Remote attestation is a term for technology which is used to verify the software\nthat another device is running. Usually remote attestation technology is implemented\nin hardware, making it difficult to get around.
\nIt is a building block of extremely restrictive DRM systems, as it allows a third\nparty to police what the user can or can't run on a device that is (at least\nsupposed to be) theirs.
\nAn example of an implementation of remote attestation is Google Play Integrity.\nThis is software that can tell a third party whether you are running a Google-approved\nAndroid system. It is mainly (but not exclusively) used by bank and government\napps.
\nThe reason it is implemented is "security", but as I'll talk about in the next\nsection, the actual reason is one of control. It allows Google to decide what\nsomeone can or can't run on their device. It strips all ownership of a device\nthat should be yours away and puts Google in control as the arbiter of what is\nor is not acceptable.
\nBecause of this, the user can't choose what they do with their devices anymore,\nthey can only do what is approved by Google. If they exercise their freedom at\nall, by using a modified version of Android, an alternative operating system,\nor emulating the app, the app will refuse to run.
\nDo you want to be able to use your banking app on your laptop or desktop? Tough\nluck! You're not allowed to. (Even though you should be! Emulation is great for\ninteroperability!)
\nSome may tell you that the built-in Android hardware attestation is a good\nalternative, it is not. It still does the same thing.\nThere is also Volla's Unified Attestation, which is the\nsame thing, just with a different authority.\nNone of these are solutions as they just replace one authority with another.
\nThis is an autonomy, freedom and interoperability nightmare, and must not be\ntolerated. There should not be any external authority able to police what I do\non my own devices.
\nOn the Apple side, there is Apple App Attest, which is the same harmful technology.
\nCurrently, (as far as I am aware) remote attestation isn't used on consumer\ndesktop systems, but we need to stay vigilant to make sure it never does.\nObject to it whenever it even gets suggested.
\nNote: A friend has made me aware\nthat anti-cheat systems use remote attestation. So it is in use on desktop systems.\nAnti-cheat systems are their own flavor of abuse, and somehow my mind sorted them\ninto a different bucket. Still, yikes.
\nA common justification that is given for remote attestation is "security". At\nface value, this may make some sense, as the remote server can verify that you\nare running a "legitimate" copy of the software on a "legitimate" operating\nsystem.
\nThe big problem here is that someone has to decide what is legitimate and what\nis not, and that this remote party is almost never the user of the software. In\neffect, what remote attestation does is give someone else the ability to decide\nwhat you can or can't do on a device you should own.
\nThis then begs the question: Security for who? It's definitely not for the\nuser, as they are locked out of their device. Their security and autonomy have\nbeen harmed significantly.
\nIf someone can't run whatever operating system they'd like and still be able to\nuse the apps they need, then they are completely at the mercy of whoever is\nthe authority judging what software is good and what software is bad. We all know\nhow that ends, as big tech companies never have the best interests of the user\nin mind. Whenever the interests overlap, that is a freak accident, not the norm.
\nAll of the security is for the authority judging your device, none of it is for\nyou.
\nOur personal devices are in a very real sense extensions to our body, which means\nthat bodily autonomy should in some way extend to them. What this means is that\neveryone must have full control of their personal devices and everything that\nruns on them.
\nThis includes having access to all of the code and being able to do whatever\nyou want with it, including modifying it, building it yourself, and sending\ncopies to anyone. (modified or not)
\nThere should be nothing that the user is not allowed to do on their own devices,\nand every single application running on their device must be held to the same\nstandard. It is your device, so everything must run under your rules, and only\nyour rules, no others.
\nThe developer or their company should not have any say over how you use your\ndevice, you should be able to run their software in whichever way you wish and\nthey must not be able to prevent that. You should also be able to emulate\nwhatever you like.
\nIt's your device, no-one except you should be able to decide what runs on it\nand in what way it runs. Any app running on your system is supposed to be under\nyour full control.
\nRemote attestation is a technology that might have some use cases, but the\noverwhelming majority of those use cases are extremely hostile to the user. For\nthat reason, I believe it must be objected to in its entirety. Our personal\ndevices should be ours, and ours only. They must not be under the control of\nanyone else, and no one should be able to decide whether our devices or the\nsoftware they run are legitimate or not.
","headings":[{"level":1,"text":"Remote Attestation Should Not Be Tolerated","id":"remote-attestation-should-not-be-tolerated"},{"level":2,"text":"What is Remote Attestation?","id":"what-is-remote-attestation"},{"level":2,"text":"Example: Google Play Integrity","id":"example-google-play-integrity"},{"level":2,"text":"Will Anyone Please Think Of The Security!?","id":"will-anyone-please-think-of-the-security"},{"level":2,"text":"User Autonomy","id":"user-autonomy"},{"level":2,"text":"Conclusion","id":"conclusion"}]}}