zlacker

[return to "Remote Attestation is coming back"]
1. alexhs+ne[view] [source] 2022-07-30 00:29:03
>>gjsman+(OP)
The problem isn't the capability of remote attestation. The problem is who's using it, i.e. who's defining what "security" means. As noted above, for a company, "security" often means intentionally inhibiting my freedom, not actually securing anything I care about.

We would benefit from a better public discussion of what "security" encompasses. Else, we risk conflating "what MS wants me to do with my computer" with "preventing hackers from stealing my credit card number".

Imagine a world where you could submit personal information to a company, with the technological assurance that this information would not leave that company... and you could verify this with remote attestation of the software running on that company's servers.

◧◩
2. mike_h+W81[view] [source] 2022-07-30 13:35:36
>>alexhs+ne
"Imagine a world where you could submit personal information to a company, with the technological assurance that this information would not leave that company... and you could verify this with remote attestation of the software running on that company's servers."

That world already exists, it just doesn't get used much. You can do this with Intel SGX and AMD SEV.

The obvious place for this is blocking cloud providers from accessing personal data. For example, it could be used to resolve concerns about using US based services from Europe, because any data uploaded to such a service can be encrypted such that it's only processed in a certain way (this is what RA does).

RA gets demonized by people making the arguments found in the sibling comment, but they end up throwing the baby out with the bathwater. There are tons of privacy, control and decentralization problems that look intractable until you throw RA in the mix, then suddenly solving them becomes easy. Instead of needing teams of cryptographers to invent ad-hoc and app specific protocols for every app (which in reality they never do), you write a client that RAs the server to check that it's running software that won't leak your private information as part of the connect sequence.

◧◩◪
3. accoun+EK5[view] [source] 2022-08-01 11:18:36
>>mike_h+W81
> The obvious place for this is blocking cloud providers from accessing personal data. For example, it could be used to resolve concerns about using US based services from Europe, because any data uploaded to such a service can be encrypted such that it's only processed in a certain way (this is what RA does).

This will not work because the concerns about US based services are legal ones due to access requirements by the US government which cannot be solved by technical restrictions while still complying with those requirements.

◧◩◪◨
4. mike_h+qt9[view] [source] 2022-08-02 14:15:06
>>accoun+EK5
The US Gov requirements don't require that cloud services make as much data available to themselves as possible, only that they provide access to what they do have (otherwise end to end encrypted messengers would already be illegal and shut down).
[go to top]