Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your computer should say what you tell it to say

eff.org

Post reply on HN
Print view View original

161–170 of 263 posts

Re: Your computer should say what you tell it to say

#161

Post by amadeuspagel »

freedomben wrote: post #93

I think a realistic description/story from real experience I've had as a security engineer might help some people understand why this will end up so bad. I've worked with banks, who are among the most security-minded of organizations. It's not because they're security nerds, it's because the cost of getting hacked is astronomical, and because regulations require them to be "as secure as possible." Banks won't be chom…

Right now, many banks require a mobile app, which can only be installed from an app store, which is only available on devices that you don't control. Even if they have a web interface, you need the mobile app to login.

Re: Your computer should say what you tell it to say

#162

Post by bayindirh »

politelemon wrote: post #127
bayindirh wrote: post #14

Earlier quoted context omitted.

The problem is, this is very open (or even designed) to be abused by their implementers. It's akin to having only Microsoft as the Secure Boot key authority. Mobile devices already has tons of attestation features. Secure enclaves, security processors, cryptographic capabilities of SIM cards (e.g. I carry my private key inside my SIM card, and use it as a wet signature, legally). We do not need this tech which can an…

Based on what you're saying though, it's already been forced on users through mobile devices. This is the next step in a series of steps which weren't argued against. It's not that we don't need this tech, is that we didn't need this tech and are making noise and it now.

Putting boot signing and “OS integrity control” aside, current iteration of TPM devices are not this intrusive. They allow me to generate and/or store keys and do cryptographic things with these keys securely. They store my information locally, and if implemented right, this data can’t leave that chip.

Even OS integrity check is done locally. You can’t ask arbitrary measurements out of it.

WEI is different. Rules come from outside. Acceptable parameters are decided by another party. You have no pieces of the system in your possession. You are a Furby forced to tell something with the will of the attester through the filter tuned and configured elsewhere.

I can disable TPM or force it to reset itself if I want to. Even Apple’s security processors can be wiped clean of your data.

WEI is not like that.

Re: Your computer should say what you tell it to say

#163

Post by jsty »

freedomben wrote: post #93

I think a realistic description/story from real experience I've had as a security engineer might help some people understand why this will end up so bad. I've worked with banks, who are among the most security-minded of organizations. It's not because they're security nerds, it's because the cost of getting hacked is astronomical, and because regulations require them to be "as secure as possible." Banks won't be chom…

I don't get how this would be seen within banks as any different to the existing endpoint security offerings offering remote attestation that - by the same logic - they would already be mandating customers to use to access banking platforms, because doing otherwise would mean not being "as secure as possible" and getting dinged by the regulators.

Re: Your computer should say what you tell it to say

#164

Post by xbruteforce »

> Google is adding code to Chrome that will send tamper-proof information about your operating system and other software, and share it with websites. Google says this will reduce ad fraud.

Is it only to "reduce ad fraud" though, or the wider agenda is deeper entangle their tracking in one's life.

Re: Your computer should say what you tell it to say

#165

Post by WarOnPrivacy »

wmf wrote: post #77
bayindirh wrote: post #27

Earlier quoted context omitted.

I skimmed the link you provided, thanks. It looks like they propose to mix false signals to prevent this from being abused, but oh. That's easy to bypass. Require two attestations back to back to see whether they differ, or put up a page saying, "can you please try again?" The open question is circling around the question, can we make it work in a way, such that it doesn't work for bad guys, but works for good guys.…

We can't even agree on who the good guys and bad guys are. Is a bank bad for excluding certain browsers?

> We can't even agree on who the good guys and bad guys are.

This is true. In these discussions of trust, my measurement of a bad actor is who is in a position to harm me and has a history of causing harm.

High on my list are LEO and other government interests (fed,state,local).

Re: Your computer should say what you tell it to say

#166

Post by generic92034 »

JohnFen wrote: post #147
WarOnPrivacy wrote: post #124

Earlier quoted context omitted.

> I expect banks to be about the very last significant account you use to mandate this technology Unless Google happens to make fat campaign donations or post-office job offers to elected officials who can insure WEI becomes mandated for banks. In the face of this, what banks want won't matter much.

If Google wants to force WEI to become common, all they really have to do is mandate that sites have to implement WEI in order to be listed in their index.

But that would be fuel for another antitrust case.

Re: Your computer should say what you tell it to say

#167

Post by benatkin »

wincy wrote: post #69
oaktrout wrote: post #34

Earlier quoted context omitted.

Or written with help from chat gtp, I've seen it hallucinate similar mistakes before.

Ah actually it is ChatGPT, you’ve made a common mistake. Perhaps you are an AI? As we all know, ChatGPT stands for “Chat General Purpose Tool”, as it is an artificial general intelligence.

Hmm I thought it was ChaiGPT. People were calling the API ChatGPT so they changed the name to that of a beloved beverage and JavaScript assertion library.

Re: Your computer should say what you tell it to say

#168

Post by bsilvereagle »

freedomben wrote: post #81
tailspin2019 wrote: post #8

Earlier quoted context omitted.

Agreed. I have a lot of respect for the work they do. They make some cool merch too: https://supporters.eff.org/donate/

Can anyone speak to the quality of the shirts? I bought one many years ago at a Linux conference and the design was cool but the shirt itself feels like cardboard and sandpaper, so I never wear it. If the shirts are Bella Canvas or American Life or something else high quality, I'd happily buy some. Tshirts are a great way to raise funds IMHO, and the EFF is doing extremely important work and needs to be funded.

The sizing charts give the shirt manufacturer: https://supporters.eff.org/t-shirt-size-chart#watcheru

Re: Your computer should say what you tell it to say

#170

Post by pdonis »

tapoxi wrote: post #10

I mean, devil's advocate here, this tech already exists and the question is do we do client attestation in a browser or pretend remote attestation doesn't exist. If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? I'm not trying to argue in favor of WEI, I just think this doesn't magically disappear if Google doesn't implemen…

> do we do client attestation in a browser or pretend remote attestation doesn't exist

Neither. The issue is that this is being framed as a "client attestation" problem, when the actual problem that needs to be solved (as opposed to a "problem" that certain companies would like to "solve" to benefit themselves at users' expense) is a user attestation problem.

My bank has no reason to care what client I am using to access their online services. They do have a reason to care about correctly identifying who I am. But there are already ways to do that that are just as good as anything WEI will provide.

Companies that do care what client I am using don't care for my benefit. They care for their benefit. But as long as they can't get the law to tilt the playing field in their favor, I can just refuse to use their services if they refuse to accept my client. As soon as "client attestation" becomes a legal requirement, though, then it's not just those particular companies that will use it; everybody will have to, including my bank, even though my bank has no reason to do so other than the law if such a law passes.

Post reply on HN