Apple and Google are gradually expanding their use of hardware-based attestation.
-
Yes, and money goes both ways.
-
@7cd4a72311bad46117e0f692dddc5f31a543b47ff4265b028f8d820ac808ab3c @MAlBarram Pixels aren't somehow dead and none of what we posted is in any way specific to Pixels, Android devices or operating systems based on the Android Open Source Project.
You should read the thread we posted which is about them bringing the Play Integrity API to the web including for desktops by requiring having a phone certified by it or an iOS device in order to pass checks on the web and desktops too.
-
@7cd4a72311bad46117e0f692dddc5f31a543b47ff4265b028f8d820ac808ab3c @MAlBarram Pixels aren't somehow dead and none of what we posted is in any way specific to Pixels, Android devices or operating systems based on the Android Open Source Project.
You should read the thread we posted which is about them bringing the Play Integrity API to the web including for desktops by requiring having a phone certified by it or an iOS device in order to pass checks on the web and desktops too.
@7cd4a72311bad46117e0f692dddc5f31a543b47ff4265b028f8d820ac808ab3c @MAlBarram This doesn't impact GrapheneOS more than it impacts Windows, desktop Linux, FreeBSD, etc. You should read what we wrote in the thread. Whether you use a FreeBSD device or a GrapheneOS device, needing to have an unmodified iOS or Google Mobile Services Android device to pass checks for accessing banking and government services or now to pass certain reCAPTCHA checks is still going to be an issue.
-
Instead of governments stopping Apple and Google from engaging in egregiously anti-competitive behavior, they're directly participating in locking out competition via their own services. Requiring people to have an Apple device or Google-certified Android device is anti-competition, not security.
@GrapheneOS This is a major issue. Even to make appointments in DE at local Government Offices one has to jump through ID processes that in my case only work via my wife's iPhone.... it should be constitutionally illegal. It is a denial of right.
-
Android's hardware attestation shouldn't be used to lock out users not using specific hardware or OSes. However, the fact that it permits arbitrary roots of trust and OSes at least allows services to permit more. Google could use it to permit GrapheneOS for Play Integrity if that was about security.
It is a proof that governments, banks and companies are one and the same.
-
The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.
@GrapheneOS Het lijkt me dat @kimvsparrentak hier ook wel een mening over zal hebben? Het kan toch niet zo zijn dat login in Europa straks wordt gegatekeeperd door twee Amerikaanse bedrijven?
-
Current media coverage for reCAPTCHA Mobile Verification misunderstands it and the impact of it. They're bringing a hardware attestation requirement to Windows, desktop Linux, OpenBSD, etc. by requiring a QR scan from a certified smartphone to pass reCAPTCHA in some cases. They could expand it more.
@GrapheneOS How would this be accessible, eg would blind people be able to scan a QR code on a screen?
-
Apple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.
@GrapheneOS Is this illegal under antitrust or pro-competition laws? If so, is legal action against it planned?
-
@GrapheneOS Het lijkt me dat @kimvsparrentak hier ook wel een mening over zal hebben? Het kan toch niet zo zijn dat login in Europa straks wordt gegatekeeperd door twee Amerikaanse bedrijven?
@ArtHarg wat bedoel je met ‘login in Europa’?
-
@GrapheneOS @dwaynemonroe pypi disabled pgp signing (certified donald stufft and william woodruff tag team production. woodruff whined about how he couldn't surveil some keypairs and claimed this made them "useless")
anyway if you want the cryptographic checkmark from pypi they need you to give microsoft or google a few minutes alone with your code before any user can see it. not "reproducible" but reprobuilds only bullies open source code not corps. would love the evangelism strike force to fight corporate DRM and not module signing in the kernel
it is very possible to reproducibly diff a build process with module signing, diffoscope just completely sucks
[yes i'm likely gonna fork it]
thanks for listening!
@hipsterelectron @GrapheneOS @dwaynemonroe The book to throw at people who can't grasp the significance is Edwin Black „IBM and the Holocaust” and for what the target will be in the USA, to which I'll hopefully never be repatriated, witness e.g. Marsha Blackburn declaring that the purpose of KOSA is to „eradicate the transgender.” I figured out that no one was going to deal with the issue in good faith and fled the country before the inauguration, and was already vindicated at the inauguration itself.
-
Instead of governments stopping Apple and Google from engaging in egregiously anti-competitive behavior, they're directly participating in locking out competition via their own services. Requiring people to have an Apple device or Google-certified Android device is anti-competition, not security.
@GrapheneOS The Brazilian government app "gov.br" requires Play Integrity too. There's no fallback, no alternative verification method.
I've sent complaints to the Brazilian entities suggested in the "Keep Android Open" website, but they either reply with a template message or completely ignore it.
Google is pretty much our Evil Corp, but where is fsociety?
-
@GrapheneOS The Brazilian government app "gov.br" requires Play Integrity too. There's no fallback, no alternative verification method.
I've sent complaints to the Brazilian entities suggested in the "Keep Android Open" website, but they either reply with a template message or completely ignore it.
Google is pretty much our Evil Corp, but where is fsociety?
@GrapheneOS I've used Magisk and Play Integrity Fix/Fork before. While it works, it requires a rooted device. The PIF module has to update very often to keep working, and it would have root privileges to your phone...
-
Android's hardware attestation shouldn't be used to lock out users not using specific hardware or OSes. However, the fact that it permits arbitrary roots of trust and OSes at least allows services to permit more. Google could use it to permit GrapheneOS for Play Integrity if that was about security.
@GrapheneOS You're just doing it wrong. Using current mobile hardware and android as base is just wrong approach. Happy to talk about this f2f.
-
Apple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.
@GrapheneOS we need more Linux or BSD FOSS phones. Can that mitigate or at least stop these practices?
-
Apple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.
@GrapheneOS Worst case, this is gonna kill desktops altogether, and AluminumOS simply existing is a huge step in that direction. -
@GrapheneOS Is this illegal under antitrust or pro-competition laws? If so, is legal action against it planned?
@GrapheneOS @alwayscurious Anti-trust is dead in the Fourth Reich. -
@garrett We provide documentation at https://grapheneos.org/articles/attestation-compatibility-guide on how apps can use the Android hardware attestation to permit GrapheneOS and other hardware / operating systems which aren't certified by Google. This API supports permitting alternate roots of trust and non-stock operating systems. We use new signing keys for each new device model so new devices won't be listed without them updating it and their list won't include alternate builds of GrapheneOS. Apps should not be doing this at all.
Hardware Attestation should only be used in situation when device is supposed to not be owned by the user. Like an internal service of a company making sure only company-provided devices are accessing it.
-
The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.
@GrapheneOS I’ve been reflecting on this. For the UK, wondering if we might consider a government petition that explicitly requests that all public (or publicly funded) services can be accessed and used without being forced to use any (especially any foreign) third party service?
-
Android's hardware attestation shouldn't be used to lock out users not using specific hardware or OSes. However, the fact that it permits arbitrary roots of trust and OSes at least allows services to permit more. Google could use it to permit GrapheneOS for Play Integrity if that was about security.
@GrapheneOS We really need to start using containers for running the OS itself instead of flashing the OS. Shameless plug but LosOS (https://gitlab.com/losos-linux) does that.
-
Control over reCAPTCHA puts Google in a position where they can require having either iOS or a certified Android device to use an enormous amount of the web. Google defines certification requirements for Android which includes forcing bundling Google Chrome, etc. It's enormously anti-competitive.
@GrapheneOS Ejem... There is Altcha. Open source, GDPR compliant, and you can use your backend.
-
J jwcph@helvede.net shared this topic
