zb3

42 ms·

841.
by zb3 3y ago
I'm unable to understand this. Since the API doesn't provide a way to force a specific atestor to be invoked, doesn't it mean it will be the browser that decides which atestor can run on a given platform? Of course then subst
842.
by zb3 3y ago
Compete in anticompetitiveness? Attestation is the problem itself, it makes it harder to compete, by definition excluding any newly created environment. But this isn't really my problem as I'm not a business. As an user, I'd
843.
by zb3 3y ago
Even if that'd be the case I'd still consider this API nothing more than a framework for enabling anticompetitive behaviour. But let's go back to the "anyone as attestor" argument. I don't see it in the API at
844.
by zb3 3y ago
But: 1) I meant damage to them, bots are beneficial for users (scrapping services) just like piracy (but this is a political point) 2) Even if the reason for these changes it to fight that "fraud", it does NOT mean it won't b
845.
by zb3 3y ago
> Google could accomplish all of their supposedly nefarirous goals by just ignoring the linux users. No, because in order to ignore linux users you'd need to know that the device in question is actually running linux. But then again
846.
by zb3 3y ago
Having access to hardware information doesn't imply being able to transfer them to websites in a trusted way that the user can't modify. Chrome runs in the userspace, whereas I can write a kernel module which chrome can't int
847.
by zb3 3y ago
That's not the competition I really meant, replace hardware vendors with OS vendors / Google. "Android certified" means it follows Google's rules, so there's no way to compete by creating alternative security m
848.
by zb3 3y ago
Of course it is anticompetitive, if a given service (which is defacto mandatory) strikes a deal with select few hardware vendors to artificially make it impossible to access the service using different hardware (for purely business reasons
849.
by zb3 3y ago
Where did I say you could access these without authentication? Nowhere. But I can still access them with my device being controlled by me, I can create bots/extensions to export and archive content. I can because there's no reliab
850.
by zb3 3y ago
How can they get hardware attestation right now? They can't, that's why WEI is proposed.
851.
by zb3 3y ago
How can they verify it now with hardware-based security? They can't, that's why WEI is proposed, to bridge device attestation API. While trivial fingerprinting methods can be bypassed, TEE-based methods are pretty much impossible
852.
by zb3 3y ago
Those methods didn't kill the open web because they could be bypassed, and that's precisely why WEI was proposed.
853.
by zb3 3y ago
The problem is that the owner of the device is considered "untrusted" here. While that sometimes makes sense (for law enforcement purposes), using this for business purposes is anticompetitive. It shouldn't be possible for co
854.
by zb3 3y ago
Well actually fuck "professional content producers", there's always someone there who writes just because they want others to read, I'll just read them instead and it'd be good if the search engine let me find them
855.
by zb3 3y ago
I'd prefer reading content written by people who are just interested in the topic and sharing their thoughts. I want genuine interaction, not commercial garbage.
856.
by zb3 3y ago
That's why I mentioned intel deprecating SGX, because newer desktop CPU's don't support that, so it'd be impractical for websites to discriminate based on that. Also note that servers running in the cloud can naturally b
857.
by zb3 3y ago
Yes, but I just wanted to highlight that here we have a completely new attack surface - hardware-level hacking, which is not the same as hacking hardware via software (like Spectre/Meltdown) :)
858.
by zb3 3y ago
> cryptographic proof backed by the hardware that the machine you're talking to is indeed running that software Assuming both the software and hardware are secure, where hardware security includes resistance for attacks like fault i
859.
by zb3 3y ago
Enclaves and remote attestations aren't bad per-se, it's just those where the user of the device is considered an "untrusted party". It makes more sense to consider your cloud provider an untrusted party, however I'
860.
by zb3 3y ago
Note that in this case, the "untrusted" party is the cloud provider, not the user. It's meant to attest servers. Fortunately newer intel consumer-class processors don't support SGX anymore.
861.
by zb3 3y ago
It attests the server, not the client.
862.
by zb3 3y ago
Relevant in context of the new WEI API, which will sooner or later depend on hardware security. Extracting hardware attestation key is not an easy task, and users should be aware of the fact that this is not just another software-based prot
863.
What Makes a Chip Tamper-Proof (2020)(semiengineering.com)
2 points by zb3 3y ago|1 comments
864.
Comics about Life at Google(goomics.net)
2 points by zb3 3y ago|0 comments
865.
by zb3 3y ago
The latest, tone-deaf response from a Google engineer: https://github.com/RupertBenWiser/Web-Environment-Integrity/...
866.
by zb3 3y ago
In practice "trusted Android" means Android shipped with Google adware and spyware (and possibly much more vendor-specific bloatware) which you can't remove. One can clearly see that it might not really be about trust..
867.
by zb3 3y ago
Yeah, but while you could think of trusted computing like "the author of the code has control" - and I'd not see a big issue with payment apps being tamper-resistant, I do see a GIANT issue with Google instering their bloatwa
868.
by zb3 3y ago
Google is abusing trusted computing. While I can understand that some banks prefer the payment processing code to be run on devices which are locked down, currently such Android devices contain Google adware and spyware, which is definitell
869.
by zb3 3y ago
Because browser engineers need to work on more useful features such as EME or Web Environment Integrity API
870.
by zb3 3y ago
This is meant to be a Play Integrity API proxy for the web. Now, I'm not opposed to having a locked down device when performing actions like using a bank app. However, Google is abusing this, because they force their adware and spyware

More ›