Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardware Attestation as Monopoly Enabler

grapheneos.social

Post reply on HN
Print view View original

441–450 of 799 posts

Re: Hardware Attestation as Monopoly Enabler

#441

Post by notpushkin »

przmk wrote: post #440
charcircuit wrote: post #436

Earlier quoted context omitted.

>How about being banned from online banking, government services and all social networking / communication platforms? You aren't banned. You just have to use a secure device. It's like saying that a store banned you because they stopped taking checks and started requiring a credit card since they are more secure and harder to commit fraud with. As a person you didn't lose any freedom. Freedom does not mean someone ha…

It's not about being secure. Google allows devices with up to 10 years without any patches to pass their integrity API. Meanwhile Graphene OS, which is very secure and up-to-date, doesn't pass.

This. Plus if I want to access my bank account on a device I trust, the bank shouldn’t say “hey we don’t trust it so buzz off”. It’s my money in that account.

I understand there’s some stupid compliance thing that makes banks do this, but it clearly isn’t a hard requirement, as there’s still plenty of banks that don’t participate in this security theatre.

Re: Hardware Attestation as Monopoly Enabler

#442

Post by dmantis »

charcircuit wrote: post #436
franga2000 wrote: post #420

Earlier quoted context omitted.

How about being banned from online banking, government services and all social networking / communication platforms? Because that's the road we're already heading down. What makes you think they will give us this magical hypervisor capability? It's more effort, increases the chances someone finds a bypass and takes power away from the incumbent online platforms. It's so much easier to just prevent it all. The only re…

>How about being banned from online banking, government services and all social networking / communication platforms? You aren't banned. You just have to use a secure device. It's like saying that a store banned you because they stopped taking checks and started requiring a credit card since they are more secure and harder to commit fraud with. As a person you didn't lose any freedom. Freedom does not mean someone ha…

> You just have to use a secure device.

No, you have to use government backdoored device. I.e. the most secure android rom (at least the only rom we know is not penetrable by state-sponsored celebrite based malware) is not covered by google's play protect, while bunch of outdated CVEd phones are.

Same will go with many hardened Linux machines, QubesOS, Whonix stations, you name it. I'd argue they are far more secure than any average windows/macos installation.

Hardware attestation has nothing to do with security, it's censorship.

Re: Hardware Attestation as Monopoly Enabler

#443

Post by charcircuit »

matheusmoreira wrote: post #412
charcircuit wrote: post #407

Earlier quoted context omitted.

Do you consider being banned in a video game because of hacking to be an example of something killing computing freedom? The user still maintains all the freedom of doing whatever computing they want on their own machine, but if they want to play with others who don't want to play with cheaters then they have to use the official client. For people who want a high degree of freedom and be able to access as many digita…

> Do you consider being banned in a video game because of hacking to be an example of something killing computing freedom? No. It's the constant attempts to invade our computers and "prevent" the unwanted behavior that are problematic. See kernel level anticheat nonsense. They want to own our computers. > if they want to play with others who don't want to play with cheaters then they have to use the official client T…

>See kernel level anticheat nonsense.

This nonsense mainly exists only because the operating system is unable to attest that it the app is secure and the right app is what is running.

>It's their computer, it should run whatever software they want.

I agree, but companies shouldn't be forced to match cheaters with legitimate players. Cheaters just can't secretly be cheating.

Re: Hardware Attestation as Monopoly Enabler

#444

Post by labcomputer »

AnthonyMouse wrote: post #222
Someone wrote: post #34

Earlier quoted context omitted.

IMO, it would be better if they removed the claim “It doesn't provide a useful security feature” because, even if it does, the collateral damage of making non-Google, non-Apple OSes second class citizens remains, and that is the main problem.

> it would be better if they removed the claim “It doesn't provide a useful security feature” because, even if it does, What evidence is there that it does? Attestation purports to prove the code is running on an "approved" device. There are multiple reasons that has no real security value. The first is that "approved" not only has no relationship to "secure", they're actually anti-correlated . As the article points…

> Attestation purports to prove the code is running on an "approved" device. There are multiple reasons that has no real security value.

BART (San Francisco Bay Area Rapid Transit), as a real world example, recently installed "evasion-proof" fare gates, and observed a 90% drop in vandalism-related maintenance expense. An overwhelming majority of fare evaders are not vandals, but apparently nearly all vandals were fare evaders. Bayes' theorem in action.

I don't have any data to back this up, but my sense is that attestation is an analogous situation.

In other words, banks and governments and other such institutions have noticed (and they probably do have data to back this up) that very few of their customers use "unapproved" devices and a very large majority of fraud comes from "unapproved" devices. They view banning unapproved devices as a high-ROI means to reduce fraud.

So, any argument predicated on "attestation is not security" is doomed to fail, just like saying "most fare-evaders aren't vandals". Yes, most people running GrapheneOS aren't trying to commit bank fraud, but the banks don't care about that if nearly 100% of fraudsters are using unapproved devices.

Re: Hardware Attestation as Monopoly Enabler

#445

Post by charcircuit »

greybcg wrote: post #417
charcircuit wrote: post #407

Earlier quoted context omitted.

Do you consider being banned in a video game because of hacking to be an example of something killing computing freedom? The user still maintains all the freedom of doing whatever computing they want on their own machine, but if they want to play with others who don't want to play with cheaters then they have to use the official client. For people who want a high degree of freedom and be able to access as many digita…

We had fun in online games without kernel level nonsense. Why do I need to compromise my hardware when the problem is an outlier in the social graph? Anticheat is part an arms race and part just raising the bar so people cant cheat too easily. That said you can feed a video feed into a Kria K26 or even a pi or jetson and make automatic targeting completely transparant to the kernel. Then what? Hardware attestation in…

>We had fun in online games without kernel level nonsense.

You might of. But there was a percentage of players turned away by cheaters or even just had a bad experience one day because of one. At scale this can cause a bad experience for a ton of players so trying to stop as many cheaters as possible does matter.

>Why do I need to compromise my hardware

You don't have to compromise anything. In fact it is optimal to have the system be as secure as possible that way cheats can't mess with the game.

>How do old boomershooter communities tackle cheaters?

By limiting the rate of new players. This goes against the wishes of games who want to achieve massive growth.

>When and why do methods that work on a social graph fail or necessitate anticheat?

If people provided IDs that could work too instead of anticheat, but usually people do not want to do that just to play a game. It adds friction to the onboarding process.

Re: Hardware Attestation as Monopoly Enabler

#447

Post by Loic »

matheusmoreira wrote: post #386

I always say this when this topic comes up: remote attestation will be how our computing freedom dies. They've made it so that it doesn't even matter if they allow you to install whatever you want. Anything that isn't corporate owned is banned. Own your device? You "tampered" with it. You're banned. From everything. You're ostracized from digital society. You're not even a citizen, much less a second class citizen. E…

For once, we may be "saved" thanks to Trump. Because of the brutal change in geopolitics he triggered, the EU is now actively looking at all the hard dependencies on US controlled systems. Android and iOS are two of them.

I cannot tell if the alternative solution will be better, but I do think we will develop alternatives.

Re: Hardware Attestation as Monopoly Enabler

#448

Post by userbinator »

MadnessASAP wrote: post #410
userbinator wrote: post #203

Earlier quoted context omitted.

Then explain why RA was invented? It is inherently against user freedom, just like "secure" boot and the rest of the corporate-authoritarian crap. People have woken up to the truth as the pieces come together. This article from 2022 is fun to look at and see how prescient it was: https://news.ycombinator.com/item?id=29859106

I have 2 servers, Alice and Bob, Bob has a secret, I want Bob to be able to share that secret with Alice. However, I want Alice to be able to prove to Bob that it is actually Alice, that it is running the correct AliceOS, and that AliceOS was loaded on bare metal Alice without nefarious pre-book or virtualization hooks. A TPM with measured boot (SecureBoot) does exactly this, remote attestation is how Alice proves to…

That's the academic viewpoint, but in practice it's used for far more hostile purposes.

(One argues that since you own both of them, you should simply set up the two servers yourself with a key of your own choosing, asymmetric or otherwise, and then restrict physical access to them.)

Re: Hardware Attestation as Monopoly Enabler

#449

Post by bartekpacia »

matheusmoreira wrote: post #386

I always say this when this topic comes up: remote attestation will be how our computing freedom dies. They've made it so that it doesn't even matter if they allow you to install whatever you want. Anything that isn't corporate owned is banned. Own your device? You "tampered" with it. You're banned. From everything. You're ostracized from digital society. You're not even a citizen, much less a second class citizen. E…

all "hackers" be vibe coding b2b saas these days

the meaning of this word has diluted so much

Re: Hardware Attestation as Monopoly Enabler

#450

Post by Hackbraten »

brabel wrote: post #431
Hackbraten wrote: post #387

Earlier quoted context omitted.

Let them know. Write a letter to the CEO. And vote with your wallet and switch banks if you can. There's always a bank willing to offer you a non-app 2FA scheme.

Do you think banks are using attestation gratuitously? It helps prevent a lot of fraud. You are opposing something that saves people’s savings every day just because you think it takes “freedom” away from a few hobbyists. Do you even have a phone that does not support hardware attestation or is all this posturing about something hypothetical?

> Do you think banks are using attestation gratuitously?

What I'm claiming is that banks have the freedom of offering their customers 2FA other than smartphone apps.

> Do you even have a phone that does not support hardware attestation or is all this posturing about something hypothetical?

All the phones I own, including my daily driver, run some flavor of Debian. None of them support hardware attestation.

I'm in Europe, bound by PSD2, and own a couple of cheap, certified chip-and-TAN devices so I can do banking.

Post reply on HN