Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardware Attestation as Monopoly Enabler

grapheneos.social

Post reply on HN
Print view View original

471–480 of 799 posts

Re: Hardware Attestation as Monopoly Enabler

#471

Post by xinayder »

charcircuit wrote: post #297
xinayder wrote: post #213

Earlier quoted context omitted.

DRM is a technology and is inherently evil. Web attestation is DRM for the web, and is inherently evil. Age ID is a technology and is inherently evil. We have over 30 years of the world wide web and for these more than 3 decades this was never a problem. Suddenly, we "need" to create new technology that seem to be security features, but are essentially just being used for evil, thus being inherently bad. It's not lik…

>We have over 30 years of the world wide web and for these more than 3 decades this was never a problem. Are you seriously trying to suggest copyright infringement has not been an issue over the last 30 years? Both of them are solutions to problems that we've had over the last 30 years and were created for the greater good to solve problems that developers were facing.

Tell me when DMCA law has worked in favor of small companies/developers?

DMCA is abused every. single. time.

Re: Hardware Attestation as Monopoly Enabler

#473

Post by adev_ »

EtienneK wrote: post #468
nananana9 wrote: post #379

Earlier quoted context omitted.

Requiring "tokens" stored in "trusted modules" and 7-factor-auth for everything is not progress, it's theater. The biggest achievement of the security orthodoxy was locking me out of my email, by requiring me to read a code sent to my email to log into my email. I -- literally -- do not care about a single "account" in any "service" I use aside from my email and bank account. Most people would add a few social media…

Passkeys are better passwords. They need a TPM.

> Passkeys are better passwords. They need a TPM.

Passkeys absolutely do not need TPM.

You can get passkey support in any browser with a simple 1password plugin without any TPM hardware.

The same way you could get a TOTP app on your phone without any TPM.

TPMs are just an extra security layer for most usages.

They are mainly a necessity for some shady business like DRMs.

Re: Hardware Attestation as Monopoly Enabler

#474

Post by xinayder »

MadnessASAP wrote: post #410
userbinator wrote: post #203

Earlier quoted context omitted.

Then explain why RA was invented? It is inherently against user freedom, just like "secure" boot and the rest of the corporate-authoritarian crap. People have woken up to the truth as the pieces come together. This article from 2022 is fun to look at and see how prescient it was: https://news.ycombinator.com/item?id=29859106

I have 2 servers, Alice and Bob, Bob has a secret, I want Bob to be able to share that secret with Alice. However, I want Alice to be able to prove to Bob that it is actually Alice, that it is running the correct AliceOS, and that AliceOS was loaded on bare metal Alice without nefarious pre-book or virtualization hooks. A TPM with measured boot (SecureBoot) does exactly this, remote attestation is how Alice proves to…

And exactly how many Linux distros support Secure Boot out of the box? Just a few.

I can perhaps agree that the idea of SB can be good, but it was designed (and is used) in a bad way. Just look at how many distros do not support SB.

Re: Hardware Attestation as Monopoly Enabler

#475

Post by someguyornotidk »

pocksuppet wrote: post #455
someguyornotidk wrote: post #451

Earlier quoted context omitted.

The problem with the reasonable framing you suggest is that it gets thrown out of the window the moment someone utters Protect the Children®. I'm willing to bet that most people, including those with kids like myself, don't truly believe that surrendering our basic rights to better protect the children is a rational thing to do, but they would never dare to push their opinion publicly. The few that do get all but lab…

I don't actually believe this. People don't actually believe every car should have a GPS tracker so that if a pedophile drives a car, the police can track it. That is a ridiculous argument, and if they make it, there should be something you can say to make it blow up in their face. Unfortunately, as we've all now discovered, winning arguments isn't about being right, so I don't know which words you can say to make th…

> People don't actually believe every car should have a GPS tracker so that if a pedophile drives a car, the police can track it.

It's not about what people believe, but what they are willing to publicly push back against. If such a law was proposed today, I bet it would pass because the only discussions around it would be whether the data can be kept safe and what punishments to dole out if the car owner access this data. Arguments about privacy will be waved away or dismissed without debate.

In fact, let's make a pointless bet: I bet my imaginary internet reputation that the US or EU will pass a law within the next 10 years that requires the continuous recording and collection of data that not only includes GPS, but also face and audio data whenever a car is in motion. This law will impose severe punishments on any owner that accesses this data or deletes it.

I desperately fear for my family and want things to improve, but we are going to lose this battle.

Re: Hardware Attestation as Monopoly Enabler

#476

Post by xinayder »

brabel wrote: post #431
Hackbraten wrote: post #387

Earlier quoted context omitted.

Let them know. Write a letter to the CEO. And vote with your wallet and switch banks if you can. There's always a bank willing to offer you a non-app 2FA scheme.

Do you think banks are using attestation gratuitously? It helps prevent a lot of fraud. You are opposing something that saves people’s savings every day just because you think it takes “freedom” away from a few hobbyists. Do you even have a phone that does not support hardware attestation or is all this posturing about something hypothetical?

Can you show me examples where locking down an OS has prevented fraud in banking?

Honestly, if the only way to secure your banking system is by locking down users' devices, there is something really bad going on at your end, security-wise. Your system should be secure even without locking down user hardware.

Re: Hardware Attestation as Monopoly Enabler

#477

Post by someguyornotidk »

throwawayqqq11 wrote: post #462
pocksuppet wrote: post #455

Earlier quoted context omitted.

I don't actually believe this. People don't actually believe every car should have a GPS tracker so that if a pedophile drives a car, the police can track it. That is a ridiculous argument, and if they make it, there should be something you can say to make it blow up in their face. Unfortunately, as we've all now discovered, winning arguments isn't about being right, so I don't know which words you can say to make th…

"Criminals will adapt and avoid while the public gets transparent." Is my simple response.

Not only transparent, but exposed and vulnerable to attack. It's truly a lose-lose situation.

Re: Hardware Attestation as Monopoly Enabler

#478

Post by jstrebel »

Banking apps are the deal-breaker for me. I only do business with banks that offer alternative ways of securing transactions e.g. eTan / ChipTAN / PhotoTAN with a separate reader / generator (see https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbr...). This is probably a pretty European thing to do, but at least it avoids being locked in and being tracked.

Re: Hardware Attestation as Monopoly Enabler

#480

Post by Hackbraten »

xinayder wrote: post #476
brabel wrote: post #431

Earlier quoted context omitted.

Do you think banks are using attestation gratuitously? It helps prevent a lot of fraud. You are opposing something that saves people’s savings every day just because you think it takes “freedom” away from a few hobbyists. Do you even have a phone that does not support hardware attestation or is all this posturing about something hypothetical?

Can you show me examples where locking down an OS has prevented fraud in banking? Honestly, if the only way to secure your banking system is by locking down users' devices, there is something really bad going on at your end, security-wise. Your system should be secure even without locking down user hardware.

One of the threat models is that a fraudster tricks a non-technical user into installing malware, which then manipulates the user interface so that next time the user tries to send money to Bob, it actually goes to Mallory. That's a legitimate concern, and one of the causes why PSD2 mandates that all 2FA devices must have a display that shows the user where they're about to send the money and how much.
Post reply on HN