61–70 of 71 posts
A few years ago I would read this headline with hope and excitement about technological innovation. Right now, I am apprehensive about anything Google related. Even about anything big tech related. How is this going to be used to limit our rights and track all our movements?
Earlier quoted context omitted.
No I just won't use your crap. The value proposition is already marginal almost all the time, this tips over to "absolutely not, fuck off" territory. >If you want to write your friends a message Then I will use email as I do today. It works, it's universal, and it's free of this kind of bullshit (which is why they push everyone to use other things.) I even went on a date last weekend I set up over email (and it's far…
I am with you all the way. But the amount of people that only use whatsapp for example in my daily life is staggering. I don't think the good guys are gonna win this one in the end.
It is hard not to take a cynical view, that such dissenters will be pursued aggressively by a system that demands conformity. I do recognize the quasi-fascist leanings in modern consumer IT products and their backers.
But, even if tolerated by this larger IT-bound society, can this sort of IT abstention be carried on long enough and made feasible for different age groups and personality types? Can it be the basis for a sustainable, multi-generation subculture? Or is it more ephemeral, a phase someone might go through, like retirement to a quiet cottage...
[flagged]
If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
You're of course welcome to make your substantive points more thoughtfully.
Earlier quoted context omitted.
I am with you all the way. But the amount of people that only use whatsapp for example in my daily life is staggering. I don't think the good guys are gonna win this one in the end.
Sometimes I try to imagine a future societal split akin to the Amish. Not as a religious group, but as a social movement eschewing these overbearing IT products and services. A rejection of this "attention" or "dopamine" exploitation market. It is hard not to take a cynical view, that such dissenters will be pursued aggressively by a system that demands conformity. I do recognize the quasi-fascist leanings in modern…
Perhaps you could come up with some sort of argument for it from Christianity and start a Christian sect/denomination from it.
[flagged]
Could you please stop posting flamebait and snark? Your account has unfortunately been doing this repeatedly. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful. You're of course welcome to make your substantive points more thoughtfully.
I truly believe that we'll see a world where everything requires remote attestation and corporate approved devices within the next few years. It's a nightmare scenario for me and I consider it inevitable. I just don't have much more than sad cynicism left since it seems to become worse every day.
Earlier quoted context omitted.
Could you please stop posting flamebait and snark? Your account has unfortunately been doing this repeatedly. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful. You're of course welcome to make your substantive points more thoughtfully.
You know what dang, I'll genuinely consider it. I truly believe that we'll see a world where everything requires remote attestation and corporate approved devices within the next few years. It's a nightmare scenario for me and I consider it inevitable. I just don't have much more than sad cynicism left since it seems to become worse every day.
I hear you about this issue (corporate control over devices, let's call it) and of course a large segment of the community agrees with you. Howwever, the moderation point here isn't about that; it's about a style of commenting that we're trying to avoid here. Your account has been posting in that style on unrelated issues too, so I think this is independent of the specific content.
Earlier quoted context omitted.
You can run a software TPM if you browse within a VM.
~~~~But your VM TPM won't be signed during manufacturing by a trusted root. No attestation.~~~~ OK I take it back, privacy is one of their specified goals: > Note that the certificate chain for the TPM is never sent to the server. This would allow very precise device fingerprinting, contrary to our privacy goals. Servers will only be able to confirm that the browser still has access to the corresponding private key.…
That is effectively what Token Binding does. That was unfortunately difficult to deploy because the auth stack can be far removed from TLS termination, providing consistency on the client side to avoid frequent sign outs was very difficult, and (benign) client side TLS proxies are a fairly common thing.
Some more on this in the explainer: https://github.com/w3c/webappsec-dbsc#what-makes-device-boun...
The article claims this is based on Token Binding, but skimming the W3 spec it seems to be something entirely different and not at all to be based on or related to TLS Token Binding (with an integration already envisaged by the WebAuthN spec). TB doesn't need or rely on a TPM at all, it conceptually just ties bearer tokens to a key which is (re-)used across TLS sessions; for upper layers this is transparent, but for…
However, DBSC as an API and protocol is similarly agnostic about key storage. There is no attestation and the User Agent is fully responsible for selecting key storage that provides the best protection.
Earlier quoted context omitted.
This inexplicable overreaction to genuinely valuable security improvements is getting ridiculous. Computer security is a complete dumpster fire right now and we need things like this.
> valuable security improvements Valuable to who, exactly?
I hope it catches on! Though they suggest storing the signing keys in TPM which is ideal, even storing them locally in the browser in an unextractable manner would be enough to prevent session hijacking.
"unextractable" from the perspective of the JS-facing APIs does not necessarily mean unextractable by local malware (unless it's backed by something like a TPM!)