Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lennart Poettering, Christian Brauner founded a new company

amutable.com

Post reply on HN
Print view View original

751–760 of 770 posts

Re: Lennart Poettering, Christian Brauner founded a new company

#751

Post by egorfine »

microtonal wrote: post #739
bri3d wrote: post #738

Earlier quoted context omitted.

> it will be used for movies, government services, banks I really, really don't think these entities care enough about desktop Linux. I'd be way more worried about some kind of Windows web-based attestation appearing. If that happens I really do think there's a bit of an alarm to sound, because this will make using desktop Linux inconvenient in the way attestation has made using alternate Android ROMs inconvenient. >…

Android strict attestation is popular because fraudulent cloned banking apps are a rampant problem for banks, not because they're trying to "stick it" to 200 GrapheneOS users. Where I live in Europe, Fairphones are becoming fairly popular (as in, I encounter non-tech people using Fairphones). A subset of those users run /e/OS (anti-Google/big tech sentiment is growing pretty strong). This is increasingly becoming a r…

No worries here as EU is slowly pushing to ban OS-unlocked phones under the guise of "think of the children^Wradio spectrum".

Re: Lennart Poettering, Christian Brauner founded a new company

#752

Post by mariusor »

mzajc wrote: post #746
mariusor wrote: post #567

Earlier quoted context omitted.

Why not? Being terse does not make one right...

Off the top of my head, because - You're just moving your trust elsewhere, this time to a private corporation (whoever makes the CPU / TPM / other "trusted" component). - This doesn't guarantee voter anonymity the way paper ballots do. Considering the analog hole and the complexity of computers, I can think of a billion ways a motivated and resourceful Mallory could to connect someone to their ballot.

> This doesn't guarantee voter anonymity the way paper ballots do.

You're saying that with a lot of assurance, but in my opinion that's still to be debated. We can build something that will keep at least a degree of separation between the identity that points to a specific individual and the identity that casts the ballot.

Re: Lennart Poettering, Christian Brauner founded a new company

#753

Post by calgoo »

thewebguyd wrote: post #604
fc417fc802 wrote: post #591

Earlier quoted context omitted.

Why should I need a separate device? Doesn't a hardware security token suffice? I wouldn't even mind bringing my own but my bank doesn't accept them last I checked. (Do any of them?) If the bank can't be bothered to either implement support for U2F or else clearly articulate why U2F isn't sufficient then they don't have a valid position. Anything else they say on the matter should be disregarded.

You shouldn't need a separate device, but we are quickly entering an era where a lot of banking (and other) apps will outright refuse to run or allow logins if it detects a rooted device, or play integrity fails. In this way, the banks are asserting control over your device. It's beyond authentication, they are saying "If you have full control over your device, you cannot access our services." I'll agree with you tha…

I have to use my phone to approve the web login to my account. My bank is working very hard to make sure that everyone uses the app for everything, including closing down offices and removing ATMs around the city.

Re: Lennart Poettering, Christian Brauner founded a new company

#754

Post by jofla_net »

UltraSane wrote: post #724
jofla_net wrote: post #641

Earlier quoted context omitted.

All this theatre is turning out to be nothing more than giving up the agency we have today (nice things), for a risk averse kneejerk runaround with glaring ulterior motives...just like the scan your face+id push for services.

Would YOU be willing to use a bank that refused to use TLS? I didn't think so. How is you refusing to accept remote attestation and the bank refusing to connect to you any different?

Because Banking has existed and operated fine for countless decades without it(attestation).

Also, as there is ample discussion elsewhere, having attestation does NOT eliminate the ability for your account to become compromised.

As restated.

"If the user's device isn't compromised then everything is fine regardless of whether or not it can pass attestation. If the user's device is compromised, the device doesn't need to pass attestation to run a fake bank app and steal the user's credentials. Once the attacker has the user's credentials they can use them to transfer money regardless of whether or not they have to use a different device that can pass attestation.

It doesn't really provide any security."

IT DOES however completely rewrite the paradigm of general purpose computing in very asymmetrical ways.

Re: Lennart Poettering, Christian Brauner founded a new company

#755

Post by AnthonyMouse »

mariusor wrote: post #669
AnthonyMouse wrote: post #609

Earlier quoted context omitted.

If the user's device isn't compromised then everything is fine regardless of whether or not it can pass attestation. If the user's device is compromised, the device doesn't need to pass attestation to run a fake bank app and steal the user's credentials. Once the attacker has the user's credentials they can use them to transfer money regardless of whether or not they have to use a different device that can pass attes…

So do we just give up because it's too hard?

It's not a matter of being hard. It's like trying to prevent theft by forcing everyone to wear a specific brand of shoes. The fact that the shoe company insists that it's useful is not evidence that it is.

It's not that you can't solve the problem, it's that you can't solve the problem using that mechanism. Attestation is useless for this.

The thing that would actually work for this is to have an open standard supported by PCs and phones to read the chip in payment/ATM cards, because then you could do "card-present" transactions remotely. You touch your card to the phone/PC and enter your PIN to authorize a new merchant. That actually solves the problem because then instead of the bank trusting every commercially available phone on the market, they only trust the specific card that they mailed to the cardholder, and you can only authorize a new merchant with physical possession of the card because it contains a private key. But that doesn't require attestation because then you don't need the keys to be in the phone since they're in the card, and it doesn't require a third party to sign anything because the bank puts the private key into the card before sending it to the cardholder without any need for Google or Apple to certify anything.

Re: Lennart Poettering, Christian Brauner founded a new company

#757

Post by mariusor »

meshugga wrote: post #756
mariusor wrote: post #583

Earlier quoted context omitted.

Right... we should not even try because memes...

those who don't understand the memes are doomed to be them

I'd prefer to be the butt of someone's memes rather than not try at all.

Re: Lennart Poettering, Christian Brauner founded a new company

#758

Post by UltraSane »

jofla_net wrote: post #754
UltraSane wrote: post #724

Earlier quoted context omitted.

Would YOU be willing to use a bank that refused to use TLS? I didn't think so. How is you refusing to accept remote attestation and the bank refusing to connect to you any different?

Because Banking has existed and operated fine for countless decades without it(attestation). Also, as there is ample discussion elsewhere, having attestation does NOT eliminate the ability for your account to become compromised. As restated. "If the user's device isn't compromised then everything is fine regardless of whether or not it can pass attestation. If the user's device is compromised, the device doesn't need…

Stop ignoring my question. If it is OK for YOU to refuse to use a bank that doesn't use TLS then why isn't it OK for a bank to refuse you as a customer if you refuse to agree to remote attestation? Both parties have the right to specify reasonable security postures and either mutually agree or not.

Re: Lennart Poettering, Christian Brauner founded a new company

#759

Post by rkomorn »

UltraSane wrote: post #758
jofla_net wrote: post #754

Earlier quoted context omitted.

Because Banking has existed and operated fine for countless decades without it(attestation). Also, as there is ample discussion elsewhere, having attestation does NOT eliminate the ability for your account to become compromised. As restated. "If the user's device isn't compromised then everything is fine regardless of whether or not it can pass attestation. If the user's device is compromised, the device doesn't need…

Stop ignoring my question. If it is OK for YOU to refuse to use a bank that doesn't use TLS then why isn't it OK for a bank to refuse you as a customer if you refuse to agree to remote attestation? Both parties have the right to specify reasonable security postures and either mutually agree or not.

Not OP, and also not sure where I actually stand on this debate because I think your point has a lot of validity to it, but...

I think there's also an argument in favor of a person having the right to access their money (and I'd argue that accessing your bank's website/app is accessing your money) however they want, and that access to their money is more of an important right than the bank's right to control how that access happens.

I think we can all agree to some "within reason" clauses on both sides (eg not allowing HTTP only access seems reasonable), and I guess a lot of this debate is "is requiring attestation within reason?"

To me, any asymmetry between the rights of the consumer and the rights of the bank should be in the favor of the consumer.

Re: Lennart Poettering, Christian Brauner founded a new company

#760

Post by giant_loser »

2pEXgD0fZ5cF wrote: post #500

Well I was wondering when the war on general computing and computer ownership would be carried into the heart of the open source ecosystems. Sure, there are sensible things that could be done with this. But given the background of the people involved, the fact that this is yet another clear profit-first gathering makes me incredibly pessimistic. This pessimism is made worse by reading the answers of the founders here…

Yup

Poettering is a well-known Linux saboteur, along with Red Hat.Without RH pushing his trash, he is not really that big of a threat.

Just like de Icaza, another saboteur, ran off to MS. That is the tell-tell sign for people not convinced that either person's work in FOSS existed to cause damage.

No, this is not a snarky, sarcastic comment. Trust Amutable at your own peril.

Post reply on HN