> privacy-oriented OS

Well, in all seriousness what examples could you give me here in terms of device hardware attestation? Even GrapheneOS does use Google root certificates to attest your device. There is indeed an option for EUDI to keep a list of keys and I bet this is probably the way they are going to go for Android in the future. We shouldn't forget this is still in the planing phase.

> to have an account with Apple or Google.

True for Google, not true for Apple. Device attestation on iOS does not require you to have an iCloud account or sign into some Apple services. It works entirely using device hardware ids.

> I also own an expensive card reader, which together forms a system that is completely capable of supporting any attestation anyone would need.

Nope. This is eID and verifies your identity, it does not attest the security of your hardware. These are two different problems we talk about here.

▲

Hackbraten an hour ago | parent | next [-]

> Nope. This is eID and verifies your identity, it does not attest the security of your hardware.

The reader and its firmware is already certified by the federal IT security agency BSI for use with eID and banking. Why shouldn’t I be allowed to use that for whatever digital identity wallet thing the EU is cooking up?

	▲	p2detar 33 minutes ago \| parent [-]
		Correct me if I’m wrong please, but this is a mobile Wallet app, an enclave, for government issued documents: Ausweis, Diploma, etc. How does a card reader come into the workflow here? I don’t quite get your point.

▲

fsflover 2 hours ago | parent | prev [-]

> in all seriousness what examples could you give me here in terms of device hardware attestation?

My Librem 5 runs an FSF-endorsed OS and has a smartcard.

> True for Google, not true for Apple. Device attestation on iOS does not require you to have an iCloud account or sign into some Apple services.

This is extremely misleading. Even if true, you must have an account in order to install any app on an iPhone.

▲

p2detar 44 minutes ago | parent [-]

> My Librem 5 runs an FSF-endorsed OS and has a smartcard.

Ok, so how does that help with device attestation? If I am an app developer how does it tell me that your OS has not been tempered with or actually that my app has not been tempered with? Are there any cryptographic keys stored in a secure place on the device that the Librem vendor can verify?

> This is extremely misleading.

But it's not. It's an architectural difference between how Google and Apple implemented attestation. Apple stores the generated keys in a secure part on your device and certifies them. The rest is your job as an app developer. And as a user, you do not have your iCloud or iTunes account used for device attestation. In contrast Google and its Play services are an integral part of the attestation workflow.

For Apple it's evident from their docs. As a side note: I do try to learn more about this, because of an incoming project concerning it.

> You can’t rely on your app’s logic to perform security checks on itself because a compromised app can falsify the results. Instead, you use the shared instance of the DCAppAttestService class in your app to create a hardware-based, cryptographic key that uses Apple servers to certify that the key belongs to a valid instance of your app. Then you use the service to cryptographically sign server requests using the certified key. Your app uses these measures to assert its legitimacy with any server requests for sensitive or premium content.

Source: https://developer.apple.com/documentation/devicecheck/establ...

	▲	fsflover 13 minutes ago \| parent [-]
		> If I am an app developer how does it tell me that your OS has not been tempered with or actually that my app has not been tempered with? This is not your business to verify and control what can run on my phone. I can do it with my smart card, which securely stores cryptographic keys. > And as a user, you do not have your iCloud or iTunes account used for device attestation. It does not matter. An account is necessary to make the phone usable at all. The attestation is useless on a phone that can't install apps.