Apple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.
Google's Play Integrity API requires hardware attestation for the strong integrity level and is gradually phasing in requiring it for the more commonly used device integrity level. Apple already has it as a requirement. Over the long term, this will increasingly lock out hardware and OS competition.
The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.
Apple's Privacy Pass brought hardware attestation to the web to help with passing captchas on their own hardware. Many people saw that as harmless since few sites would be willing to lock out non-Apple-hardware users. Apple and Google are both likely to bring broader hardware attestation to the web.
Google's reCAPTCHA is planning an approach where they use Privacy Pass on Apple hardware, their own approach on Google Mobile Services Android devices and a QR code scanning system to require an iOS or Google certified Android device for Windows and other systems:
https://t.co/7rQnioRa8A
Banking and government services increasingly require using a mobile app where they can use attestation to force using an Apple or Google approved device and OS. Apple's privacy pass, Google's 'cancelled' Web Environment Integrity and now reCAPTCHA Mobile Verification are bringing this to the web.
Current media coverage for reCAPTCHA Mobile Verification misunderstands it and the impact of it. They're bringing a hardware attestation requirement to Windows, desktop Linux, OpenBSD, etc. by requiring a QR scan from a certified smartphone to pass reCAPTCHA in some cases. They could expand it more.
Control over reCAPTCHA puts Google in a position where they can require having either iOS or a certified Android device to use an enormous amount of the web. Google defines certification requirements for Android which includes forcing bundling Google Chrome, etc. It's enormously anti-competitive.
Google's Play Integrity API bans using GrapheneOS despite it being far more secure than anything they permit. It also bans using any other alternative. This isn't somehow specific to an AOSP-based OS. You can't avoid this by using a mobile OS based on FreeBSD instead. You'll just be more locked out.
Google's Play Integrity API permits devices with no security patches for 10 years. The device integrity level can be bypassed via spoofing but they can detect it quite well and block it once it starts being done at scale. The strong integrity level requires leaked keys from TEEs/SEs to bypass it.
It doesn't provide a useful security feature, but it does lock out competition very well. Services requiring Apple App Attest or Google Play Integrity are primarily helping to lock in Apple and Google having a duopoly for mobile devices. Play Integrity is more relevant due to AOSP being open source.
Governments are increasingly mandating using Apple's App Attest and Google's Play Integrity for not only their own services but also commercial services. The EU is leading the charge of making these requirements for digital payments, ID, age verification, etc. Many EU government apps require them.
Instead of governments stopping Apple and Google from engaging in egregiously anti-competitive behavior, they're directly participating in locking out competition via their own services. Requiring people to have an Apple device or Google-certified Android device is anti-competition, not security.
reCAPTCHA Mobile Verification will currently work with sandboxed Google Play on GrapheneOS but it clearly exists to provide a way for them to start using hardware attestation on systems without it. People without an iOS or Android device will be locked out when this is required even without that.
This isn't about security or any missing functionality. GrapheneOS can be verified via hardware attestation. Google bans using GrapheneOS for Play Integrity because we don't license Google Mobile Services and conform to anti-competitive rules already found to be illegal in South Korea and elsewhere.
Services shouldn't ban people from using arbitrary hardware and operating systems in the first place. Google's security excuse is clearly bogus when they permit devices with no patches for 10 years but not a much more secure OS. It's for enforcing their monopolies via GMS licensing, that's all.
La plupart des PME et ETI B2B disposent aujourd'hui des ingrédients nécessaires à leur croissance : des équipes motivées, des outils CRM et de la donnée.
Pourtant, leur croissance reste souvent artisanale, imprévisible et freinée par des silos entre le marketing et les ventes
And after voting that out too...
🇪🇺 ChatControl is back with a vengeance
The Conservatives (EPP) are attempting to force a new vote TODAY (March 26) seeking to reverse the European Parliament's NO on indiscriminate scanning of ALL your private messages, emails and photos
This is a direct attack on democracy and blatant disregard for your right to privacy
If you're European contact your representatives now, with this handy form:
https://t.co/Zypz9GS9hB
If not, please share this tweet so more people see it and we can block the vote
It's crazy they keep just bringing back whatever they want until it's passed!
Obviously now we see the European Commission is controlled by powerful evil lobbying groups 👺
L’entrepreneuriat : dernière ligne de défense contre le déclin.
La France s’enfonce. Croissance en berne, dette abyssale, bureaucratie étouffante, nivellement par le bas… Pendant qu’on débat de la répartition d’un gâteau qui rétrécit, d’autres pays construisent l’avenir.
Mais tout n’est pas perdu. Il reste un moteur capable d’éviter la catastrophe : l’entrepreneuriat.
🔥 Créer son entreprise, c’est reprendre son destin en main. C’est refuser d’attendre un hypothétique sauveur étatique, refuser la médiocrité, refuser l’assistanat généralisé qui tue l’initiative.
L’entrepreneuriat est le seul ascenseur social qui fonctionne encore. Pas besoin d’être "fils de", pas besoin d’avoir fait l’ENA. Si vous avez du talent, du travail et du courage, vous pouvez réussir. C’est aussi simple que ça.
Mais plutôt que de célébrer ceux qui créent, innovent et prennent des risques, la France fait tout pour les décourager.
⚠️ Taxer, réguler, contrôler : la destruction programmée de la croissance.
Plutôt que d’encourager l’initiative privée, on la ponctionne, on l’étrangle, on la suspecte. À chaque nouveau problème, la réponse est la même : plus d’impôts, plus de réglementations, plus de normes absurdes.
📉 L’exode des talents est une réalité. Les entrepreneurs partent. Pas parce qu’ils ne veulent pas contribuer, mais parce qu’ils refusent d’être les boucs émissaires d’un pays qui n’accepte plus la réussite.
Pendant ce temps, les bureaucrates empilent les taxes et les subventions comme un enfant joue aux Legos, sans jamais se demander comment on crée réellement de la valeur.
Taxer toujours plus, c’est tuer l’initiative. Contrôler toujours plus, c’est tuer l’innovation.
💡 Laissez-nous créer, laissez-nous travailler, laissez-nous réussir !
Ce n’est pas l’État qui va nous sauver. Ce sont ceux qui osent. Ceux qui se lèvent, qui prennent des risques, qui transforment une idée en entreprise, une entreprise en succès, un succès en richesse.
Moins d’impôts, moins de paperasse, moins d’obstacles. Plus de liberté. C’est le seul moyen de redresser un pays qui croule sous sa propre lourdeur.
La France n’a jamais eu de problème de talent. Elle a un problème de confiance envers ceux qui en ont.
🔹 Moins d’État, plus d’initiatives.
🔹 Moins de contraintes, plus de croissance.
🔹 Moins de jalousie, plus de réussite.
Il est temps de choisir.
There's nothing correct in this rag. Because yes it’s a rag, there are no other words. But not just any rag, a dangerous rag.
🧵👇
I. Let's start by saying that the mandate of the ECB is to manage price stability. Writing nonsense about Bitcoin does not seem to me to be part of this mandate, so I would be glad if public money didn't finance this kind of thing, especially when the main mandate has not even been achieved for quite a bit of time.
It is scandalous that the credibility, time and money of a public institution is used to hit a particular asset. I recall here that it is also on this precise point that the SEC lost its case in the United States, having shown that they were not "merit neutral", that is to say indifferent to the merits and asset qualities.
What's more, if Bitcoin is not a currency as they like to repeat, WHY ARE THEY WRITING ABOUT IT AT ALL?!
II. Let us also note that the article is seriously lacking in sources. Almost all of the assertions are unsubstantiated. When they are, for the vast majority it is a referral to opinion articles in the press.
There is only one academic source: Cong et al. (2023) whose abstract tells us "Our sample consists of 29 centralized exchanges, among which the regulated ones feature transaction patterns consistently observed in financial markets and nature.".
Oddly, the ECB paper draws a completely different conclusion: "wash trading accounts for 77.5% of the total trading volume on unregulated exchanges".
I continue with the sources to show you the immense bad faith, and in particular in the case of supposed money laundering and financing of terrorism by cryptos.
“Bitcoin remains the top choice for money laundering in the digital world, with illicit addresses transferring $23.8 billion in crypto in 2022, marking a 68.0% increase from the previous year.” The source indicated is "Chainanalysis 2024". We will overlook the fact that the company is called Chainalysis.
Source links to “2024 Crypto Crime Trends: Illicit Activity Down as Scamming and Stolen Funds Fall, But Ransomware and Darknet Markets See Growth”, January 18.”
https://t.co/WtM2xDXkAj
I don't even know if I need to continue... The title of the report is literally "Illicit Activity Down."
But let's continue anyway because it's juicy. We are told that activity is increasing even though it is decreasing. The reason is quite simple : the authors of the article take the previous reference year (2022) compared to that of even before (2021).
Why ? Because it serves their message. Between 2021 and 2022, illicit activity had increased (in value, not necessarily in proportion). Between 2022 and 2023, it has decreased. So it doesn't interest them, and they go back to the year before, despite the fact that it would obviously have been more relevant to take this year's figure rather than arbitrarily that of the previous year.
Moreover, in terms of order of magnitude, to tell us that Bitcoin is the "top choice" for laundering when it represents ~$20 billion is to mechanically assert that all other means are inferior, and consequently that there is LESS than 20 billion laundered each year in euros or dollars.
Remember that the Pandora Papers ALONE are $11,000 billion in perfectly fiat currency. The few articles that investigated the subject of illicit activities pointed to a proportion of around 1% of the GDP of the euro zone in 2010, or 110 billion (15 years ago).
https://t.co/vRcOWNThxb
Bad faith is evident to the point of ONLY selecting the years that interest them on graphs which do provide more exhaustive data. At this stage, we are on the edge of pure and simple lies, and, in any case, it is plain and conscious disinformation. I say conscious because they THEMSELVES cite the 2024 Chainalysis article, and so they have seen and read it! They do not ignore this information.
III. Beyond the opinion-based sources, the ambient bad faith, the disinformation, and the fact that the authors are not experts and are in full conflict of interest (one of the authors works specifically on the digital euro in addition... .), we obviously find a pile of false assertions, all debunked, or opinions presented as facts:
1) “Today, Bitcoin transactions are still inconvenient, slow, and costly.”
Compared to what ? A SEPA transfer that takes 5 working days? An international transfer that costs on average between 5 and 10% of the transaction?
Remember that if we compare Bitcoin with payment cards, we are comparing apples and pears. VISA & Mastercard do not do transactions, they do authorizations. And so we have to compare this upper layer to the Lightning Network which perfectly sustains comparison.
2) "Outside the darknet, the hidden part of the internet used for criminal activities, it is hardly used for payments at all."
False, completely false, documented, and admitted by the police or intelligence services. Whether it is the FBI which is delighted that criminals use cryptos, or the gendarmerie or even TracFin in France, it is now admitted, including among detractors, that it is not mainly used for criminal activities.
In the National Money Laudering Risk Assessment 2022 from the US Department of the Treasury, we can read "the use of virtual assets for money laundering remains far below that of fiat currency and more traditional methods" or even "the size and scope of drug proceeds generated on the darknet and laundered via virtual assets remain low in comparison to cash-based retail street sales. Worldwide sales on major darknet markets appear to have remained modest when compared to overall illicit drug sales. For example, during 2017–2020, drug-related darknet market sales amounted to approximately $315 million annually, or about 0.2 percent of the combined estimated illicit annual retail drug sales in the United States and European Union."
https://t.co/7NGQ0Zk9tR
I would add that in 2022, the Bitcoin network processed more transaction value than VISA (+$10,000 billion), which is not bad for something supposed to have failed.
3) “Bitcoin is still not suitable as an investment.”
It's just the best performing asset in 15 years.
4) “the mining of Bitcoin using the proof of work mechanism continues to pollute the environment on the same scale as entire countries”
The authors have not opened the latest academic publications: You et al. (Cornell), Ibanez et al. (University College London), Bruno et al. (University of North Carolina), etc. which ALL points to the opportunity to use Bitcoin to green electricity grids and reduce methane emissions. I guess they also didn't ask those who have already tried, i.e. the Texas grid operator, ERCOT, whose ex-CEO Brad Jones called Bitcoin a blessing for the stability of its network and an incentive to increase the ENR mix.
No, the authors prefer evoking the famous “evidence of its huge negative environmental impact.” Which ones? We won't know, since the assertion, although serious, is simply not sourced.
As we suspect, the authors probably preferred to give credibility to the famous Digiconomist, a person who has no expertise and has been wrong by major orders of magnitude for more than 5 years on everything he says on this subject, who lies (he declares in the Cell Reports paper that he has no conflict of interest, which is obviously false since he works in a central bank), and who moreover is not even researcher, since he has not finished his doctorate. This seems to be a better pedigree than Fengqi You (mentioned), from the renowned Cornell University, whose research specialties include computer science and energy transition, the two areas that interest us here, and which since 2010 has been honored with fifteen awards recognizing the quality of his research work.
To tell the truth, the authors probably don't care at all about the environment, but it gives them a practical angle of attack to attack an object that competes with them.
IV. Finally, I add that the article alone is a mountain of contradictions.
1) The value of Bitcoin would be zero because it does not produce "cash flow (unlike real estate) or dividends (stocks), cannot be used productively (commodities), and offers no social benefit (gold jewelry) or subjective appreciation based on outstanding abilities (works of art)."
Does the euro produce cash flows? No
Does the euro produce dividends? No
Can the euro be “used productively”? No
Does the euro offer “social benefits” like jewelry? No
Is the euro subject to subjective appreciation based on extraordinary qualities? No
So we understand that the euro is worth zero?
2) Bitcoin, as we have seen, is supposed to be the “top choice” for money laundering & terrorism.
Yet further in the article, the authors rebel against regulatory fatalism, and bring out the killer argument to encourage legislators not to sit idly by: “But Bitcoin transactions offer pseudonymity rather than complete anonymity, as each transaction is linked to a unique address on the public blockchain. Therefore, Bitcoin has been a cursed tool for anonymity, facilitating illicit activities and leading to legal action against offenders by the tracing of transactions".
Great, so in the same article, Bitcoin manages to be the best way to carry out illicit activities, but also a “cursed” way which allows “legal actions against offenders” because we can trace the transactions.
In. The. Same. Article.
V. Finally, the authors wonder why Bitcoin is not yet banned (“it seems wrong that Bitcoin should not be subject to strong regulatory intervention, up to practically forbidding it”), and come to suggest actions to legislator (Reminder, this has no place here, since it does not fall under the mandate of price stability).
What are these actions?
"The Bitcoin network has a governance structure in which roles are assigned to identified individuals. Authorities could decide that these should be prosecuted in view of the large scale of illegal payments using Bitcoin."
First, Bitcoin governance does not have roles assigned to individuals. There are roles, yes, but the individuals who participate in them are interchangeable. They are also not necessarily identified, see solo miners.
Among those roles, there are core devs, miners, nodes, exchange platforms etc. Everyone has their little power, but no one controls Bitcoin alone. Let us incidentally recall for example that a few years ago, during the Blocksize Wars, miners & exchange platforms lost their battle against nodes.
So what does the authors’ not-at-all-innocent little phrase mean?
That we're going to take the core devs from their homes and put them in jail? For which motive ? Because they wrote code?
Should Einstein have been put in jail for opening the way to work on nuclear power?
Someone who sells a kitchen knife has to go to jail because a buyer committed a crime with it?
All this on the basis of a “large scale of illegal payments” which is false, and which they themselves debunked in their own article.
I'm sorry, but where is this going ?
I reiterate that Bitcoin is a test for democracies, and that in Europe we are failing every step of the test. What is happening is serious.
Let's stop the liberticidal delusions and authoritarian or even totalitarian excesses now. It's a political fight.
On en a pas trop parlé mais Viamedis et Almerys ont annoncé avoir été victimes d'un piratage : état civil, numéro de sécu, assureur et garanties souscrites... on parle de 33 millions de français. 33 MILLIONS
@ZacharyByDesign@weweb_io We can't fill in our email address, when we click on the input, it goes straight to "done, you're registered" without having filled in anything 🥲