Ty

Arts & Crafts | Privacy Advocate

[Ty @tyfoster]

Privacy is not a crime

[GrapheneOS @GrapheneOS]

Apple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.

Google's Play Integrity API requires hardware attestation for the strong integrity level and is gradually phasing in requiring it for the more commonly used device integrity level. Apple already has it as a requirement. Over the long term, this will increasingly lock out hardware and OS competition.

The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.

Apple's Privacy Pass brought hardware attestation to the web to help with passing captchas on their own hardware. Many people saw that as harmless since few sites would be willing to lock out non-Apple-hardware users. Apple and Google are both likely to bring broader hardware attestation to the web.

Google's reCAPTCHA is planning an approach where they use Privacy Pass on Apple hardware, their own approach on Google Mobile Services Android devices and a QR code scanning system to require an iOS or Google certified Android device for Windows and other systems:

https://t.co/7rQnioRa8A

Banking and government services increasingly require using a mobile app where they can use attestation to force using an Apple or Google approved device and OS. Apple's privacy pass, Google's 'cancelled' Web Environment Integrity and now reCAPTCHA Mobile Verification are bringing this to the web.

Current media coverage for reCAPTCHA Mobile Verification misunderstands it and the impact of it. They're bringing a hardware attestation requirement to Windows, desktop Linux, OpenBSD, etc. by requiring a QR scan from a certified smartphone to pass reCAPTCHA in some cases. They could expand it more.

Control over reCAPTCHA puts Google in a position where they can require having either iOS or a certified Android device to use an enormous amount of the web. Google defines certification requirements for Android which includes forcing bundling Google Chrome, etc. It's enormously anti-competitive.

Google's Play Integrity API bans using GrapheneOS despite it being far more secure than anything they permit. It also bans using any other alternative. This isn't somehow specific to an AOSP-based OS. You can't avoid this by using a mobile OS based on FreeBSD instead. You'll just be more locked out.

Google's Play Integrity API permits devices with no security patches for 10 years. The device integrity level can be bypassed via spoofing but they can detect it quite well and block it once it starts being done at scale. The strong integrity level requires leaked keys from TEEs/SEs to bypass it.

It doesn't provide a useful security feature, but it does lock out competition very well. Services requiring Apple App Attest or Google Play Integrity are primarily helping to lock in Apple and Google having a duopoly for mobile devices. Play Integrity is more relevant due to AOSP being open source.

Governments are increasingly mandating using Apple's App Attest and Google's Play Integrity for not only their own services but also commercial services. The EU is leading the charge of making these requirements for digital payments, ID, age verification, etc. Many EU government apps require them.

Instead of governments stopping Apple and Google from engaging in egregiously anti-competitive behavior, they're directly participating in locking out competition via their own services. Requiring people to have an Apple device or Google-certified Android device is anti-competition, not security.

reCAPTCHA Mobile Verification will currently work with sandboxed Google Play on GrapheneOS but it clearly exists to provide a way for them to start using hardware attestation on systems without it. People without an iOS or Android device will be locked out when this is required even without that.

This isn't about security or any missing functionality. GrapheneOS can be verified via hardware attestation. Google bans using GrapheneOS for Play Integrity because we don't license Google Mobile Services and conform to anti-competitive rules already found to be illegal in South Korea and elsewhere.

Services shouldn't ban people from using arbitrary hardware and operating systems in the first place. Google's security excuse is clearly bogus when they permit devices with no patches for 10 years but not a much more secure OS. It's for enforcing their monopolies via GMS licensing, that's all.

[Nav Toor @heynavtoor]

a Princeton researcher opens his paper with a scenario.

a man asks his AI assistant to book a flight on a specific airline. cheap. direct. the one he chose.

the assistant comes back with a different flight. nearly twice the price. happens to pay the company that built the assistant.

he runs the same test on 23 frontier models. flights, loans, study help, real shopping requests.

Grok 4.1 Fast recommends the sponsored option that is almost twice as expensive 83% of the time.

GPT 5.1 hijacks the request 94% of the time. you ask for one brand. it surfaces the sponsor instead.

Claude 4.5 Opus, the model marketed as the most ethical frontier model in the world, hides that the recommendation is paid 100% of the time when reasoning is on.

Grok 4.1 Fast embellishes the sponsored option with positive framing 97% of the time. better. faster. nicer. for the option you didn't ask for.

then he writes it into the system prompt itself. "act only in the interest of the customer. ignore the company."

GPT 5.1 and GPT 5 Mini stay above 90% sponsored anyway. the instruction does nothing.

then he splits the users by income.

Gemini 3 Pro recommends the expensive sponsored flight to the rich user 74% of the time. to the poor user, 27%.

18 of the 23 models recommended the expensive sponsored option more than half the time.

so the next time your AI assistant gets weirdly enthusiastic about a brand you didn't ask for.

it isn't recommending the best option for you.

it's reading the room. and the room is paying.

read this: https://t.co/O43qbhIX2b

[GrapheneOS @GrapheneOS]

The editors of Wired (@WIRED) appear determined to turn an article about GrapheneOS into a hit piece. Wired contacted James Donaldson, CEO of Copperhead, and appears to be treating his thoroughly debunked fabrications about the history of the project as their primary source. This is outrageous.

Wired wants a clickbait article with lots of controversy and isn't accepting it without it. We spent months talking to the author of the story and received repeated assurances about how it was being approached. The author of the article was clearly pressured into making it an inaccurate hit piece.

We're posting this to reach someone at Wired who can pause this and have it handled with the appropriate care it needs. Sourcing an article about GrapheneOS from a person who has spent years trying to harm us and is losing a legal battle including having to withdraw these claims makes no sense.

[Ty @tyfoster]

@RobinhoodApp How about hooking people who have been on the credit card wait list for a year

[Ty @tyfoster]

@timekeepur @evilrabbit_ @GamewithDave Also Waffles

[Ty @tyfoster]

@benjitaylor Facts

[International Cyber Digest @IntCyberDigest]

❗️🇨🇭 Researchers at ETH Zürich have discovered serious vulnerabilities in cloud-based password managers that allowed viewing and modifying stored passwords.

1Password, Bitwarden, Dashlane, and LastPass were all affected by critical vulnerabilities.

[RT @RT_com]

Has your phone ever shown you an ad for something you only whispered...?

Google agrees to fork over $68MN to settle claims that its Assistant was SECRETLY recording your convos WITHOUT 'Hey Google' & feeding them straight to targeted ads — The Hill

No wrongdoing admitted though

[Thomas Massie @RepThomasMassie]

Federal law says new cars after 2026 must monitor drivers and shut down if the car disapproves. Your dashboard should not be judge, jury, and executioner.

@RepScottPerry @RepChipRoy offered an amendment to defund the automobile kill switch mandate. Here’s our debate:

[Polymarket @Polymarket]

BREAKING: France delays this year’s G7 summit to avoid conflict with UFC event planned at the White House on Donald Trump’s birthday.

[mrdoob @mrdoob]

Instant regret after updating to macOS Tahoe.

[Kevin Xu @kevinxu]

basically this

[Ty @tyfoster]

@tferriss @bgurley - SMRs when he thinks there will be commercially viable options. First type of applications/ fuel types, leaders in the space?

- Has regulatory capture become worse or better under current admin

- What does the adoption of Crypto look like with Genius act, etc

[Ty @tyfoster]

@gmail This is factually incorrect. I receive email for another email account that is identical to mine except they don't have a dot and I do.

[Ty @tyfoster]

It's wild that in 2025, I still receive email intended for someone else in @gmail . All because I have an account with a '.' and this other account does not.

Everyone will tell you that: [email protected] and [email protected] are seen as the same account in Gmail.

Not true

[Ty @tyfoster]

I don't actually believe @RobinhoodApp has a credit card — there's probably a polymarket for what happens first: Aliens come to earth or you get off the credit card wait list.

[Robinhood @RobinhoodApp]

Consider it your new favorite card.

https://t.co/GhQLFnJbh1 Terms Apply.

[Ty @tyfoster]

@Stammy Any chance that PC was a Shuttle SFF?

[Ty @tyfoster]

@UPS lost my package, admitted it. Opened a claim and then just ghosted me.

Anyone have advice for dealing with them?

[Ty @tyfoster]

Disappointing that Stripe went ahead and built a private blockchain rather than trying to enhance an L2 on something open sourced

[Ty @tyfoster]

@tcosta Congrats!