Post #1461980

2026-03-14 18:07 UTC

@anderslund @svuorela @pmakholm jeg er ikke ekspert, men mit indtryk er at det handler om at en server skal vide med sikkerhed at et api kald kommer fra den rigtige app, så man ikke f.eks. kan lave en MenID app som ligner og opfører sig som NemID.

Replies (3)

@anderslund@expressional.social 2026-03-14 18:08

@jpkolsen @svuorela @pmakholm Præcis.

Open ##1461981
@svuorela@helvede.net 2026-03-15 06:22

@jpkolsen @anderslund @pmakholm men for at det kan virke helt skudsikkert er der behov for kontrol over hele kæden fra Secure boot i hardware der godkender os der så kan validere apps. Hvis noget i den kæde er brudt kan der lyves.

Open ##1461982
@GrapheneOS@grapheneos.social 2026-03-16 16:03

@jpkolsen Android already has a hardware attestation system open to everyone unlike this centralized system. Volla, Murena and iodé made a centralized system on top of the Android hardware attestation API to permit their own products while forbidding others. They're not enabling anything which wasn't already possible and are fully dependent on standard Android hardware attestation. Unified Attestation is anti-competitive and it clearly isn't legal. https://grapheneos.social/@GrapheneOS/116239523775374959

Open ##1461986