The Android Ready SE Alliance

Very exciting & good.

I also have some pretty big fears though. It feels like we are building systems that are ever more resistant to users having any ability to introspect & explore & manipulate. It feels like the cloud-mainframe is expanding into the devices we own & carry with us.

The unwillingness of security keys to let their owning users copy keys off them seem like another example of that sort of "security must be absolute" mindset, that rejects that the user ought have control & capabilities & be able to do things on their own.

Uncertainty & fear are all over the place, but I feel like there still needs to be a balance, and we're engaging in absolutist securing. And that is closing a lot of very important doors. Security by default is ok, but we keep refusing alternate accessibilities under that moniker.

"SE vendors are joining hands with Google to create a set of open-source, validated, and ready-to-use SE Applets."

Is this a Google specific program or part of AOSP ?

For security critical applications, there needs to be a vendor-neutral program build upon open standards. Can another OS vendor provision attestation keys ?

GlobalPlatform [0] has standardized the SE space, general adoption of APIs is the next step.

[0] https://globalplatform.org/