Nostr Archives

🔐 Introducing: Unified Attestation An open-source project for verifying the integrity of Android apps—as an alternative to Google's Play Integrity. The goal is to make apps such as banking and payment apps usable on independent Android systems without relying on Google services. We invite developers, ROM projects, and app providers to get involved. https://uattest.net/ #Volla #VollaOS #OpenSource #software #hardware #Privacy #Security #DeGoogle

💬 27 replies

Replies (27)

🌈 Lascapi ⁂1d ago

looks very promising !! 👍

0000 sats

GrapheneOS1d ago

Android already has a hardware attestation system that's open to everyone unlike this centralized system. Volla, Murena and iodé are making a centralized system on top of the Android hardware attestation API to permit their own products while forbidding others. They're not enabling anything which wasn't already possible and are fully dependent on standard Android hardware attestation. Unified Attestation is anti-competitive and it clearly isn't legal. https://grapheneos.social/@GrapheneOS/116200110686604617 📝 0f39c7d8…

000

2299f83…f8e4481d ago

Interesting approach, but: How does #unifiedattestation ensure every interested other and secure alternative ROM can also pass the test? @GrapheneOS does heavily criticize your approach. They claim it puts you (your project) in charge of controlling which ROMs pass attestation and which do not. Is there any room for a collaboration? It sounds as if #GrapheneOS rules this out, how about you guys from @Volla? Any negotiations possible? Any common ground? I, as a user, would just like to use those banking apps without worrying they might stop functioning anytime with any updates. Those banking-app-devs are the real culprits IMHO, to rely on something like Integritycheck theater. @Volla is your secret that you will convince banking-app-devs to open up their checks?

000

Lutin Discret1d ago

thanks. Your approach is better than google having a monopoly on device attestation.

0000 sats

GrapheneOS1d ago

Android already has a standard hardware attestation API. The sole purpose of your Unified Attestation system is a power grab where you put yourselves in control of what's allowed to be used. You do not get to make any demands of GrapheneOS in order for it to be permitted. It's not legal for you to make a system which forbids using other options to your products unless those join your cartel and comply with your demands. You aren't a neutral party and have massive conflicts of interest.

0000 sats

Michael Downey 🧢1d ago

You're literally calling for centralization on the decentralized social network. 🤡 #Volla #VollaOS #OpenSource #software #hardware #Privacy #Security #DeGoogle

0000 sats

GrapheneOS10h ago

Android hardware attestation works on all modern Android devices and is the entire basis for Volla's Unified Attestation API. Their system is a centralized service built on top of Android hardware attestation. Android hardware attestation can already be used directly with arbitrary roots of trust and verified boot key fingerprints permitted. Instead of making a centralized attestation service, they could have at least just made signed root CAs and key fingerprints.

0000 sats

GrapheneOS1d ago

Android already has a hardware attestation system open to everyone unlike this centralized system. Volla, Murena and iodé made a centralized system on top of the Android hardware attestation API to permit their own products while forbidding others. They're not enabling anything which wasn't already possible and are fully dependent on standard Android hardware attestation. Unified Attestation is anti-competitive and it clearly isn't legal. https://grapheneos.social/@GrapheneOS/116239523775374959

0000 sats

🌈 Lascapi ⁂1d ago

Hi @GrapheneOS, you said : > Unified Attestation is anti-competitive and it clearly isn't legal. I don't get your point with this argument. If I understand well, Unified Attestation is a competitor of Google Play Integrity. And everyone can try to setup another competitor. How can you say that it's not legal?

0000 sats

GrapheneOS1d ago

0000 sats

GrapheneOS1d ago

0000 sats

GrapheneOS1d ago

0000 sats

circus_maximus1d ago

It seems like a decentral phone home system - so your app as an app developer has its own "home server". Not sure what the benefit of this is and the use case in general

0000 sats

GrapheneOS1d ago

Unified Attestation is a centralized system and is nothing more than a anti-competitive power grab. These for-profit companies want to be in control of which devices and operating systems are allowed to be used for European banking and government apps. For-profit companies selling devices should not be the ones deciding which devices are allowed to be used. It's inherently going to be extraordinarily biased and unfair with them in charge. https://grapheneos.social/@GrapheneOS/116239523775374959 📝 41f0dbc4…

0000 sats

GrapheneOS1d ago

0000 sats

GrapheneOS10h ago

We would still be against a system being run by companies selling devices rather than a neutral system with fair enforcement of security policy which avoids getting in the way of frequent OS updates. However, it would not be nearly as bad if it was designed to have apps use the standard Android hardware attestation API directly where they could easily add other sources of which roots and operating systems are allowed. Why do they want a centralized service?

0000 sats

GrapheneOS10h ago

Our Auditor app stopped bothering to support devices not supported by GrapheneOS because it was too much trouble. We plan to eventually add a less secure generic mode working across all non-Pixel devices with working hardware attestation but it's a low priority and we're focused on GrapheneOS. Anyone who can currently use Auditor can use GrapheneOS on their device so nearly everyone using it is a GrapheneOS user and we haven't prioritized non-GrapheneOS usage.

0000 sats

GrapheneOS1d ago

Multiple companies collaborating together to make a system which permits their products and forbids using alternatives isn't legal. The whole point of Unified Attestation is that it's a centralized system on top of Android hardware attestation putting these companies in control of which devices and operating systems are allowed. Companies making the products being certified should not be the ones deciding what's allowed. It's clearly not legal for them to be forbidding alternatives.

0000 sats

GrapheneOS1d ago

They're pushing for banking and government apps to adopt a system which they control what's allowed to be used. They're going to be permitting their own products without reasonable security standards while locking out anything not participating in it. That's an anti-competitive cartel and not legal. We're not only going to heavily advocate against it but will file a lawsuit against Volla and the other companies involved as soon as there are apps using it while not permitting GrapheneOS.

0000 sats

Vollaficationist14h ago

Let's collaborate. It's contra-productive with this quarrelling, which often lacks true understanding (cf. this thread, too). UA is *not* a centralised system; on the contrary it is open to any and all interested OS manufacturers - and you have been invited. Any and all. The procedures will be opensourced for anyone to scrutinise and improve. You are so welcome to join.

0000 sats

GrapheneOS12h ago

Unified Attestation is absolutely a centralized system where the companies involved are in control of what's allowed. It's entirely built on top of Android hardware attestation which works fine without a centralized service. Putting out an invite for others to join an anti-competitive cartel providing a centralized service permitting their products doesn't make it open or decentralized. It's an illegal system and GrapheneOS will be filing a lawsuit if it's not ended.

0000 sats

GrapheneOS1d ago

We're completely willing to file a lawsuit against @Volla over this as soon as there are apps permitting their products through their system while disallowing GrapheneOS. It's not legal for Volla and multiple other companies to get together to implement a system banning using anything other than their products. We aren't going to participate is an illegal anti-competitive cartel. It's clearly against the law and should be stopped now prior to it causing clear damages to GrapheneOS.

0000 sats

GrapheneOS1d ago

Devices and operating systems providing an alternative to Google's ecosystem based on AOSP is a distinct space from the broader Android app ecosystem. Companies trying to give themselves an advantage through banning arbitrary options other than their own products/services is clearly an illegal anti-competitive tactic within that space. This should be halted before it causes harm to GrapheneOS. We will not tolerate apps permitting their products through it and banning GrapheneOS.

0000 sats

GrapheneOS12h ago

We've been using the Android hardware attestation API since 2017 in our Auditor app and we were the ones to propose official support for pinning-based verification which was implemented. We've filed multiple issues about bugs in the early implementation on Pixels. We know how it works and know that it's fully usable without Volla's centralized service on top of it putting them in control. You don't understand how it works or what they've built, you just promote the.

0000 sats

GrapheneOS12h ago

GrapheneOS will not participate in an illegal system. It would be a violation of Canadian law. We also won't give these companies veto power over app compatibility in GrapheneOS. It's an existential issue for GrapheneOS similarly to the Play Integrity API. We're already winning a lawsuit and we can win another against Volla too. They should discontinue this before any app adopts it at which point it becomes a legal matter if that app doesn't permit GrapheneOS.

0000 sats