Comment by Grombobulous
5 days ago
If you’re talking about device attestation, I see no particular way in which the technology is locked down to Google/Apple. Another phone/OS manufacturer could implement the same mechanism.
5 days ago
If you’re talking about device attestation, I see no particular way in which the technology is locked down to Google/Apple. Another phone/OS manufacturer could implement the same mechanism.
We have a mobile OS duopoly. There is nothing that can replace it in any forseeable future. Remote attestation is deeply anti-competitive, and also is exactly the mechanism used to ensure it stays this way.
I see this as a chicken and egg issue. Small competitors like SailfishOS and GrapheneOS already face the challenge of having a comparatively minuscule customer base.
The way the EU and some other countries approach issues like this is to consider Apple and Google regulated monopolies. They must allow alternative app stores and follow other rules that normal non-monopoly businesses don’t have to follow.
There’s nothing about device attestation that is any more or less challenging than their status quo predicament.
Somewhat related, on the HN home page today: https://news.ycombinator.com/item?id=50217495
For any of those regulation attempts, the duopoly has been coming up with another countermeasure that delayed and nullified the main effect.
Remote attestation as a broadly used technology will in itself protect the duopoly. Without it, smaller competitors could just offer an alternative that is automatically compatible with the app or service ecosystem, implement compatibility layers or client software compatible to that services.
Now they can't, because even if they offered their own remote attestation service, they would need to convince every app supplier individually to explicitly support their system.
The only way to enable any kind of growing competition would be to outright abolish hostile technologies like remote attestation, bootloader lockdown and so on.