Hacker News

points by whazor 1 day ago | 0 comments

I think we really need an open hardware signing authority for open-source roms like GrapheneOS.

We don't need a signing authority. Those "attestations" are are anti-user security theater. We need to stop requiring apps for everything. The internet was designed to be used in a browser that can run anywhere. 2FA can be done with simple texts or phone calls.

[–] aussieguy1234 1 day ago

GrapheneOS does have their own device attestation sdk

[–] croniev 1 day ago

Imagine the outcry. That would go against everything OS stands for, wouldn't it?

[–] whazor 1 day ago

If you are a bank, you want to have an authority that guarantees OS hardware signing of a smart phone.

But this authority could be a bunch of cool people like Letsencrypt, instead of only Google.

[–] Normal_gaussian 1 day ago

OS isn't a co-ordinated movement with a single set of values.