Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardware Attestation as Monopoly Enabler

grapheneos.social

Post reply on HN
Print view View original

101–110 of 799 posts

Re: Hardware Attestation as Monopoly Enabler

#101

Post by userbinator »

grishka wrote: post #6

Our civilization desperately needs a method to modify modern microelectronics after manufacturing that can be used at least in a well-equipped repair shop, and it needs it yesterday. Alternatively, just make it illegal to ship any kind of initial bootloader as part of a CPU's/SoC's mask ROM in any computing device that is marketed as a general-purpose one. I.e. the first instruction that the CPU executes after reset…

Alternatively, just make it illegal to ship any kind of initial bootloader as part of a CPU's/SoC's mask ROM in any computing device that is marketed as a general-purpose one.

No, you just need to make it illegal to have the bootloader contain hardcoded key material and use it for verifying the code it loads.

Re: Hardware Attestation as Monopoly Enabler

#102

Post by noir_lord »

pjmlp wrote: post #81
miohtama wrote: post #56

The EU Digital (identity) Wallet EUDI requires hardware attestation by Google or Apple, effectively tying all the digital EU identities to American duopoly. Talk about digital sovereignity. Apparently protecting the children > sovereignity. https://gitlab.opencode.de/bmi/eudi-wallet/wallet-developmen...

I wrote to the EU contact about this, got a patronising reply about how good it is, app being open source and what not. Clearly tailored to the regular normie without technical skills.

Probably because the reply was written by someone without technical skills.

I’ve written to politicians over the years about technical matters and it’s uniformly either a clearly form response or an inaccurate summation of the technical risks, if I’m been charitable because they don’t understand them either.

At a certain point it begins to feel pointless.

Re: Hardware Attestation as Monopoly Enabler

#103

Post by thecatapps »

With all of the discourse around hardware attestation, digital ID, and age verification in recent weeks/months, is there actually any good solution to the problems these existing tools (Privacy Pass, WEI, Fraud Defense, uploading IDs) claim to solve? Are there open and privacy-preserving standards that can solve the problem of bots and minors? If not, what would be required to establish one, and is it realistic?

Businesses will do what businesses will do, but it seems to me having something to point to and saying "do this instead" is more effective than "this sucks and isn't even about security, don't do this at all" even though it's true.

Re: Hardware Attestation as Monopoly Enabler

#104

Post by Hoodedcrow »

coppsilgold wrote: post #98

Requiring authorized silicon (and software) isn't even the biggest problem here. They do not use zero knowledge proof systems or blind signatures. So every time you use your device to attest you leave behind something (the attestation packet) that can be used to link the action to your device. They put on a show about how much they care about your privacy by introducing indirection into the process (static device 'ID…

Would like to read a writeup on this, I was certain it was going to be something like this from the app's announcement.

Also I recall a discussion on Graphene's forums that DRM ID is not only retained there, but stays the same across profiles.

Re: Hardware Attestation as Monopoly Enabler

#105

Post by acgourley »

elric wrote: post #92
realusername wrote: post #16

Earlier quoted context omitted.

The places you actually need an ID are so rare, I don't think it's worth it to build such a system (and no, porn or social network definitely aren't valid use cases). It's a problem in search of a solution.

> It's a problem in search of a solution. The cynic in me suspects it's a way of slowly but methodically eradicating online anonymity and thus anonymity in general.

I think it would make the web MORE anonymous, not less!

The reason it's hard to boot up a secure social network (such as Signal) is the handshake for (re)identifying people. Signal makes a ton of conceits here (the UX essentially asks people to assume phone numbers are securely held) in the name of low friction and it's why they grew so fast. The "real" secure social networks are essentially too difficult to get real adoption because they don't make these conceits around phone numbers, and demand real key exchanges.

But if you had a L1 set of private and public keys the government works to maintain and defend, the L2 social networks like Signal (or banks, or markets, whatever) can do this cheap and easily.

Re: Hardware Attestation as Monopoly Enabler

#106

Post by whatsupdog »

applfanboysbgon wrote: post #36
iamkrazy wrote: post #29

It's still not too late. With the help of Claude et. al, we can make a truly open mobile OS from ground up. We can make an app translater that can translate Android and iOS apps to our OS. We can make deals with manufacturers to start shipping phones with this OS. We have the will, there's enough of us on this site to make an impact. All ee need is good leadership. Please somebody with enough clout step up.

The OP is from an already-existing open mobile OS, which already has a deal with a manufacturer. The problem isn't, and has never been, making an OS. This is not a technical problem. This is a political problem.

But that open mobile OS is still a fork of Android, which is too hell bent on privacy (which is not a bad cause, but something that masses don't care about). We should focus on an OS which is hell bent on UX, UI and other features that masses crave.

Re: Hardware Attestation as Monopoly Enabler

#107

Post by varispeed »

kyleee wrote: post #93
varispeed wrote: post #73

Earlier quoted context omitted.

Corruption. A taboo topic people prefer to downvote and pretend it does not exist. But even bigger problem is that institutions designed to prevent this from happening are not doing their job. Thousands security service and civil servants take their wages and look the other way.

No doubt there is corruption; but it’s also momentum. There aren’t stable and good alternatives for so many reasons so the duopoly has momentum

I understand, but this is a national security matter. The focus should be on developing matching domestic capability.

Re: Hardware Attestation as Monopoly Enabler

#108

Post by minraws »

I mean sure Google & Apple are evil, but don't we all need some evil in our lives, EU citizens doesn't matter we love the evil and honestly we enjoy it.

What can't we do for these two companies we will beg, we will bend, we might even consider grovelling as long as the evil is around, to help us find the greater evils in the world. That is, the people we don't like, might be the bad guys today, but just don't worry you will be the bad guy too, just wait until the bad guys get into power...

I haven't read the hobbit or lord of the rings but man if this isn't greed corrupting all men then I don't know what is.

I feel sick of all this, I might really just move out and live the rest of my life out on the farm somewhere.

Re: Hardware Attestation as Monopoly Enabler

#109

Post by Hoodedcrow »

Someone wrote: post #34
ChuckMcM wrote: post #2

This is a really good thread on why this technology is becoming a problem for "open" anything. The argument "we can create our own separate web" is fine until all of your services are behind the web that locks you into owning a Google approved or Apple approved mobile device.

IMO, it would be better if they removed the claim “It doesn't provide a useful security feature” because, even if it does, the collateral damage of making non-Google, non-Apple OSes second class citizens remains, and that is the main problem.

I feel like the complaint about this not adding to security could be read in a really wrong way. Instead of "this is some hypocritical BS", could be interpreted as "lol let's lock EOL devices from even lower integrity tiers". Doubt this is possible because so, so many people use EOL phones, but still.

Re: Hardware Attestation as Monopoly Enabler

#110

Post by Hoodedcrow »

microtonal wrote: post #48
CharlesW wrote: post #17

The thread is a bit vague. Am I understanding correctly that GrapheneOS Foundation's objection isn't to attestation per se, but that they can't participate in Google-controlled attestation APIs? In other words, although GrapheneOS can be cryptographically attested, apps using Google Play Integrity won’t accept it because it isn't Google-certified/GMS-licensed?

My impression is that they are against remote attestation in apps/websites in general and if apps really want to do it, they should do it using the attestation API that AOSP already provides. The attestation API in AOSP allows companies to trust signing key fingerprints (such as those of GrapheneOS), which means that the attestation system is not controlled by a single company (Google). The most damning part about Go…

> The attestation API in AOSP allows companies to trust signing key fingerprints (such as those of GrapheneOS), which means that the attestation system is not controlled by a single company (Google).

I wonder if this would exclude rooted OSes, non-relocked bootloaders and things like that? Sorry for stupid question, still not quite understanding how this works.

Post reply on HN