5 ms·

I agree with that.. additionaly, I'm finding it to be insane that organizations are trying to force you to have a "audited" phone to interact with them. (I.e. e

by monksy 3mo ago

I agree with that.. additionaly, I'm finding it to be insane that organizations are trying to force you to have a "audited" phone to interact with them. (I.e. events, businesses, etc)

andai 3mo ago
What is that? I don't seem to be finding anything relevant on Google.
- andwur 3mo ago
  Likely referring to Android's Play Integrity/hardware attestation API (good explainer from GrapheneOS [1]) that is practically used to restrict what devices/brands/Android builds an app will allow itself to be run on. [1] https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu...
- monksy 3mo ago
  We're running into situations where the usage of smart phones and apps are becoming mandatory for using services. For example: The UK has a digital ID requirement which is required for you to be employed in the UK. Additionally the EU digital identity services have a hardware/software attestitation that is required to run their apps. (Many of those which 3rd party software can't run). Another example of this is the Australian eTA - (Everyone has to have a visa to visit Australia.. but the real only way to get a visa* is you have to get an electronic travel authorization which only works via an App) https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu... Apps that ban graphene-os being used: myGov (Australian government app) gov.br (Brazilian government app) Ticketcorner Authy Chyrpe Dating TextNow mada Pay (Saudi NFC payment app) McDonald's (International app used for many but not all countries not including the US) Dott My SEAT (Connectivity for SEAT cars) SwissID Volkswagen BKK Faber-Castell & Partner TK-Doc TK-Ident TK-App (Blocks access to TK-Safe, TK-GesundheitsMessenger, fingerprint login) IO (Italian government app which uses it to gate access to the digital wallet feature) PosteID (Italian postal service’s app used to access the national digital identity system "SPID") Singpass
  - anonzzzies 3mo ago
    GrapheneOS and others should have lobbyists or rather lawyers and lawmakers to fight for using secure systems to mandatory be allowed for these. Sure, there must be some type of OS guarantee, but that should not be exclusive to Google and Apple. And indeed browsers with otp/authn devices (not one per service but yubi/thetis type of thing as those can be made sovereign for a large part); when an OS is not allowed, the browser and app should be mandatory allowed with such a device as that is, actually, more secure than the original device as it is an external encryption and encryption key source the hacker cannot reach.
    - Cider9986 3mo ago
      Us users might be effective as well. Hopefully anti-trust law catches up and bans play integrity. They are probably going to spend their money improving features and experience to get more users. There's threads on the forum dedicated to sending emails to Volkswagen to get them to support Grapheneos and it may be working.
  - subscribed 3mo ago
    > The UK has a digital ID requirement which is required for you to be employed in the UK. That's untrue. There was a strong push towards the digital ID from the current administration, but it was abandoned 6 months ago. What you likely mixed up with digital ID is the old digital visa scheme, mandatory for all non-UK citizens to prove right to work. Re: your app list: looks a little bit eclectic, so it's worth mentioning most of the apps don't ban GoS specifically, but enforce Google play strong or device integrity pass, which GoS doesn't pass. Some trip on some exploit protections, like secure app spawning, but these can be turned off per app in the latest releases based on Android 17.
    - andai 3mo ago
      > the old digital visa scheme, mandatory for all non-UK citizens to prove right to work. Weren't they accepting refugees without documentation?
LoganDark 3mo ago
I miss the days when iOS jailbreaks allowed you to completely circumvent basically all DRM because the trust in Apple was so high that you could just assume a device is secure. Contrast that with Android, which has always had invasive attestation mechanisms because of widespread mistrust in OEMs. On iOS, sometimes you had individual apps trying to check for jailbreak but that was it
- realusername 3mo ago
  Apps trying to check for jailbreak is still a thing on iOS and as you would expect, it's jank and can trigger on stock iOS if you are unluky
matheusmoreira 3mo ago
Remote attestation is not just insane, it's the technology that will end free computing as we know it today. What good is free software if using it marks our devices as untrusted and gets us banned from every service out there? Gets us ostracized from digital society? Because we "tampered" with the device? We should be able to run whatever software we want and they should be none the wiser. Instead, we are part of the threat model now. Our devices are now cryptographically attesting that they are corporate owned and that we are under corporate control. It's so disgusting. The future we're heading towards is terrifying. Everything the word hacker ever stood for will be destroyed if this keeps up.
- Cider9986 3mo ago
  It can be used for security and used privately [1] but I entirely agree with you, Google's use of it is anti-competitive and terrible. [1] attestation.app
  - preisschild 3mo ago
    Yeah same as TPM and Secureboot. They can improve your own personal security (and thereby privacy) drastically, but it has to be controlled by the user.
  - matheusmoreira 3mo ago
    It's all about who owns the keys and who trusts those keys. If you don't have the keys to "your" computer, then you don't own that computer, you're just renting it from the corporation. And even if our own keys could be used, who's going to trust those attestations? Nobody. They will trust Google's keys, Microsoft's keys, Apple's keys. Not ours.
    - teravor 3mo ago
      the intent is that no one owns those keys, your silicon should be the only entity in "possession" of those keys. but no one uses blind signatures for attestation so it can be used to fingerprint your device's serial. they do try to make it hard. but generally you should assume that if whoever you are attesting to colludes with google they will obtain your HWID - and if it's google you are attesting to you should assume they have your HWID. GOS uses a proxy for attestation, but it does absolutely nothing for this threat model. PS: DRM is even worse, there is no intermediary and the APIs are open to all apps. you probably need to be a well resourced intel agency to make use of it as you need to source a valid DRM license server certificate. technically, actual license servers are in violation of their agreements with google, apple, etc if they use the license request for fingerprinting. but they do retain the ability to blacklist silicon (invalidate pirate devices from pirated media watermarks).
daniela-vera 3mo ago
[flagged]
preisschild 3mo ago
> that organizations are trying to force you to have a "audited" phone to interact with them. (I.e. events, businesses, etc) Even worse, GOVERNMENTS do that. EU Governments basically forcing you to give Google (via the Google Mobile Services rootkit) or Apple (and via the cloud act also the Trump Admin) access to your entire phone (including all of your saved personal data) to use the govt eID system...
- inigyou 3mo ago
  Use the old-school ID system.
roysting 3mo ago
> organizations are trying to force If it were only that and we actually had “free market capitalism” and “competition” you could simply choose, but leering and steering these “organizations” is the treasonous and inherently illegitimate government, which is increasingly indistinguishable from private corporations, mostly because it’s the same pool of people, which are reflexively moving us all towards a common focal point of a form of tyranny similar to hereditary oligarchy and/or serfdom.

by monksy 3mo ago

I agree with that.. additionaly, I'm finding it to be insane that organizations are trying to force you to have a "audited" phone to interact with them. (I.e. events, businesses, etc)

andai 3mo ago

What is that? I don't seem to be finding anything relevant on Google.

andwur 3mo ago
Likely referring to Android's Play Integrity/hardware attestation API (good explainer from GrapheneOS [1]) that is practically used to restrict what devices/brands/Android builds an app will allow itself to be run on. [1] https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu...
monksy 3mo ago
We're running into situations where the usage of smart phones and apps are becoming mandatory for using services. For example: The UK has a digital ID requirement which is required for you to be employed in the UK. Additionally the EU digital identity services have a hardware/software attestitation that is required to run their apps. (Many of those which 3rd party software can't run). Another example of this is the Australian eTA - (Everyone has to have a visa to visit Australia.. but the real only way to get a visa* is you have to get an electronic travel authorization which only works via an App) https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu... Apps that ban graphene-os being used: myGov (Australian government app) gov.br (Brazilian government app) Ticketcorner Authy Chyrpe Dating TextNow mada Pay (Saudi NFC payment app) McDonald's (International app used for many but not all countries not including the US) Dott My SEAT (Connectivity for SEAT cars) SwissID Volkswagen BKK Faber-Castell & Partner TK-Doc TK-Ident TK-App (Blocks access to TK-Safe, TK-GesundheitsMessenger, fingerprint login) IO (Italian government app which uses it to gate access to the digital wallet feature) PosteID (Italian postal service’s app used to access the national digital identity system "SPID") Singpass
- anonzzzies 3mo ago
  GrapheneOS and others should have lobbyists or rather lawyers and lawmakers to fight for using secure systems to mandatory be allowed for these. Sure, there must be some type of OS guarantee, but that should not be exclusive to Google and Apple. And indeed browsers with otp/authn devices (not one per service but yubi/thetis type of thing as those can be made sovereign for a large part); when an OS is not allowed, the browser and app should be mandatory allowed with such a device as that is, actually, more secure than the original device as it is an external encryption and encryption key source the hacker cannot reach.
  - Cider9986 3mo ago
    Us users might be effective as well. Hopefully anti-trust law catches up and bans play integrity. They are probably going to spend their money improving features and experience to get more users. There's threads on the forum dedicated to sending emails to Volkswagen to get them to support Grapheneos and it may be working.
- subscribed 3mo ago
  > The UK has a digital ID requirement which is required for you to be employed in the UK. That's untrue. There was a strong push towards the digital ID from the current administration, but it was abandoned 6 months ago. What you likely mixed up with digital ID is the old digital visa scheme, mandatory for all non-UK citizens to prove right to work. Re: your app list: looks a little bit eclectic, so it's worth mentioning most of the apps don't ban GoS specifically, but enforce Google play strong or device integrity pass, which GoS doesn't pass. Some trip on some exploit protections, like secure app spawning, but these can be turned off per app in the latest releases based on Android 17.
  - andai 3mo ago
    > the old digital visa scheme, mandatory for all non-UK citizens to prove right to work. Weren't they accepting refugees without documentation?

LoganDark 3mo ago

I miss the days when iOS jailbreaks allowed you to completely circumvent basically all DRM because the trust in Apple was so high that you could just assume a device is secure. Contrast that with Android, which has always had invasive attestation mechanisms because of widespread mistrust in OEMs. On iOS, sometimes you had individual apps trying to check for jailbreak but that was it

realusername 3mo ago
Apps trying to check for jailbreak is still a thing on iOS and as you would expect, it's jank and can trigger on stock iOS if you are unluky

matheusmoreira 3mo ago

Remote attestation is not just insane, it's the technology that will end free computing as we know it today. What good is free software if using it marks our devices as untrusted and gets us banned from every service out there? Gets us ostracized from digital society? Because we "tampered" with the device? We should be able to run whatever software we want and they should be none the wiser. Instead, we are part of the threat model now. Our devices are now cryptographically attesting that they are corporate owned and that we are under corporate control. It's so disgusting. The future we're heading towards is terrifying. Everything the word hacker ever stood for will be destroyed if this keeps up.

Cider9986 3mo ago
It can be used for security and used privately [1] but I entirely agree with you, Google's use of it is anti-competitive and terrible. [1] attestation.app
- preisschild 3mo ago
  Yeah same as TPM and Secureboot. They can improve your own personal security (and thereby privacy) drastically, but it has to be controlled by the user.
- matheusmoreira 3mo ago
  It's all about who owns the keys and who trusts those keys. If you don't have the keys to "your" computer, then you don't own that computer, you're just renting it from the corporation. And even if our own keys could be used, who's going to trust those attestations? Nobody. They will trust Google's keys, Microsoft's keys, Apple's keys. Not ours.
  - teravor 3mo ago
    the intent is that no one owns those keys, your silicon should be the only entity in "possession" of those keys. but no one uses blind signatures for attestation so it can be used to fingerprint your device's serial. they do try to make it hard. but generally you should assume that if whoever you are attesting to colludes with google they will obtain your HWID - and if it's google you are attesting to you should assume they have your HWID. GOS uses a proxy for attestation, but it does absolutely nothing for this threat model. PS: DRM is even worse, there is no intermediary and the APIs are open to all apps. you probably need to be a well resourced intel agency to make use of it as you need to source a valid DRM license server certificate. technically, actual license servers are in violation of their agreements with google, apple, etc if they use the license request for fingerprinting. but they do retain the ability to blacklist silicon (invalidate pirate devices from pirated media watermarks).

daniela-vera 3mo ago

[flagged]

preisschild 3mo ago

> that organizations are trying to force you to have a "audited" phone to interact with them. (I.e. events, businesses, etc) Even worse, GOVERNMENTS do that. EU Governments basically forcing you to give Google (via the Google Mobile Services rootkit) or Apple (and via the cloud act also the Trump Admin) access to your entire phone (including all of your saved personal data) to use the govt eID system...

inigyou 3mo ago
Use the old-school ID system.

roysting 3mo ago

> organizations are trying to force If it were only that and we actually had “free market capitalism” and “competition” you could simply choose, but leering and steering these “organizations” is the treasonous and inherently illegitimate government, which is increasingly indistinguishable from private corporations, mostly because it’s the same pool of people, which are reflexively moving us all towards a common focal point of a form of tyranny similar to hereditary oligarchy and/or serfdom.