Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardware Attestation as Monopoly Enabler

grapheneos.social

Post reply on HN
Print view View original

511–520 of 799 posts

Re: Hardware Attestation as Monopoly Enabler

#511

Post by loup-vaillant »

jorvi wrote: post #364
userbinator wrote: post #161

In 1999, Intel received an absolutely massive amount of opposition when they decided to include a software-readable serial number in their CPUs, so much that they reversed the decision. Then the "security" and Trusted Computing authoritarians continued pushing for TPMs and related tech, and contributed to the rise of mobile walled gardens. Windows 11's TPM requirements were another step towards their goal. The amount…

Weird rant. TPMs are great. The modern computing landscape needs a safe place to put secrets. It's what made the iPhone (Secure Enclave is effectively a TPM) years ahead of Android in terms of security. The problem isn't the TPM, but attestation. As soon as the TPM is required to not be under your control to get access to Y, bad things happen. Hell, in actuality, the problem isn't even attestation, its policy. The EU…

> TPMs are great.

TPMs are a fucking mess. TPM 2 at least, I’ve worked with it for a few months. I love me some hardware security module, but I want to control it. And if it must be a standard, please please to something like the TKey, so it can be both much simpler than current ad-hoc standards and future proof.

https://loup-vaillant.fr/articles/hsm-done-right

Re: Hardware Attestation as Monopoly Enabler

#512

Post by bell-cot »

rdevilla wrote: post #498
fransje26 wrote: post #495

Earlier quoted context omitted.

> We don't need to bring in pedo references. That looks very unhinged to most people. Sorry for how you may feel about it, but that *is* how it's being framed for the public.. https://europeanconservative.com/articles/news/eu-parliament...

[flagged]

Speaking of ways to - rightly or wrongly - veer off on a tangent, and convince large numbers of people that the anti-Big Brother side is unhinged...

A better counter argument to "catch the pedo" is to bring up cases of creeps who were insiders - law officers, or just techies with access - and used the "well-intended" tech to get at their victims.

Re: Hardware Attestation as Monopoly Enabler

#513

Post by pocksuppet »

someguyornotidk wrote: post #475
pocksuppet wrote: post #455

Earlier quoted context omitted.

I don't actually believe this. People don't actually believe every car should have a GPS tracker so that if a pedophile drives a car, the police can track it. That is a ridiculous argument, and if they make it, there should be something you can say to make it blow up in their face. Unfortunately, as we've all now discovered, winning arguments isn't about being right, so I don't know which words you can say to make th…

> People don't actually believe every car should have a GPS tracker so that if a pedophile drives a car, the police can track it. It's not about what people believe, but what they are willing to publicly push back against. If such a law was proposed today, I bet it would pass because the only discussions around it would be whether the data can be kept safe and what punishments to dole out if the car owner access this…

I think most people would think, and say, that giving every car a GPS tracker so that if a pedophile drives a car, the police can track it, is a terrible idea.

Re: Hardware Attestation as Monopoly Enabler

#514

Post by eesmith »

lxgr wrote: post #193
userbinator wrote: post #165

Earlier quoted context omitted.

Hell yes. I was going to post the same comment. I don't give a flying fuck how it's implemented. Remote attestation is inherently evil. I remember the WEI apologists trying to do the same thing to derail the argument. The problem is the goal, not the details. Just say no: DO NOT WANT!

Remote attestation is a technology, not a policy or a political effort, so it can't be inherently evil. You can disagree with all its known or proposed uses, but then I think it makes more sense to name these.

Remote attestation is a policy, not a technology.

The policy is "I will not let you access this system unless your system software implements this technological protection."

A camera is technology. A security camera is policy, because it's a camera hooked up to policies on how to watch, record, and respond to what is required, and it is a political effort when connected with laws about face masks, prohibiting spray painting of the cameras, and allowing privacy intrusions.

Re: Hardware Attestation as Monopoly Enabler

#515

Post by vbezhenar »

coppsilgold wrote: post #98

Requiring authorized silicon (and software) isn't even the biggest problem here. They do not use zero knowledge proof systems or blind signatures. So every time you use your device to attest you leave behind something (the attestation packet) that can be used to link the action to your device. They put on a show about how much they care about your privacy by introducing indirection into the process (static device 'ID…

Can you revoke certificate for a specific device using privacy schemes?

Like imagine that someone managed to extract key from the specific device and distributed that key in a software implementation to fake attestation. Now Google needs to revoke that particular key to disallow its usage. This is obvious requirement.

Re: Hardware Attestation as Monopoly Enabler

#516

Post by vbezhenar »

EtienneK wrote: post #468
nananana9 wrote: post #379

Earlier quoted context omitted.

Requiring "tokens" stored in "trusted modules" and 7-factor-auth for everything is not progress, it's theater. The biggest achievement of the security orthodoxy was locking me out of my email, by requiring me to read a code sent to my email to log into my email. I -- literally -- do not care about a single "account" in any "service" I use aside from my email and bank account. Most people would add a few social media…

Passkeys are better passwords. They need a TPM.

Run vaultwarden locally. Install bitwarden. Now you have software-only implementation of passkey. Dig into vaultwarden sqlite database and you'll find passkey data there. Extract and save it on disk and you have exportable passkey. See, it's all security theater without remote attestation.

I had an idea to create blatantly insecure passkey browser extension. Maybe I should do that.

Re: Hardware Attestation as Monopoly Enabler

#517

Post by Hoodedcrow »

userbinator wrote: post #154
Hoodedcrow wrote: post #109

Earlier quoted context omitted.

I feel like the complaint about this not adding to security could be read in a really wrong way. Instead of "this is some hypocritical BS", could be interpreted as "lol let's lock EOL devices from even lower integrity tiers". Doubt this is possible because so, so many people use EOL phones, but still.

Doubt this is possible because so, so many people use EOL phones, but still. Because many people have fortunately realised that "EOL" is just an excuse to create lots of e-waste and push even more hostile unwanted changes.

Eh, not really. Using EOL devices is genuinely a bad idea, it's just that with phones you have no choice due to the updates usually being only like 2-3 years and alternative OSes not being as accessible as Linux. And most people don't even care or know anyway.

Re: Hardware Attestation as Monopoly Enabler

#518

Post by rdevilla »

bell-cot wrote: post #512
rdevilla wrote: post #498

Earlier quoted context omitted.

[flagged]

Speaking of ways to - rightly or wrongly - veer off on a tangent, and convince large numbers of people that the anti-Big Brother side is unhinged... A better counter argument to "catch the pedo" is to bring up cases of creeps who were insiders - law officers, or just techies with access - and used the "well-intended" tech to get at their victims.

> A better counter argument to "catch the pedo" is to bring up cases of creeps who were insiders - law officers

Certainly. You mean like that time an Israeli Cyber Directorate division chief fled Nevada for Israel after being investigated for soliciting a minor for sexual purposes?

https://www.haaretz.com/israel-news/2025-08-21/ty-article/.p...

https://archive.is/kNYUo

Re: Hardware Attestation as Monopoly Enabler

#519

Post by loup-vaillant »

adev_ wrote: post #473
EtienneK wrote: post #468

Earlier quoted context omitted.

Passkeys are better passwords. They need a TPM.

> Passkeys are better passwords. They need a TPM. Passkeys absolutely do not need TPM. You can get passkey support in any browser with a simple 1password plugin without any TPM hardware. The same way you could get a TOTP app on your phone without any TPM. TPMs are just an extra security layer for most usages. They are mainly a necessity for some shady business like DRMs.

> Passkeys absolutely do not need TPM.

They do not, but how does the service you’re using know your passkey is secure? For all they know you’re just some gullible user that clicks through every fishing email you get. You’re dumb, weak, helpless, they gotta protect you from this scary world out there, and maybe yourself as well.

They can’t do that if they allow your passkey to be stored anywhere you control. KeepassXC? The second you type in your master password the keylogger will snatch it, and your entire database with it!

Okay, maybe you’re some hot shot cryptographer, you’re using a TKey (think Yubikey, except you have full control), and there’s no way your secret key leaves it even if your main computer is fully compromised. Well, the service doesn’t know that. All they see is your public key and a matching signature.

So, sorry Mr. Security Researcher, we’re gonna have to be safe, and require you to use approved hardware only. Too many (wo)men children out there must be protected, we have no way to tell you’re not one of them, so it’s remote attestation or you’re out. What’ online buying worth for anyway, when you can just cross the ocean?

---

Just so we’re clear, I agree with you here. But don’t forget there are two kinds of passkeys out there: with or without the evil remote attestation. And many companies will push for the remotely attested kind, using the exact argument I used above, except with a straight face.

Or they will just present a false dichotomy: remotely attested passkeys on the one hand, short easy to guess reused everywhere passwords on the other.

Re: Hardware Attestation as Monopoly Enabler

#520

Post by [deleted] »

JumpCrisscross wrote: post #338
altairprime wrote: post #321

Earlier quoted context omitted.

It’s not a proper noun, and this is HN: pedantry is par. “The president of Xyz” capitalizes the X in Xyz(pn) but not the P in president(n). However, the P in President(pn) is capitalized when it’s a Title suffixed to a Name - but that varies per country by what they title their president-equivalent locally and isn’t always translated, while the concept-slash-role label of ‘president’ in English generally does not (an…

> It’s not a proper noun The President, within this context, identifies a single entity. As such, it is a proper noun. Analogy: there are many continents. But if we're discussing Brexit, the Continent is a proper noun. I don't think it's in correct to not capitalise. But it's certainly gramatically okay, and not in the same bucket as The Nutters who capitalise Random words it Looks like Legalese.

[deleted]
Post reply on HN