| ▲ | altairprime 20 hours ago | |
That's not exactly correct, at least in the U.S. Banks don't take away the right to modify, banks discriminate against modification. Businesses, in general, have the right to refuse service to anyone for any reason except when their refusals either explicitly, or implicitly by pattern of behavior, derive from one or more characteristics that are protected from discrimination under law. The characteristic of having rooted, and/or having modified, a device is not currently protected from discrimination, and so businesses — who are self-serving to the extreme and minmaxing risk vs. profit just like any good video game player would — are within their legal rights to discriminate against users who modify their mobile phones. You can see a similar pattern taking effect in the car modification industry; California requires tens of thousands of dollars to assess whether a car modification is "legal" to sell there, due to the intersections of gas vehicle smog laws and the tendency of vehicle owners who modify their vehicle to be likely to, just as businesses do above, selfishly minmax lower-emissions vs. higher-performance behaviors in the car's components and programming. As there exists no categorical protection against undue discrimination for "those who modify their property", one such as myself who modifies their vehicle without intent to reduce or defeat low-emissions behaviors has no recourse to claim that the state's $20,000 test fee is discriminatory against personal use by individuals. I support the societal-level necessity of enforcement in this area, but that doesn't excuse charging $20,000 to a for-profit business and then $20,000 to a personal-use resident. So, the true solution, in a U.S. constitutional context anyways, is to amend the protected categories under the Bill of Rights to include "individuals who modify their own possessions" as a category that is protected from undue discrimination. It's a simple enough change from a written perspective. Perhaps California or the E.U. will enact it first? Note, however, that undue does not mean always. Digital ID checks should be restricted to devices booted into sealed-attested mode for the same reason that notarization apps should — faked/stolen digital IDs carry severe and broad-spectrum risks to an entire society of individuals — but banks simply trying to decrease their fraud reimbursement expenses have insufficient cause to discriminate against account holders accessing their accounts. I would absolutely accepted "not permitted to initiate outbound transfers in excess of $10,000" as a compromise. It becomes more unclear when you consider e.g. Apple Pay, and Apple Music. Both currently deny service to those whose macOS is not sealed and attested. One could make a very convincing case that digital wallets are a case where the benefits of sealed attestations are a necessary case of discrimination against those who modify their devices; financial fraud is a nightmare for both users and banks, after all! But there is no convincing case that being able to listen to music albums with a modified device is somehow a threat both to users and to the music industry, and so Apple would find their demand for sealed+attested to be illegal discrimination by Apple Music. I suspect the outcome here is that we see devices that offer a sealed-attested 'wallet' mode, activated by a hardware switch function of some fashion, that temporarily seizes control of the device in order to create a protected environment — with some sort of indicator that can't be falsified by any other software on the device, i.e. the camera green / mic orange LED — so that users can interact with attestation-critical services like ID checks, NFC payment, and MFA requests without having to reboot their device from modified mode. Those who want to install their own attested environment can do so, with the understanding that a great deal of legwork remains to not only earn the world's trust that third-party environments can be secured, but also that both government and corporate environments detest having to decide who to trust themselves and will do their very best to either reject all parties other than a single corporation (E.U. age checks, I'm looking at you!) or will create arcane bullshit obstacles that make it difficult to DIY a secure wallet. Some of that difficulty is completely appropriate for exactly the reasons that secure attestations are appropriate in specific, narrow cases only (same reason I appreciate paper currency having physical anti-counterfeiting technology, but not the stupid constellation): counterfeiting predates humanity, sealed-attestation environments are an excellent defense against entire categories of attacks, and a reasonable level of bureaucratic slowdown is an excellent defense against opportunistic hit-and-run fraud. | ||