this post was submitted on 11 Mar 2026
74 points (100.0% liked)
Privacy
4306 readers
87 users here now
Icon base by Lorc under CC BY 3.0 with modifications to add a gradient
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
You make a valid point, but I still don't see why attestation is necessary. In a corporate setting, sure, it's probably important to remotely verify that the OS is still untampered--except, oh wait, you can do that with the FOSS, opt in, privacy respecting, auditor app. If you install it via MDM you can install, set up, and then block the app so the user doesn't do something dumb.
As for my bank and other such companies, from a legal standpoint I'm already liable if my device is compromised. In almost every Terms and Conditions, it will include a clause that they cannot guarantee your device, or any device you use to access their service, is free from malicious software, and thus it is up to you to keep your account secure.
If banks were really serious about security, more of them would offer yubikey support. None of mine do, unless they just brought it online.
I see you have made up your mind and nothing said will change it. 🙄
If you can tell me an actual use case for attestation that isn't purely for discrimination, I'm all ears. But if you want to tell me I should be in support of something because it's better than the other thing, all the while ignoring the fact that it has no need to exist in the first place, I'm certainly not going to be swayed to agree with you.