Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your computer should say what you tell it to say

eff.org

Post reply on HN
Print view View original

91–100 of 263 posts

Re: Your computer should say what you tell it to say

#91

Post by caskstrength »

endisneigh wrote: post #25

I read the entire thing and it’s not clear how this reduces control of your own computer. It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong. > It also raises the barrier to entry for new browsers, something Google employees acknowledged in an unofficial explainer for the new feature, Web Environment Integrity (WEI). Th…

> I read the entire thing and it’s not clear how this reduces control of your own computer.

Requiring to run a software stack signed by a third-party to access a basic Web page definitely reduces my control over my own computer.

> It seems the premise is that those with a computer should be able to access others servers wholesale unconditionally. This premise is obviously wrong.

That is not the premise since you can already run a closed-club server and only provide accounts to people you want with whichever conditions you chose. You just not entitled to verify the software that clients run.

> At the end of the day, even if WEI is implemented it wouldn’t necessarily get rid of an open web as it’s entirely optional. Those who implement it are those who are not interested in an “open web” to begin with and definitionally were never going to support it anyways.

This will be forced on the Web by ad networks. For our own good and to prevent fraud by the bots of course.

Re: Your computer should say what you tell it to say

#92

Post by RobotToaster »

cortesoft wrote: post #11

I agree with most of this, but one nit pick: > Originally, secure computing relied on a second processor - a "Technical Protection Module" or TPM - to monitor the parts of your computer you directly interact with. TPM stands for Trusted Platform Module, not Technical Protection Module

Probably just an attempt at a more accurate acronym, like digital restrictions management for DRM.

Re: Your computer should say what you tell it to say

#93

Post by freedomben »

I think a realistic description/story from real experience I've had as a security engineer might help some people understand why this will end up so bad.

I've worked with banks, who are among the most security-minded of organizations. It's not because they're security nerds, it's because the cost of getting hacked is astronomical, and because regulations require them to be "as secure as possible."

Banks won't be chomping at the bit to implement WEI because they hate the open web or they hate Linux users. They'll be chomping at the bit because if they don't it will be a liability, and a "you're not doing all you can for security" type of risk that can open them to lawsuits, regulatory punishments, and even higher insurance costs. WEI is not a requirement right now because it doesn't exist. Once it exists though, you can be sure it will become a standard practice requirement, and anyone arguing against it might as well be arguing that using CC cameras is a privacy invasion: they'll seem absurd and won't last long in that position.

In short order it will be implemented by all the CDNs like Cloudflare, and it will be a simple checkbox for site owners to add to their site. Failure to implement this would be a fiduciary disaster, so they will have no choice. Once that is there, nobody who cares at all about security for their site (which is pretty much all people) are going to uncheck that box.

Re: Your computer should say what you tell it to say

#94

Post by sharemywin »

nologic01 wrote: post #42

> A handful of companies have established chokepoints between buyers and sellers, performers and audiences, workers and employers, as well as families and communities. When those companies refuse to deal with you, your digital life grinds to a halt This short paragraph summarizes the (ex-ante) improbably unusual situation we have drifted into. The negatively affected stakeholders being enumerated are more or less the…

We need rules that make it easier to transfer data(including addresses), control your own privacy, more compatible options for storing, searching, sorting, ranking, filtering data.

Re: Your computer should say what you tell it to say

#95

Post by sharemywin »

clucas wrote: post #89
nologic01 wrote: post #42

> A handful of companies have established chokepoints between buyers and sellers, performers and audiences, workers and employers, as well as families and communities. When those companies refuse to deal with you, your digital life grinds to a halt This short paragraph summarizes the (ex-ante) improbably unusual situation we have drifted into. The negatively affected stakeholders being enumerated are more or less the…

> as if they already operate effective mind control at systemic scale. If the logical conclusion of your reasoning is a mass mind control conspiracy, you should revisit your assumptions. > somehow they can bully into submission basically the entire universe I don't think anyone is bullying all of society. I think most people just don't care. It's really not that crazy, no mind control involved. Just good old fashione…

it's like any kind of other long tail problem. if it doesn't directly effect you or someone you know you generally don't care about it too much as an aggregate.

Re: Your computer should say what you tell it to say

#96

Post by seabass-labrax »

This is one of the most detailed and balanced articles I have read so far on the topic. However, like every other one I've read, it omits one very important clarification about 'Web Environment Integrity':

It is not part of the Web. This is exclusively a Google draft for a Google Chrome feature, and whilst Google is a member of the World Wide Web Consortium (W3C), they are not doing this as a member. I don't believe such a proposal would get even as far as a working group charter, given how limited it is to Google's interests. The only reason that it's a threat to the Web is because of their overwhelming market dominance, which is approaching a monopoly already.

I fear that the prominent use of the term 'Web' in this kind of document is tarnishing the reputation of the W3C, who have a solid process[1] to avoid pursuing these short term interests when they come with the risk of long term damage to the openness of the Web.

[1]: https://www.w3.org/Consortium/Process/

Re: Your computer should say what you tell it to say

#97

Post by JohnFen »

freedomben wrote: post #93

I think a realistic description/story from real experience I've had as a security engineer might help some people understand why this will end up so bad. I've worked with banks, who are among the most security-minded of organizations. It's not because they're security nerds, it's because the cost of getting hacked is astronomical, and because regulations require them to be "as secure as possible." Banks won't be chom…

> Once it exists though, you can be sure it will become a standard practice requirement

Yes, this seems inevitable. At which point, I will no longer be using the bank's website.

> they'll seem absurd and won't last long in that position.

I'm not sure what you mean here, though. People who object to ubiquitous surveillance don't seem absurd to most (even those who aren't so upset about it), and they certainly aren't changing their position.

Re: Your computer should say what you tell it to say

#98

Post by zb3 »

charcircuit wrote: post #71

>You can choose not to send this to the remote server, but you lose the ability to send an altered or randomized description of your device and its software if you think that's best for you. The EFF is being misleading here by conflating the attestation taken and fingerprintable information like a user agent. An attestation taken does not contain information about the device that can be used to identify since the dat…

> WEI doesn't prevent you from participating in the web or needing to meet someone else's specification. You can even make an attestation service for your own browser.

As always, Google will do its best to ensure it PRACTICALLY does, while denying it at the same time by pointing out that "you can make your own Google".

> because the physical analog, fraud, is illegal,

I don't know about the US, but in Poland abusive and anticompetitive clauses are not enforceable. Lying about the device seems to be the digital equivalent.

Re: Your computer should say what you tell it to say

#99

Post by freedomben »

JohnFen wrote: post #97
freedomben wrote: post #93

I think a realistic description/story from real experience I've had as a security engineer might help some people understand why this will end up so bad. I've worked with banks, who are among the most security-minded of organizations. It's not because they're security nerds, it's because the cost of getting hacked is astronomical, and because regulations require them to be "as secure as possible." Banks won't be chom…

> Once it exists though, you can be sure it will become a standard practice requirement Yes, this seems inevitable. At which point, I will no longer be using the bank's website. > they'll seem absurd and won't last long in that position. I'm not sure what you mean here, though. People who object to ubiquitous surveillance don't seem absurd to most (even those who aren't so upset about it), and they certainly aren't c…

Hey John, I love that we are in the same threads on HN so much :-D

> I'm not sure what you mean here, though. People who object to ubiquitous surveillance don't seem absurd to most (even those who aren't so upset about it), and they certainly aren't changing their position.

Yeah good question/clarification, I'm referring to the CCTV cameras in the bank itself (such as in the vault, in the lobby, etc).

Re: Your computer should say what you tell it to say

#100

Post by fallingknife »

minerva23 wrote: post #22
barbariangrunge wrote: post #7

Remember: upvoting the EFF's articles is good, but you (yes, you!) can also donate to them to help with these campaigns!

I had donated to the EFF in the past, but their stance[1] that CDNs/hosted services shouldn't be allowed to choose the customers they are willing work with is not only wrong, it's causes harm[2]. [1] https://www.eff.org/press/releases/international-coalition-r... [2] https://blog.cloudflare.com/kiwifarms-blocked/

You are essentially saying that we should have to ask permission from large corporations to be able to effectively run a website. For all practical purposes that means no free speech on the internet.
Post reply on HN