Hacker News Reader

Comment by userbinator | Hacker News Reader

This is the dream of corporate authoritarians everywhere. The dystopian nightmare we all warned about because we saw it coming. "Security" is the "think of the children" fearmongering of the current environment.

As one of our Founding Fathers put it: "Those who give up freedom for security deserve neither."

Remote Attestation: Just Say No.

View on HN

Remote Attestation has valid use cases. I assume that you see problems with e.g. RA backed DRM or tamper protection on consumer devices like smartphones. In an ideal world, a political decision would have to be made about allowed use cases for RA that sets up limits where it conflicts with consumer protections. This isn't a technical problem.

Could you elaborate on why this is so evil?

Ensuring our remote employees’ machines are secure is a serious problem for us, and it’s absolutely impossible to require employees to be diligent. We require attestation upon connection to our corporate VPN that checks for basic things such as latest security patches, certain tools installed, etc.

It's a tool. Remote attestation isn't "evil" in the same way a knife isn't inherently evil. It's how they're used.

It's not that remote attestation can't be used for good. Obviously it can. It's that there's so many ways we can use it for evil, and given the track the world is on, it's quite obvious it will be.

When you access a service with your own device, you control what your device does with what they send. You can block ads or malware, inspect code they send you or network traffic you send them to see if it's exfiltrating your private data, extract the data to analyze or keep as evidence when the service is violating a law or contract, write or use third party code to process the data when the service is trying to force a dark pattern interface on you, etc.

If your device will attest that it's running their code then they refuse access to the service under any other conditions, and then you can't do any of those things because their code won't allow it.

It's also a huge antitrust problem because it precludes new independent platforms from being used, since it cements the chicken and egg problem that people won't use a device that can't access existing services and the services won't support a system nobody uses. In other words, WINE is banned and Firefox is banned and everyone is stuck with IE/Edge on Windows forever.

Doing it for company-owned laptops seems a lot different than doing it for customers' devices. I think the complaint is more about the latter.

> Could you elaborate on why this is so evil?

I think you have a fair use-case when you think about corporate machines, that are not personal devices. However, the more this type of remote attestation is used, the more likely it is that politicians will also require it on private machines, because "we have the technology". And then you won't be able to run any software that you want, because it could potentially be used for serious crimes like pirating music.

It's somewhat more acceptable for entreprise use cases but remember that attestation doesn't tell you that the machine is secure, just that the software wasn't modified.

And those who give up security for freedom soon have neither. You need a balance.

Ben Franklin understood that and so included qualifiers in the quote, which was "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety".

Please stop bashing on things you don't understand. This is standard practice for workload authentication in corporate fleets. The article makes the target audience clear:

> If your infra consistently enforces mTLS

Why make the assumption they don't understand? I understand how this tech works and I'm very wary about it being rolled out widely, even if I see the legitimate uses, so I can understand their point. It might not have to do with 'bashing things one doesn't understand'

For example mutual TLS enforcement is something that can happen on my phone to prevent me reading what an app is uploading. It prevents me from auditing things, at least as easily as it used to be: add your key to the trusted keys list and see if e.g. a claim about on-device processing is true. It isn't only the corporate world that uses it, or at least, not only on their own devices

Reply on news.ycombinator.com