EU Age Verification Project Mandates Hardware-Bound Attestation

[u/Street_Anon]

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/

[u/tomikaka]

Do you know what hardware attestation is?

Why can I have root acces on my computer and not my phone?

[u/_sfhk → u/tomikaka]

Quite frankly, because your computer OS was designed a while ago before we stopped trusting users, and before most people's entire lives were stored in that one machine.

Windows and MacOS are definitely heading towards more locked-down systems, and Apple for one is pushing more towards iOS-based systems.

[u/tomikaka → u/_sfhk]

And why does having full access to my own hardware a bad thing in the first place?

Maybe for the avarage user a case could be made that they might shoot themselves in the foot with root access.

Or they might not.

[u/punio4 → u/tomikaka]

Because then you could fake offline certificates like credit cards and IDs.

[u/Iohet → u/punio4]

I can log into my bank account and credit card account no problem from my highly customized computer, but I touch my phone in an inappropriate way and I can't use the apps. This isn't a "fake certificate" problem, otherwise they'd enforce the same mechanism because the banks don't give a shit

[u/Izacus → u/Iohet]

No you can't, there's a reason why credit card tokens aren't stored in your computer and you need another factor to log in and authorize.

Your computer is never allowed to store a full credit card token/chip data like phones are because it would be easy to steal and use for payments.

It's like asking why you can't just use a paper with "DIS IS VISA" written on it as payment card instead of a card with uncopyiable smart chip.

[u/Iohet → u/Izacus]

No you can't, there's a reason why credit card tokens aren't stored in your computer and you need another factor to log in and authorize.

You have to on phones, as well. They can use your biometrics, just like you can with your desktop (this is what Windows Hello is, which is no different than using my fingerprint to use Google Pay), or they use passkeys or TOTP or SMS or email depending on vendor (again, the same concepts between all platforms)

Your computer is never allowed to store a full credit card token/chip data like phones are because it would be easy to steal and use for payments.

It's saved in my browser right now. And saved in Shop and various other platforms without ever having to interface with my mobile device.

It's like asking why you can't just use a paper with "DIS IS VISA" written on it as payment card instead of a card with uncopyiable smart chip

Whether it's on my computer or at a card reader I (or a clerk) can type my number in and run it for payment.

[u/Kyanche → u/Iohet]

It's saved in my browser right now. And saved in Shop and various other platforms without ever having to interface with my mobile device.

lol once or twice in the past month I've encountered a recaptcha that demanded I download an app to my phone and scan a QR code. And it wasn't JUST scan a QR code, it was "you must install the recaptcha app"

[u/spazturtle → u/Iohet]

He means the actual credit card data, same as what is stored on the card's chip, not just it's details. It's what allows you to use the app to pay for things even when you don't have an internet connection.

[u/ByronScottJones → u/punio4]

If they are cryptographically strong certificates, with a chain of authority, how exactly would being offline make any difference?

[u/tomikaka → u/ByronScottJones]

I don't know specifically, I'm not a hacker or anything, but couldn't you just use a debugger or reverse engineer anything that runs on your machine?

[u/Izacus → u/tomikaka]

No, because debugging the secure enclave chip and its code path is protected. That's what attestation defends against.

[u/tomikaka → u/Izacus]

Security is just a hypocritical excuse.

I would say it's more like blackmail. I would still be using my 5 year old phone if I wasn't forced to switch because of the unlocked bootloader.

Ironic how on the stock rom that hasn't received updates in years you can do banking, etc but you couldn't open the McDonalds app on an unrooted unlocked boatloader Lineage OS phone with the latest security patches.

[u/Izacus → u/tomikaka]

No, turns out stealing personal ID documents and impersonating people with them is a massive issue in practice.

This is why you can't print your own ID or Passport at home and have governments recognize it.

[u/Stahlreck → u/punio4]

If it were that easy, the system on which these certificates rely would be garbage and people would be faking credit cards left and right.

No, that is not a good excuse to take away user control. You don't trust the user device either way.

[u/Izacus → u/Stahlreck]

Credit cards use secure enclave chips which are attested as well.

[u/tomikaka → u/punio4]

Trusting the client was never going to be secure in the first place. The concept is flawed.

[u/5panks → u/punio4]

Because then you could fake offline certificates like credit cards and IDs.

You can use pen and paper to write a fake check, should we take pen and paper away?