Comment by lxgr
8 days ago
> They could start tomorrow.
They could also start requiring you to mail a DNA sample to create an account tomorrow.
> It's going to be the banks first.
The same banks that (in the US) largely don’t even systematically use 2FA for online banking logins and completely ignore 3DS for card payments? Attestation usually requires customers to buy and carry extra hardware, so I highly doubt it.
The only place I’ve seen mandatory attestation is in enterprise IT, where admins can supply and enforce usage of e.g. Yubikeys.
Yes, the same banks that simultaneously don't support 2FA, or only support it via SMS, while insisting that mobile devices pass attestation. Also the same banks that still accept swiped credit card transactions but god forbid you want to register a custom non-attested device for wireless payment transactions. Those banks. Lets not pretend that the policies of US banks are by and large either internally consistent or in the customer's best interests.
Don't they support swiped credit card transactions because they can pass the increased cost of fraud onto merchants in the form of increased transaction and chargeback fees?
Are merchants obligated to accept swipe transactions?
Just go into r/Magisk, about 9 of 10 posts is a user whose banking app fails attestation.
Fuck banks with a cactus for forcing us to relinquish our freedoms as a precondition of interacting with them, which is a precondition to exist in most societies.
Sure, mobile device app attestation is a big problem for openness, but it has nothing to do with passkeys, where attestation is effectively dead for non-enterprise uses.
Arguably, even passkeys with attestation would be a step forward compared to that, as banks could require an external authenticator tap on a rooted device, or signature of some sandboxed secure element that runs independently from the application OS.
> Sure, mobile device app attestation is a big problem for openness, but it has nothing to do with passkeys, where attestation is effectively dead for non-enterprise uses.
It’s dead so far. Again, X.com could ask you to re-enroll your passkey next time you sign in, but this time requiring attestation. It’ll be phrased like “we’re upgrading your account security, please click ‘Accept’ to proceed”.
> banks could require [...a] signature of some sandboxed secure element that runs independently from the application OS
They can. Why don’t they?
17 replies →
Fuck Play Integrity, which is what Google implements, with these drawbacks very much intentionally in place, and 'recommended' banks implement for security. Fuck Google for doing everything they can to make custom roms fail these API's ever more.
There is an alternative* of which I haven't heard in a while.
* https://uattest.net
Fuck all of that. We don't need attestation. We have been handling money online without attestation for over 30 years. Sandboxes and operating system isolation is only getting better. Pwned devices is not the main problem, people getting phissed is the main problem. You don't need attestation to defend against that.
How is that alternative supposed to work without OEM support?
On my GrapheneOS phone, the only things that I came across that require (and thus fail) maximum level attestation are Google Pay and the app for McDonald's for some reason.
Hamburglar is running infosec now and he's taking it reaaaaal serious
Misplaced annoyance with the banks, they're responding to legislative pressures and incentives. Blame the regulators.
There are no laws requiring remote attestation.
3 replies →
You answered your own question in parenthesis. US banks are an outlier and the US is not the entire world
Do you know a market in which banks widely use attestation for WebAuthN hardware authenticators?