Comment by mschuster91
8 days ago
Just go into r/Magisk, about 9 of 10 posts is a user whose banking app fails attestation.
Fuck banks with a cactus for forcing us to relinquish our freedoms as a precondition of interacting with them, which is a precondition to exist in most societies.
Sure, mobile device app attestation is a big problem for openness, but it has nothing to do with passkeys, where attestation is effectively dead for non-enterprise uses.
Arguably, even passkeys with attestation would be a step forward compared to that, as banks could require an external authenticator tap on a rooted device, or signature of some sandboxed secure element that runs independently from the application OS.
> Sure, mobile device app attestation is a big problem for openness, but it has nothing to do with passkeys, where attestation is effectively dead for non-enterprise uses.
It’s dead so far. Again, X.com could ask you to re-enroll your passkey next time you sign in, but this time requiring attestation. It’ll be phrased like “we’re upgrading your account security, please click ‘Accept’ to proceed”.
> banks could require [...a] signature of some sandboxed secure element that runs independently from the application OS
They can. Why don’t they?
> Again, X.com could ask you to re-enroll your passkey next time you sign in, but this time requiring attestation.
How? Almost none of their users own an authenticator capable of attestation (i.e., a Yubikey or similar).
> They can. Why don’t they?
They can't, because open/neutral access secure elements do not exist yet, and nobody really wants to carry an external one.
16 replies →
Fuck Play Integrity, which is what Google implements, with these drawbacks very much intentionally in place, and 'recommended' banks implement for security. Fuck Google for doing everything they can to make custom roms fail these API's ever more.
There is an alternative* of which I haven't heard in a while.
* https://uattest.net
Fuck all of that. We don't need attestation. We have been handling money online without attestation for over 30 years. Sandboxes and operating system isolation is only getting better. Pwned devices is not the main problem, people getting phissed is the main problem. You don't need attestation to defend against that.
How is that alternative supposed to work without OEM support?
On my GrapheneOS phone, the only things that I came across that require (and thus fail) maximum level attestation are Google Pay and the app for McDonald's for some reason.
Hamburglar is running infosec now and he's taking it reaaaaal serious
Misplaced annoyance with the banks, they're responding to legislative pressures and incentives. Blame the regulators.
There are no laws requiring remote attestation.
You've read all the laws? Regardless, there is likely a legal framework preventing competition and requiring the banks to standardise and coordinate. Otherwise people would go start their own bank that didn't require remote attestation; because the best way to pick up customers is to be flexible about letting them access their own money. In a free market there is a lot of pressure on financial service companies to butter their customers up (at least until the customer owes them cash).
If you're dealing with a legal oligopoly then it is expected that the quality won't be so great.
2 replies →