinite information and infinite capability to process and internalize it to become an infosec expert, sure. I don’t know about you, but most of us don’t live in that world. I agree it’s not perfect. Having to use liquid glass and being unable to install custom watch faces is ridiculous. There’s probably an opportunity for a hardened OS which can be trusted by interested parties to not be maliciously altered, and also not force so many constraints onto users like current walled gardens do. But a fully open OS, plus an ordinary user who has no time or willingness to casually become a tptacek on the side, in addition to completely unrelated full-time job that’s getting more competitive due to LLMs and whatnot, seems more like a disaster than utopia.
- ruszki 6mo ago
  > You can’t have your kitchen knife exploited by a hacker team in North Korea, who shotgun attacks half of the public Internet infrastructure and uses the proceeds to fund the national nuclear program, can you? (I somewhat exaggerate, but you get the idea.) Isn’t the status quo, that you need to intentionally choose to allow this?
  - seba_dos1 6mo ago
    Yes (well, kinda - attested systems can be and are vulnerable too), and remote attestation is completely orthogonal to that threat anyway. Securing the boot chain does not involve letting apps verify the environment they run in, it's an extra (anti-)feature that's built on top of secure boot chains. It's also really incredible how people can see "user being in control" and just immediately jump to "user having to be an infosec expert", as if one implied the other. You can't really discuss things in good faith in such climate :(
    - 6mo ago

ruszki 6mo ago

How large is this preinfected phones problem? Is it large enough to sacrifice freedom?

Avamander 6mo ago
We have had a large discovery of pre-installed malware every year for the past decade so far. Seems like a fairly big problem.
- seba_dos1 6mo ago
  And how exactly did attestation help there? Securing apps from the user does not secure the user from malware.
  - Avamander 6mo ago
    Now you can't bundle malware deep within the system "ROM" unless you want to break SafetyNet's attestation. It's a big change in that aspect.
    - ruszki 6mo ago
      Custom ROMs tell you that this is not true at all.
      - Avamander 6mo ago
        Custom ROMs no longer pass SafetyNet attestation, which apps such as banking ones (or streaming service ones) check.
        ruszki 6mo ago
        I hope you mean Play Integrity, since there is no SafetyNet attestation anymore. And for that: https://github.com/osm0sis/PlayIntegrityFork https://github.com/osm0sis/PlayIntegrityFork But there were similar things for SafetyNet attestation until it existed.