zlacker

This is hardware attestation in a nutshell: a double edged sword, and a sharp one at that.

The biggest issue is that the attestation hardware and the application client is the same device with the same manufacturer, who also happens to have a slight conflict of interest between monetizing customers and preserving any sort of privacy.

IMHO the pro-attestation forces are so overwhelming that we should all cherish the moment while we have anything open left.

>>baq+(OP)
This could be a boon to all sorts of new kind of hardware though (wishful-thinking mode)

>>baq+(OP)
How does private access token (PAT) compromise privacy in the name of monetization?

>>baq+(OP)
The insane question here is, why would the EU mandate hardware attestation controlled by two private American companies in order to access services?

That seems completely contrary to the spirit of EU laws and regulations, which tend to be about protecting the consumer, preventing monopolies, ensuring people can generally live their lives where all things that are mandatory are owned and ran by the state and foster a certain degree of EU independence, with a recent focus on "digital sovereignty".

This one is a five for one against all of those goals? Harms the customer (you could see this as the polar opposite of GDPR), strengthens entrenched monopolies, force citizens to be serfs of one of two private corporations in order to access information, and on top of that, like it wasn't enough, willingly capitulates to the US as the arbitrates of who is a valid person or not.

This is so against the spirit of the EU itself that it would almost be funny if people weren't serious.

>>disrup+z7
> The insane question here is, why would the EU mandate hardware attestation controlled by two private American companies in order to access services?

Because the EU doesn't actually care about privacy, otherwise they wouldn't be trying to do this and ChatControl. They care about being the main ones to spy on you, and maybe using fines as additional "taxes" on rich foreign companies. That's it.

>>disrup+z7
The app this discussion is about is a reference implementation that is part of a long-term process for building a digital identity app. Specifically, this discussion is about the age verification part of the app, which is the first part expected to be finished but is also only a small part of a much wider ideal.

Europe's dependence on American tech is a major pain point but realistically, there are only two smartphone vendors. If a European vendor does rise up, I'm sure whatever app comes out of this process will happily hook into the hardware attestation API for that OS as well.

https://github.com/eu-digital-identity-wallet

>>disrup+z7
> The insane question here is, why would the EU mandate hardware attestation controlled by two private American companies in order to access services?

Because this is being pushed by lobbyists to use hardware attestation to make it piratically mandatory for every citizen in the EU to be registered to either Apple or Google with a real id for all non-trivial online interactions at all times. The people behind this push neither have the technical knowledge nor care in the slightest that this is the consequence.

>>IlikeK+Pe
>piratically mandatory

I am stealing this typo.

>>disrup+z7
Take any group of a hundred tech people (devs, analysts, architects, etc.), and 95 of them will do everything with their stock Android or IOS smartphone. Maybe 3 will consciously limit their use of that device, and the remaining 2 reluctantly use something sane like GrapheneOS. Those two might pipe up and take a stand for people without smartphones (which includes a very varied swath of people, from Luddites to people with disabilities), but they'll get drowned out by sighs, sheepish looks, and the chorus of 'let's just start with those two smartphone OSes, and if after a year or two people still really need something else, a new project can be started to address that'.

It's not an insane question, it just doesn't get asked.

>>disrup+z7
Do you believe they care for EU? The driving forces are other.

>>jeroen+ec
But you could do attestation on GrapheneOS, no need to require the users to have Google spyware preinstalled. Google is abusing its position here, attestation should be to verify the security model, not Google's business model..

>>jeroen+ec
This "identity wallet" is such a hostile idea, require identification for everything instead of thinking about how to remove identification (for example, allow anonymous banking, traveling).

>>zb3+6C
Attestation is fundamentally incompatible with software freedom.

>>codedo+7G
When scoped to attest the full software stack down to the kernel, yes, because it takes control away from the general purpose computing device that the user supposedly owns. I don't however have a problem with attestation scoped to dedicated hardware security devices such as Yubi Keys.

>>ulrikr+DL
And if such dedicated hardware is ever required by the law, the manufacturer should be prohibited from bundling any business-related functionality there (such as displaying ads) that can't be turned off without breaking the certification.

Google's ad business model should never be mandated by law, unfortunately lawmakers seem to be unaware that this is what requiring Play Integrity effectively means.

>>disrup+z7
> The insane question here is, why would the EU mandate hardware attestation controlled by two private American companies in order to access services?

Please (kindly) ask Paolo De Rosa [1], Policy Officer at the European Commission and driver of many of the decisions behind the wallet and the ARF. His position is one of fatalism: that it's "too late"; the duopoly of Goople is entrenched, and it's therefore not a problem if the wallet project entrenches it even further. Regrettably quite a lot of member states agree, although representatives of France and Germany specifically are frequently standing up to the fatalism.

[1] https://github.com/paolo-de-rosa

>>baq+(OP)
My understanding of the "double edged sword" idiom is that the tool has both downsides and upsides. What are the upsides to restricting what I can do with the hardware I paid for?

>>zb3+BO
Yes, and remote attestation should be illegal on any general purpose computing device, for some reasonable definition of what that is. General purpose computing should be a human right, in particular the right to change the software running on devices that you own.

>>mzajc+3b1
Revenue for the device manufacturer for licensing sales in their walled garden "store".

Since Apple and Google are public companies I guess we should all buy stock and reap the financial rewards of destroying computing freedom. >sigh<

>>codedo+OF
Wait until you find out that in some places in the EU it's a crime to not carry a physical ID on your person when you leave the house.

>>Confik+5Y
That's so dumb... Europe did it with Airbus and they did it with GNSS. Come on Europe, make a smartphone! The hardware's only getting cheaper.

>>pelora+5B1
Is it just me, or are nation-states getting way too uppity?

>>argomo+Cp2
In post Soviet countries it’s a relic of the past, obviously still useful if you’re looking for a reason to arrest someone.

>>ronsor+D8
Chat control is being pushed by anti-EU Danish representative. EU cannot help against extremists if people vote them into power in EU structures.

>>mzajc+3b1
If done well, a lot of identity theft surface area is secured - you get an integrated yubikey more or less.

>>disrup+z7
Because the EU is essentially designed to keep European countries weak and subservient to the United States.