Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your computer should say what you tell it to say

eff.org

Post reply on HN
Print view View original

21–30 of 263 posts

Re: Your computer should say what you tell it to say

#21

Post by realusername »

tapoxi wrote: post #10

I mean, devil's advocate here, this tech already exists and the question is do we do client attestation in a browser or pretend remote attestation doesn't exist. If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? I'm not trying to argue in favor of WEI, I just think this doesn't magically disappear if Google doesn't implemen…

> If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app?

The way forward is getting it removed in mobile devices as well.

Re: Your computer should say what you tell it to say

#22

Post by minerva23 »

barbariangrunge wrote: post #7

Remember: upvoting the EFF's articles is good, but you (yes, you!) can also donate to them to help with these campaigns!

I had donated to the EFF in the past, but their stance[1] that CDNs/hosted services shouldn't be allowed to choose the customers they are willing work with is not only wrong, it's causes harm[2].

[1] https://www.eff.org/press/releases/international-coalition-r...

[2] https://blog.cloudflare.com/kiwifarms-blocked/

Re: Your computer should say what you tell it to say

#24

Post by no_wizard »

hgomersall wrote: post #20
no_wizard wrote: post #17

EDIT: Originally posited an incorrect fact here. I completely missed who wrote the article at hand (not sure why, but I didn't see the authors names) Good catch everyone

I'm puzzled by your comment. This is literally the article by him....

I completely missed it, edited in kind. thanks!

Re: Your computer should say what you tell it to say

#25

Post by endisneigh »

I read the entire thing and it’s not clear how this reduces control of your own computer.

It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong.

> It also raises the barrier to entry for new browsers, something Google employees acknowledged in an unofficial explainer for the new feature, Web Environment Integrity (WEI).

This, however, is true for sure.

At the end of the day, even if WEI is implemented it wouldn’t necessarily get rid of an open web as it’s entirely optional. Those who implement it are those who are not interested in an “open web” to begin with and definitionally were never going to support it anyways.

Re: Your computer should say what you tell it to say

#26

Post by nightpool »

tapoxi wrote: post #10

I mean, devil's advocate here, this tech already exists and the question is do we do client attestation in a browser or pretend remote attestation doesn't exist. If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? I'm not trying to argue in favor of WEI, I just think this doesn't magically disappear if Google doesn't implemen…

I would suggest reading the TAG's Web Platform Design Principles document, it does a really good job laying out why the web is different from mobile and native applications and the reasons why some APIs, like client attestation, work in a mobile environment but would damage the web platform if they're implemented. For example, the WEI proposal violates the "It should be safe to visit a web page" principle (https://www.w3.org/TR/design-principles/#safe-to-browse):

    When adding new features, design them to preserve the user expectation that visiting a web page is generally safe.
    
    The Web is named for its hyperlinked structure. In order for the web to remain vibrant, users need to be able to expect that merely visiting any given link won’t have implications for the security of their computer, or for any essential aspects of their privacy.
    
    For example, an API which allows any website to detect the use of assistive technologies may make users of these technologies feel unsafe visiting unknown web pages, since any web page may detect this private information.
    
    If users have a realistic expectation of safety, they can make informed decisions between Web-based technologies and other technologies. For example, users may choose to use a web-based food ordering page, rather than installing an app, since installing a native app is riskier than visiting a web page.
I know a lot of savvy, non-technical users who absolutely refuse to install mobile apps on their phone except from the most trusted of sources, and I think this principle is a good structural framework for reasoning through why users still prefer the web.

Re: Your computer should say what you tell it to say

#27

Post by bayindirh »

judge2020 wrote: post #18
bayindirh wrote: post #14

Earlier quoted context omitted.

The problem is, this is very open (or even designed) to be abused by their implementers. It's akin to having only Microsoft as the Secure Boot key authority. Mobile devices already has tons of attestation features. Secure enclaves, security processors, cryptographic capabilities of SIM cards (e.g. I carry my private key inside my SIM card, and use it as a wet signature, legally). We do not need this tech which can an…

There were proposals for protecting against this in the WEI explainer under "Open Questions" https://github.com/RupertBenWiser/Web-Environment-Integrity/...

I skimmed the link you provided, thanks.

It looks like they propose to mix false signals to prevent this from being abused, but oh. That's easy to bypass. Require two attestations back to back to see whether they differ, or put up a page saying, "can you please try again?"

The open question is circling around the question, can we make it work in a way, such that it doesn't work for bad guys, but works for good guys.

Mathematics & cryptography doesn't work like that. It doesn't discriminate. It levels everyone. It'll either become an iron fist or a Swiss Cheese. There can be no middle. This is maths.

Re: Your computer should say what you tell it to say

#28

Post by surajrmal »

mistrial9 wrote: post #3
local_issues wrote: post #2

The EFF stands alone in its commitment to actually speaking truth to power. The ACLU has become just another arm of the DNC, same with the SPLC etc - repeating CNN-esque talking points. Same with the NRA - milquetoast arm of those in power. The EFF will go after orgs that fund it, which requires true compunction. FIRE is a good replacement for the ACLU, FYI. And John Brown Gun Club is becoming a better NRA.

that's all great but you realize a lot of readers here are not USA, eh? "web-TPM" needs to be named-and-shamed among literate people in all nations IMHO. It is clearly political -- there are private winners and public losers in the change to locked and enforced access to digital content on the Internet. Any commercial company in any country that can successfully block the roads and check ID will make money, and they…

Your ability to mischaracterize it as "webtpm" makes me question your credibility entirely. It's fine to be opposed to the proposal, but it would be best to stay truthful and not exaggerate.

Re: Your computer should say what you tell it to say

#29

Post by alexpotato »

ceroxylon wrote: post #23

Would it be possible for attackers/fraudsters to just set up "proxy farms" of real hardware that provide the device details for attestation? It would make bots less efficient but surely the incentive for ad fraud would still exist and adaptations would be made.

This comment made me think of the videos of scammers with racks upon racks of cheap cell phones.

They are all legitimate phones and labor is cheap so it's easier to just do that rather than try to create script to click on ads etc.

Re: Your computer should say what you tell it to say

#30

Post by benatkin »

cortesoft wrote: post #11

I agree with most of this, but one nit pick: > Originally, secure computing relied on a second processor - a "Technical Protection Module" or TPM - to monitor the parts of your computer you directly interact with. TPM stands for Trusted Platform Module, not Technical Protection Module

That's wild. It seems these blog posts are outsourced.

Edit: I'm wrong about this one. It's an actual article, and a pretty good one at that. But it is either a mistake or they are introducing an alternate expansion for TPM (other acronyms have been given different sets of words).

Post reply on HN