Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your computer should say what you tell it to say

eff.org

Post reply on HN
Print view View original

51–60 of 263 posts

Re: Your computer should say what you tell it to say

#51

Post by soraminazuki »

judge2020 wrote: post #18
bayindirh wrote: post #14

Earlier quoted context omitted.

The problem is, this is very open (or even designed) to be abused by their implementers. It's akin to having only Microsoft as the Secure Boot key authority. Mobile devices already has tons of attestation features. Secure enclaves, security processors, cryptographic capabilities of SIM cards (e.g. I carry my private key inside my SIM card, and use it as a wet signature, legally). We do not need this tech which can an…

There were proposals for protecting against this in the WEI explainer under "Open Questions" https://github.com/RupertBenWiser/Web-Environment-Integrity/...

Some people can't help bringing this up in every WEI-related thread only to be debunked each time. This very article graciously mentions it and explains why it's a non-solution.

That "proposal" is doublethink in its purest form. WEI is a technology for restricting access to web services. But at the same time, it would try to prevent web service providers from doing exactly that?

Re: Your computer should say what you tell it to say

#52

Post by idle_zealot »

endisneigh wrote: post #25

I read the entire thing and it’s not clear how this reduces control of your own computer. It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong. > It also raises the barrier to entry for new browsers, something Google employees acknowledged in an unofficial explainer for the new feature, Web Environment Integrity (WEI). Th…

> it’s not clear how this reduces control of your own computer.

It eliminates a computer user's ability to have their user agent lie about the platform it's operating on. Such a capability is crucial for privacy and adversarial compatibility. Simple example: your bank of choice starts sniffing your UA string and refusing to serve Firefox, as they only test the site in Chrome and don't want to service support tickets for any other browsers. Presently you can spoof your UA string and visit the site with Firefox anyway. With WEI the bank site now has the technical means to ensure your browser accurately reports its identity and to refuse access to anything but Chrome.

I'm not necessarily claiming that this is how WEI will be used, but the point is it's now up to site operators to choose what makes a valid visitor, rather than the UA being just a transparent medium between you and a website (provided that each is implemented to spec).

Re: Your computer should say what you tell it to say

#53

Post by endisneigh »

zuminator wrote: post #43
endisneigh wrote: post #25

I read the entire thing and it’s not clear how this reduces control of your own computer. It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong. > It also raises the barrier to entry for new browsers, something Google employees acknowledged in an unofficial explainer for the new feature, Web Environment Integrity (WEI). Th…

It reduces control of my computer because without it my computer can identify itself to websites and advertisers in the way that I want, but with it, it can only use its TPM assigned identity. You can argue (I'd disagree) that it's a good thing that I can't make my computer spoof as something else, but unquestionably it does reduce my control.

This is wrong though. Wei doesn’t stop your ability to spoof, it stops your ability to be successful in spoofing.

Re: Your computer should say what you tell it to say

#54

Post by [deleted] »

benatkin wrote: post #30
cortesoft wrote: post #11

I agree with most of this, but one nit pick: > Originally, secure computing relied on a second processor - a "Technical Protection Module" or TPM - to monitor the parts of your computer you directly interact with. TPM stands for Trusted Platform Module, not Technical Protection Module

That's wild. It seems these blog posts are outsourced. Edit: I'm wrong about this one. It's an actual article, and a pretty good one at that. But it is either a mistake or they are introducing an alternate expansion for TPM (other acronyms have been given different sets of words).

[deleted]

Re: Your computer should say what you tell it to say

#55

Post by minsc_and_boo »

bayindirh wrote: post #14
tapoxi wrote: post #10

I mean, devil's advocate here, this tech already exists and the question is do we do client attestation in a browser or pretend remote attestation doesn't exist. If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? I'm not trying to argue in favor of WEI, I just think this doesn't magically disappear if Google doesn't implemen…

The problem is, this is very open (or even designed) to be abused by their implementers. It's akin to having only Microsoft as the Secure Boot key authority. Mobile devices already has tons of attestation features. Secure enclaves, security processors, cryptographic capabilities of SIM cards (e.g. I carry my private key inside my SIM card, and use it as a wet signature, legally). We do not need this tech which can an…

Noob question: Can you do attestation with mobile web, or is it app only?

Re: Your computer should say what you tell it to say

#56

Post by matheusmoreira »

tapoxi wrote: post #10

I mean, devil's advocate here, this tech already exists and the question is do we do client attestation in a browser or pretend remote attestation doesn't exist. If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? I'm not trying to argue in favor of WEI, I just think this doesn't magically disappear if Google doesn't implemen…

We choose neither of the options you presented. Instead we recognize that remote attestation is inherently abusive technology and ban it in all its forms. It should be illegal for any kind of service to ever require a "trusted client" in any context. Interoperability should be law whether they like it or not.

Re: Your computer should say what you tell it to say

#58

Post by freedomben »

nightpool wrote: post #26
tapoxi wrote: post #10

I mean, devil's advocate here, this tech already exists and the question is do we do client attestation in a browser or pretend remote attestation doesn't exist. If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? I'm not trying to argue in favor of WEI, I just think this doesn't magically disappear if Google doesn't implemen…

I would suggest reading the TAG's Web Platform Design Principles document, it does a really good job laying out why the web is different from mobile and native applications and the reasons why some APIs, like client attestation, work in a mobile environment but would damage the web platform if they're implemented. For example, the WEI proposal violates the "It should be safe to visit a web page" principle ( https://w…

Likewise, and that's the advice I give everyone. Most things are perfectly fine as a web page. The app offers no benefit to the user. It only benefits the app owner.

Re: Your computer should say what you tell it to say

#59

Post by wilsonnb3 »

zuminator wrote: post #43
endisneigh wrote: post #25

I read the entire thing and it’s not clear how this reduces control of your own computer. It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong. > It also raises the barrier to entry for new browsers, something Google employees acknowledged in an unofficial explainer for the new feature, Web Environment Integrity (WEI). Th…

It reduces control of my computer because without it my computer can identify itself to websites and advertisers in the way that I want, but with it, it can only use its TPM assigned identity. You can argue (I'd disagree) that it's a good thing that I can't make my computer spoof as something else, but unquestionably it does reduce my control.

> unquestionably it does reduce my control

It doesn't reduce your control, you are still welcome to identify your computer however you want to websites by using a browser without WEI or disabling it.

You will just have to live with the reality that a lot of servers aren't going to want to talk to your client.

Re: Your computer should say what you tell it to say

#60

Post by amusingimpala75 »

meragrin_ wrote: post #46
ChrisMarshallNY wrote: post #5

That's a very well-written explanation! I would hope that we see this kind of explanation more frequently.

Nope, not really. Still looks like the equivalent of anti-encryption people saying "think of the children". I still see no explanation on how WEI will magically change the behavior of website operators. They can already take steps to block unwanted clients, but no one is in any significant way which hinders the "open internet". WEI is meaningless unless Apple implements it. The only effect the current discussion will…

Maybe maybe it’s meaningless without Apple agreeing as things stand, because of iOS. But if the EU proposal about side loading forces Apple to allow Blink-Chrome instead of just WebKit-Chrome on iOS, then there’s not much holding Google back.
Post reply on HN