And that's honestly a pretty significant problem that demonstrates that any government entity pushing for it knows jack shit about *actual* security, because outside of a few specific "I have legitimate reasons to care about the exact firmware running on a given device" cases, the security model of device attestation is nothing more than a bandaid over bad design.
If a bank app is literally just their website in a tin, they have *zero* legitimate reason to care about the specifics of the OS I'm running, regardless of what the government thinks. If I can freely access what's effectively an identical interface from a PC running windows 7 without any secure boot or remote attestation, there's no justification to force it on mobile users just because it's a feature that exists. Why does the *entire OS* need to be as 'trusted' as the dedicated secure element for anything a banking app would need to do?
Emelia/Emi
npub18a…7pj7v
2025-08-20 21:56:28 UTC
in reply to nevent1q…2rsk
Author Public Key
npub18awg073vadjxw7vst9v3dduvxjulc7x7jjyskvqkjfa99xn28zdqj7pj7vSeen on
wss://relay.momostr.pinkPublished at
2025-08-20 21:56:28 UTCEvent JSON
{
"id": "ca128ca73688a0028851bb038f695c644cad1b68cb5bd6fed50bb3b0e5c646ad",
"pubkey": "3f5c87fa2ceb64677990595916b78c34b9fc78de94890b3016927a529a6a389a",
"created_at": 1755726988,
"kind": 1,
"tags": [
[
"p",
"b3ba3c5045fbaf99be9cb4daa9f1d7baeedaba0fc5b91596511e2fb7a70dd7f9"
],
[
"e",
"4f21a4a0e069713dfc5314b6fdeb6b04bd75a3d333d4f3d6c1d42aac3b1437cd",
"",
"reply",
"b3ba3c5045fbaf99be9cb4daa9f1d7baeedaba0fc5b91596511e2fb7a70dd7f9"
],
[
"e",
"725722573c583b785ed7b1008641c1260ca81dafc10d88238f44fff778a058ba",
"",
"root",
"b3ba3c5045fbaf99be9cb4daa9f1d7baeedaba0fc5b91596511e2fb7a70dd7f9"
],
[
"p",
"3f5c87fa2ceb64677990595916b78c34b9fc78de94890b3016927a529a6a389a"
],
[
"proxy",
"https://tech.lgbt/@becomethewaifu/115063323891645038",
"web"
],
[
"proxy",
"https://tech.lgbt/users/becomethewaifu/statuses/115063323891645038",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://tech.lgbt/users/becomethewaifu/statuses/115063323891645038",
"pink.momostr"
],
[
"-"
]
],
"content": "And that's honestly a pretty significant problem that demonstrates that any government entity pushing for it knows jack shit about *actual* security, because outside of a few specific \"I have legitimate reasons to care about the exact firmware running on a given device\" cases, the security model of device attestation is nothing more than a bandaid over bad design.\n\nIf a bank app is literally just their website in a tin, they have *zero* legitimate reason to care about the specifics of the OS I'm running, regardless of what the government thinks. If I can freely access what's effectively an identical interface from a PC running windows 7 without any secure boot or remote attestation, there's no justification to force it on mobile users just because it's a feature that exists. Why does the *entire OS* need to be as 'trusted' as the dedicated secure element for anything a banking app would need to do?",
"sig": "e53eb9fe6d41b47d0012f4e72d6b50801781a220a44a5f422e4c6394ecaf8c9b9da8676e8621b15fa438eafaee5920222fbf10213588a8d376b00e29a773cb3a"
}