Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardware Attestation as Monopoly Enabler

grapheneos.social

Post reply on HN
Print view View original

141–150 of 799 posts

Re: Hardware Attestation as Monopoly Enabler

#141

Post by graemep »

onlytue wrote: post #71
retired wrote: post #66

Earlier quoted context omitted.

So with a single flip of the switch, the president of the USA can shut down our EU Digital Identity Wallet. Why was this decision ever made?

I hate to beat a dead horse and have people downvote me but: the EU has always been corrupted. The knowledge and effects are not evenly distributed until it hits each niche group. Then they find out the hard way that they were useful idiots. It’s ok to be wrong/admit. Let’s just move past the infighting and see those in power for the evil that they are.

Governments are place a higher priority on controlling internal threats than external ones. In this case the EU wants to control its own people more than it wants to avoid deoendence on the US. It would like both,but the former is more important

Re: Hardware Attestation as Monopoly Enabler

#142

Post by pjmlp »

palata wrote: post #134
pjmlp wrote: post #81

Earlier quoted context omitted.

I wrote to the EU contact about this, got a patronising reply about how good it is, app being open source and what not. Clearly tailored to the regular normie without technical skills.

Where did you write? Is there a link or something you could share? I am not in the EU so I assume I can't, but would be nice to share a link so that other EU citizen could write. If enough people write, they may start finding it relevant.

https://european-union.europa.eu/contact-eu/write-us_en

Re: Hardware Attestation as Monopoly Enabler

#143

Post by surajrmal »

zb3 wrote: post #24
CharlesW wrote: post #17

The thread is a bit vague. Am I understanding correctly that GrapheneOS Foundation's objection isn't to attestation per se, but that they can't participate in Google-controlled attestation APIs? In other words, although GrapheneOS can be cryptographically attested, apps using Google Play Integrity won’t accept it because it isn't Google-certified/GMS-licensed?

It's a different thing if banking/government apps require a device certified for security, and a different thing if this certification certifies that the user's device has Google spyware preinstalled with elevated privileges.. Google doesn't certify devices basing on security, so that kind of attestation should have no place in banking/government apps, otherwise it just enforces the duopoly

It's hard to listen to arguments when everything is so hyperbolic. The stated rationale for attestation for captcha is to ensure there is a human on the other end and not a bot. This requires a system which is not capable of automated input. The other use case is for ensuring that an application is running on a system which protects the app from being tampered with (by the user, malware, or otherwise). While that seems to run counter to the preferences of the hn userbase, it is a legitimate desire from an application developer.

Neither of these situations are related to any so-called spyware. The fact that Google is involved here had to do with the fact that they are a trusted party for folks to rely on to ensure the desired properties are being met, nothing more. In theory it should be possible for other parties to provide similar attestation, but that party needs to be deeply involved in the OS and boot chain. Apple is obviously capable and is equally trusted. Graphene probably provides the necessary properties but lacks a good way to attest due to the reliance on Google specific attestation APIs. That could be remedied. Otherwise Graphene would need to create their own APIs and applications would need to use them, which would be a harder sell. In both cases the party asking for the attestation needs to decide to trust Graphene, which is still a barrier, but that's an easier way forward. Alternatively, Google could trust Graphene and everyone who already trusts Google would inherit such trust.

Re: Hardware Attestation as Monopoly Enabler

#144

Post by cherryteastain »

dmoy wrote: post #121
bojan wrote: post #119

Earlier quoted context omitted.

We have voted in the most right-wing Parliament and, by extension, Commission, in the EU's history. It only makes sense they'll prioritize big-business interests over those of the common folk.

Yea that's fair / makes sense from a democracy point of view (even if I might disagree personally). It's a bit odd that Europe prioritizes American big-business interests I guess? Idk, as an American it does seem kinda like an odd choice.

It's more useful to view the whole situation as EU politicians prioritizing to have their pockets filled with lobbyist money, rather than the EU as a political entity deciding this per se.

Re: Hardware Attestation as Monopoly Enabler

#145

Post by vanviegen »

andy99 wrote: post #87
miohtama wrote: post #56

The EU Digital (identity) Wallet EUDI requires hardware attestation by Google or Apple, effectively tying all the digital EU identities to American duopoly. Talk about digital sovereignity. Apparently protecting the children > sovereignity. https://gitlab.opencode.de/bmi/eudi-wallet/wallet-developmen...

Came here with roughly the same thought. Given the stated importance to many of sovereignty and not being dependent on the US, why isn’t there more opposition? I assume it’s just ignorance?

Digital sovereignty has only become a serious political topic in the EU over the past year. It may take a decade to see the effects of this in laws and policies.

Re: Hardware Attestation as Monopoly Enabler

#146

Post by mwwaters »

voakbasda wrote: post #20
samplifier wrote: post #7

Earlier quoted context omitted.

Are there enough of us to run our own country? It makes me feel dumb, but this is a serious question.

Where would you do that? Realistically, the question is one that cannot even be asked safely: are there enough of us to overthrow the existing systems and replace them with something better? The answer to either question, really, is no. The powers that be have systematically implemented policies that keep us divided to prevent that eventual outcome.

The “enough of us” is at least a majority of voters agreeing. I’m not sure what the alternative to that is.

Re: Hardware Attestation as Monopoly Enabler

#148

Post by bobmarleybiceps »

it's so great to see people boosting "security" in a way that also just happens to require locking in to big-tech approved apps that send all your data to big-tech so that they can deliver ads to you via your big-tech approved device using your big-tech approved os running your big tech approved browser showing your big-tech approved video platform with your big-tech approved content (oh, and also sends your data to your big-tech approved government)

Re: Hardware Attestation as Monopoly Enabler

#149

Post by miohtama »

palata wrote: post #131
rvz wrote: post #76

Earlier quoted context omitted.

Exactly. I have said this for a very long time and the EU (and many other governments) are not our friends and they are just as corrupt. Remember ChatControl? Anytime anyone criticises the EU here, you will get downvoted even after trying to warn the EU defenders that they are not our friends at all. I was asking for evidence about the EU digital ID wallets about what the "disinformation" was around it 3 years ago [0…

> Remember ChatControl? That thing that got refused multiple times already? Because not all politicians think like you does not mean they are corrupt. Seems like enough politicians have voted against ChatControl until now. I always wonder what people who say stuff like "politicians discussed this topic I hate and refused it, but the mere fact that they discussed means that they must all be corrupt" understand about p…

The Commission got it through on the last round, though, so eventually it passed.

Re: Hardware Attestation as Monopoly Enabler

#150

Post by dvdkon »

samplifier wrote: post #7
ChuckMcM wrote: post #2

This is a really good thread on why this technology is becoming a problem for "open" anything. The argument "we can create our own separate web" is fine until all of your services are behind the web that locks you into owning a Google approved or Apple approved mobile device.

Are there enough of us to run our own country? It makes me feel dumb, but this is a serious question.

I'm convinced that in the billions of people living on Earth, there are a couple million that could agree on things that currently divide countries, like this. Sadly they're unlikely to ever be able to gather together in a single state.

The status quo is nation-states in roughly their post-WW2 borders, and it's fiercely protected. The upside is stability and fewer wars, the downside is that the only way to try anything new is to co-opt an existing country. Adding to that, most countries are ethnostates that would prefer to have only a small percentage of their population be migrants. It's an easy way toward social cohesion, you just stay roughly where you're born, with people who were also born there and share the same cultural background. As we can see, it's not ideal - two lifelong neighbours can easily hold completely opposite moral values.

Post reply on HN