Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardware Attestation as Monopoly Enabler

grapheneos.social

Post reply on HN
Print view View original

21–30 of 799 posts

Re: Hardware Attestation as Monopoly Enabler

#21

Post by rvz »

bigyabai wrote: post #14
rvz wrote: post #5

Well there you have it. > Governments are increasingly mandating using Apple's App Attest and Google's Play Integrity for not only their own services but also commercial services. The EU is leading the charge of making these requirements for digital payments, ID, age verification, etc. Many EU government apps require them. Even the "beloved" EU government is also in on it as well as banking apps are pushing for this…

> They do not care about you By "they" you mean FAANG and the FTC, right? Telling the EU to respect the Open Web does nothing to protect users if you continue to approve the export of attested hardware. America is deliberately abetting authoritarian schemes.

> By "they" you mean FAANG and the FTC, right?

You might need to the sentence again since I was quite clear who I was talking about:

"EU government"

"banking apps"

...and everyone else who benefits from pushing "digital payments, ID, age verification, etc." that will use "Apple's App Attest and Google's Play Integrity" APIs.

It isn't that hard to understand.

Re: Hardware Attestation as Monopoly Enabler

#22

Post by SilverElfin »

acgourley wrote: post #11

It's so obvious to me states need to create a soul bound identity system, replace social security numbers with it, and then let everyone else use cryptography on top of that (which is now cheap when you don't care about sybil attacks) to do private stuff.

We also need liability. Every time someone’s data is lost, the company losing it must be held accountable. They owe us huge amounts of money, and executives + board members should be jailed. No free pass.

Let’s see then if they really want to collect all our information all the time. Right now, they take it and handle it irresponsibly because they’re free from consequences.

Re: Hardware Attestation as Monopoly Enabler

#23

Post by ls612 »

lpcvoid wrote: post #4
ls612 wrote: post #3

Asymmetric cryptography and its consequences have been a disaster for the human race. I’m not even joking all of the centralization of power and the rise of totalitarianism tech is driving is downstream from asymmetric cryptography.

I disagree, I think you cast the net way too wide. Asymmetric cryptography enables secure communication in the first place. It's being used nefariously by Google and Apple, of course, but that's to be expected from big tech.

Isn’t the ability to create certificates guaranteed conceptually once you have asymmetric crypto? In that case there is no intermediate technology which allows key exchanges without also creating digital totalitarianism.

Re: Hardware Attestation as Monopoly Enabler

#24

Post by zb3 »

CharlesW wrote: post #17

The thread is a bit vague. Am I understanding correctly that GrapheneOS Foundation's objection isn't to attestation per se, but that they can't participate in Google-controlled attestation APIs? In other words, although GrapheneOS can be cryptographically attested, apps using Google Play Integrity won’t accept it because it isn't Google-certified/GMS-licensed?

It's a different thing if banking/government apps require a device certified for security, and a different thing if this certification certifies that the user's device has Google spyware preinstalled with elevated privileges..

Google doesn't certify devices basing on security, so that kind of attestation should have no place in banking/government apps, otherwise it just enforces the duopoly

Re: Hardware Attestation as Monopoly Enabler

#25

Post by amarant »

ls612 wrote: post #3

Asymmetric cryptography and its consequences have been a disaster for the human race. I’m not even joking all of the centralization of power and the rise of totalitarianism tech is driving is downstream from asymmetric cryptography.

FFS, cryptography is not the problem. How many times will we have to shut down that particular stupidity? Asymmetric cryptography is a corner stone of basically all online secure communications, and has been since before Google and apple were even founded as companies! (First invented in 1970)

When did Https ever hurt you? That's built on asymmetric cryptography. Wherever you see the word "secure" it's basically shorthand for asymmetric cryptography.

Https

Ssh

Sftp

E2ee

It's asymmetric cryptography all the way.

Re: Hardware Attestation as Monopoly Enabler

#26

Post by skybrian »

ChuckMcM wrote: post #2

This is a really good thread on why this technology is becoming a problem for "open" anything. The argument "we can create our own separate web" is fine until all of your services are behind the web that locks you into owning a Google approved or Apple approved mobile device.

Yes, it requires you to have an approved device for certain tasks.

But you can own multiple devices. You can use an approved device specifically for banking or Netflix and whatever device you like for all your other tasks. Maybe you could use an approved device (a Yubikey?) to authenticate your other devices?

Also, governments should be leaning on them to approve more devices.

Re: Hardware Attestation as Monopoly Enabler

#27

Post by ls612 »

grishka wrote: post #8
ls612 wrote: post #3

Asymmetric cryptography and its consequences have been a disaster for the human race. I’m not even joking all of the centralization of power and the rise of totalitarianism tech is driving is downstream from asymmetric cryptography.

It's not asymmetric cryptography itself. It's the fact that it takes enormous resources to manufacture modern SoCs, such that the economy only makes sense if you're churning them out by millions at least. It's also the fact that they can't be modified after they've been manufactured. It's basically those people who can manufacture chips having technological supremacy over the rest of the humanity.

It doesn’t matter if you can produce SOCs if your hardware isn’t trusted.

Re: Hardware Attestation as Monopoly Enabler

#28

Post by otterley »

samplifier wrote: post #7
ChuckMcM wrote: post #2

This is a really good thread on why this technology is becoming a problem for "open" anything. The argument "we can create our own separate web" is fine until all of your services are behind the web that locks you into owning a Google approved or Apple approved mobile device.

Are there enough of us to run our own country? It makes me feel dumb, but this is a serious question.

If you live in a democracy, you already do run your own country. Vote accordingly. Get involved in politics.

Re: Hardware Attestation as Monopoly Enabler

#29

Post by iamkrazy »

It's still not too late. With the help of Claude et. al, we can make a truly open mobile OS from ground up. We can make an app translater that can translate Android and iOS apps to our OS. We can make deals with manufacturers to start shipping phones with this OS. We have the will, there's enough of us on this site to make an impact. All ee need is good leadership. Please somebody with enough clout step up.

Re: Hardware Attestation as Monopoly Enabler

#30

Post by aaronmdjones »

CharlesW wrote: post #17

The thread is a bit vague. Am I understanding correctly that GrapheneOS Foundation's objection isn't to attestation per se, but that they can't participate in Google-controlled attestation APIs? In other words, although GrapheneOS can be cryptographically attested, apps using Google Play Integrity won’t accept it because it isn't Google-certified/GMS-licensed?

> Am I understanding correctly that [...]

What I took away from the thread is that they're against services forcing attestation in general, and also pointing out that Play Integrity isn't about security, but rather about control, because Google could trivially make it work with GrapheneOS (which is more secure than any other Android OS on the market) but they won't.

Post reply on HN