Hacker News Reader

>The answer is of course pki with trust rooted in the device. If it isnt your grandson's iphone attesting itself [...]

Hardware level attestation isn't even required, and would only marginally increase security. Phones are already heavily locked down. If you're in a position to extract from app data, you're probably in a position to compromise the chat app itself, rendering any attestation pointless.

View on HN

The nice thing about hardware attestation is that the app might be compromised, but only for a few versions. That's enough to pop your private key stored on disc, and to impersonate you for a short while, but then control is returned to you. You might not even notice, if it's detected by the apps security managers at all.

On the flip side, the most common form of a compromise is going to be untrustworthy apps, because for some reason people still use WhatsApp

Reply on news.ycombinator.com