fsf4alltemp

Haha, it's a bit sad when the record's get compromised it's still the people's problem. :p https://www.youtube.com/watch?v=CS9ptA3Ya9E

In my country, the same verification service is used to access banks, health services (private and public), taxes, and even verify online retail purchases. This verification app on Android requires Play Integrity on first time activation so fresh installs of something like GrapheneOS will not let you use the app. It's still currently possible to use a hardware token alternative to the app. It is only getting less convenient and possible to opt out of the digital verification systems even if there's technically still workarounds. In the past, even when such verification systems existed, they were less user constricting (no requirements on remote attestation for example).

I believe if we look at the past compared to now, and then extrapolate towards the future, without proper action, we will keep slipping down the slope.

That same box that lets me play Battlefield 6 is also the only box powerful enough to run the game that doesn't have enough accessibility options that requires me to use CheatEngine to fix.

This idea that protecting users is worth the cost of giving up your ownership rights is fallacious.

Protecting 1 million grannies is an entirely different risk class than the security implications of stopping everyone from using their devices as they see fit.

Protecting 1 million grannies means everyone loses ability to install apps that:

  -allow encrypted chat
  -allow use of privacy respecting software
  -download art/games/entertainment that is deemed inappropriate to unelected parties
  -use software to organize protests and track agents of hostile governments
  -download software that opposes monopolistic holds of controlling parties

Using Linux is also not a real choice. To access my bank and health services in my country, I require a mobile device that is remote attested by either Apple or Google which are American countries. Hell, it's becoming closer to reality that playing online video games requires remote attestation either to "prevent" cheating or for age verification.

Thus the risk widens to the sovereign control a nation has over its own services. A US president could attempt to force Google and Apple to shutoff citizen access of banks and health services of an entire nation. Merely the threat could give them leverage in any sort of negotiations they might be in. For some nations in the future, the controlling nation may be China I imagine.

I think the real regulatory solution here is to break up monopoly practices. While the EU's DMA is all well and good in some ways, the EU is also pushing Chat Control... In a more fragmented market it becomes impossible for a bank or health service to mandate specific devices for access (they lose potential customers) so you could theoretically move to a device that doesn't do draconian style remote attestation that breaks if you go off the ranch. We need more surgically precise regulatory tools than sweeping legislation that would keep using alternatives like Linux or FreeBSD or whatever actually viable. It also makes it much harder for that same legislative body to enforce insane ideas like Chat Control.

The answer is not protect users from themselves. The answer is more freedom, with a legal framework that helps all users have more choices while helping victims acquire restitution.