Hacker News Reader

Comment by stevewatson301 | Hacker News Reader

There is something ironic about the FOSS projects these days embracing attestation rather than standing up for user rights by vehemently rejecting it.

View on HN

I know my reasons for feeling worried about it but I wonder why you also dislike the idea of end user operating systems making it trivial for applications to take advantage of remote attestation?

Because it can snowball from "you may not access Widevine content on an unapproved device", which is of little significance to "you may not connect to the internet on a non government approved device" which is extremely dangerous.

To preempt the "but slippery slope!" counters, where we're currently at is "you may not use your bank's mobile app on a phone that isn't running genuine, unmodded, unrooted version of the hardware and OS it came with". This is the reality of modern Android devices. And it's not worse only because, like with any API, adoption of new-and-improved Safenet / Play $forgot-the-name APIs takes time.

The slippery slope is not a fallacy if the slope is, in fact, slippery.

At least so far my bank hasn't prevented me from using my web browser on linux to access the banking website. But I am certain they will once Windows 11 gets enough traction in a few years.

Yes, websites are still the one place where users have some degree of parity with the vendors. They are, however, being actively phased out. It's a long process, but it's clear. New banks and quasi-banks often don't even have a web portal. Old-school banks have been actively pushing apps as the primary interface. In recent years, they've been pushing apps as preferred auth mechanism for confirming logins and transactions initiated off-app. How long before it'll become the only mechanism?

However, my bank requires second factor for authenticating, when using the banking website. And that second factor used to be SMS, but nowadays it is their banking app on a mobile device. Exactly that one that has to run on "genuine, unmodded, unrooted version of the hardware and OS it came with".

Can you use your web browser for all functions of the banking app?

E.g. for my bank the app is the only 2FA option that doesn't come with additional costs.

Yes, I can do everything via the website. But I must use a secure key dongle pinpad thing to log in.

It's good to know that other people can see the writing on the wall too. I've told people that this is being made possible. While it is not a guarantee that the availability of the technology will lead to the use of the technology in such a manner, the fact that it will be possible means it's just a matter of time before someone insists on doing this under the pretext of security.

The saving grace is that attestations can be forwarded but I'm sure even this will eventually get solved. (And the sheer fact they can be forwarded doesn't diminish the dangers of this use of the technology.)

>The saving grace is that attestations can be forwarded

That would require you to have root on a "trusted" device so you can extract the challenge-response that proves you are indeed "trusted". Which is becoming increasingly harder with each iteration.

Windows and AMD/Intel doe remote attestation already. This is not a theoretical development, Windows does this. Practically nobody uses Linux as their daily driver and even then the government wouldn't care. DRM and "trust" solutions are already a problem on free operating systems (like the 720p cap on Netflix content).

This isn't a slippery slope, this is a vertical surface that was erected over seven years ago when SGX hit the market, just standing there.

Luckily the content I watch on Netflix is also freely available through torrents so I don't usually notice the difference, but the DRM fight was lost long ago. Whatever evil things the government is planning on enacting won't be beaten by someone telling the police officers that they use Arch btw.

What are, if any, "advantages of remote attestation" besides enforcing DRMs and preventing sideloading/jailbreaking? Preventing those who need access to proprietary systems from using any distro except 1-2 certified ones?

So that you can be confident that your software hosted with a random cloud provider has been faithfully launched? This is why Intel is keeping SGX in their Xeon processors despite killing it off in consumer oriented series--servers benefit greatly from the ability to prove to clients that they are well behaved

I will never be confident, only the hoster's reputation of being competent and benevolent can matter. Nevertheless I appreciate the clue, thank you.

I mean I can see the advantages on a corporate network, or on just any network that you control. I may want to ensure that on my home network none of the devices have been deeply compromised so I may want to take advantage of the technology. But I feel like making this technology a normal part a user facing operating system risks normalising it to the point that companies will start abusing it to e.g. lock access to online resources to windows/mac only (potentially even leading to ISPs using it to require you to use approved operating systems to connect to the internet under the pretext of improved security).

Because it is the end of electronic personal property, and permanent removal of the ability to opt out of whatever ToC MS or Google decide you must sign to participate in society?

Why is attestation against user rights?

In addition to replies to my original comment, see [1] and [2] for the perils that attestation poses against user rights.

[1] https://www.gnu.org/philosophy/loyal-computers.en.html

[2] https://www.gnu.org/philosophy/right-to-read.en.html

It's called "defense in depth". A signed, attestable boot path is how you get defense in depth against malware attacks. Period. All computing is headed this way.

If you were responsible for the security of your enterprise network, would you vehemently fight for your user's rights to run the ransomware executable they just get sent over email?

This may come as a shock to you, but computers exist outside of a corporate context.

I'm aware of that and those computers do not need to use any of these features. But if you're a FOSS project, why should you be advocating for security features to not exist if they provide value for a significant part of their user-base?

Reply on news.ycombinator.com