argv[-1]argv_minus_one@mastodon.sdf.org
Oct 14, 2026, 8:02 PMGood to hear, but still, see my second paragraph. Though this state of affairs appears positive, I would consider it temporary.
Replies
Scott HelmeScottHelme@infosec.exchangeOct 14, 2026, 8:32 PMThere's something I'm missing. Why would any site start requiring attestation? What's the perceived benefit to them that you're seeing that would drive that?
- argv[-1]argv_minus_one@mastodon.sdf.orgOct 14, 2026, 9:24 PM
“Security” is the usual excuse.
See, for example, the EUDI Wallet app. It requires a certified proprietary device, for “security” reasons. Even though the credentials it stores are yours and no one else's, it will not run on, for example, a device running /e/OS. Because it's not “secure”.
Obviously there's some ulterior motive at work, but what exactly that is, I don't know. All I know is what the public-facing excuse is, and that it's obviously false.