zlacker

>>gjsman+(OP)
The problem isn't the capability of remote attestation. The problem is who's using it, i.e. who's defining what "security" means. As noted above, for a company, "security" often means intentionally inhibiting my freedom, not actually securing anything I care about.

We would benefit from a better public discussion of what "security" encompasses. Else, we risk conflating "what MS wants me to do with my computer" with "preventing hackers from stealing my credit card number".

Imagine a world where you could submit personal information to a company, with the technological assurance that this information would not leave that company... and you could verify this with remote attestation of the software running on that company's servers.

>>alexhs+ne
> The problem is who's using it, who's defining what "security" means?

Ask that question every time you see the word "security" written. There is no such word as bare security.

- security for who?

- security from who?

- security to what ends?

Much of the time security is a closed system, fixed-sum game. My security means your loss of it.

>>nonran+qi
Can you give some examples?

>>ChadNa+am
Let's go with online games, which is mentioned in the article. This focus will specifically be on Riot, but any game publisher can perform this.

> - security for who?

Riot Games

> - security from who?

The users of their software.

> - security to what ends?

Ensuring a device (A) is running windows (B) is running unmodified Windows system files (C) a rootkit that replaces syscall behavior isn't installed

All of this is an effort to prevent cheats that wallhack/aimbot or otherwise give the player an unfair advantage - at least, it ensures the cheats aren't loaded early enough to where their anti-cheat is unable to detect their influence on the game process.

While i say 'Riot Games' is who benefits, it's all at the request of their users; you can search for 'hacker' or 'cheats' on r/leagueoflegends and see tons of posts from years ago complaining about cheaters scripting (automatically using abilities in the best possible way) and gaining an unfair advantage against them. Every posts' comments will boil down to "Riot really should figure out how to stop these cheaters". It's a cat-and-mouse game, but it'll be a lot easier to catch the mouse once they can safely enable the remote attestation requirement and only lose 0.1% of their players.

On the less moral side, this can also be applied to single-player games to reduce the chances of a game's anti-piracy protections being cracked.

>>judge2+iq
We don't need to replace trust with complete submission to a third party. Just build trust. Game servers don't need to be a single festering pool of every user who purchased the title. You can just play games with a community that has accountability.

It's like putting a camera network and automated tranq drones in every playground so kids don't play tag 'wrong'.

This insanity of trying to conflate complete submission to a third party with trust or security when in reality it provides neither because that party is an adversary is a society-wide mental illness.