Remote Attestation is coming back
Is there any way we can make Remote Attestation providers liable for any losses incurred while using their services? Can we make it so that banks, record companies, and individuals can sue Microsoft or Google if their system doesn&#x27;t deliver on the promise? If we still see cheating in on-line gaming even though all machines are attested, can we we get our money back?<p>I feel like part of the problem is that Remote Attestation providers get to have their cake and eat it too: they make a theme park, set up boundaries, and charge admission under the premise that it&#x27;s safer to play in their walled garden than in a public park.<p>But if a bad actor slips through their gate and picks a few pockets or kidnaps a couple children, the operators get to say &quot;not our problem, our services have no warranty -- read the EULA&quot;.<p>I feel like in the real world, if a park operator explicitly bills itself as &quot;a safe place to play&quot; it&#x27;s their problem if someone goes on a crime spree on their property -- there is some duty to deliver on the advertised safety promise.<p>But somehow, in the software world people can control admission, control what you do <i>and</i> somehow have no liability if things still go off the rails. It&#x27;s just a sucker&#x27;s game.<p>Of course, I&#x27;d rather not see remote attestation happen, but maybe part of the reason it keeps creeping back is exactly because there is zero legal downside to making security promises that can&#x27;t be kept, but incredible market advantages if they can sucker enough people to believe in the scheme.