Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your computer should say what you tell it to say

eff.org

Post reply on HN
Print view View original

171–180 of 263 posts

Re: Your computer should say what you tell it to say

#171

Post by pdonis »

minsc_and_boo wrote: post #55
bayindirh wrote: post #14

Earlier quoted context omitted.

The problem is, this is very open (or even designed) to be abused by their implementers. It's akin to having only Microsoft as the Secure Boot key authority. Mobile devices already has tons of attestation features. Secure enclaves, security processors, cryptographic capabilities of SIM cards (e.g. I carry my private key inside my SIM card, and use it as a wet signature, legally). We do not need this tech which can an…

Noob question: Can you do attestation with mobile web, or is it app only?

Sure, if your mobile device is only allowed to use "approved" web browsers. Which is one of the key harms to users that the proposed WEI standard will inflict.

Re: Your computer should say what you tell it to say

#172

Post by pdonis »

wmf wrote: post #77
bayindirh wrote: post #27

Earlier quoted context omitted.

I skimmed the link you provided, thanks. It looks like they propose to mix false signals to prevent this from being abused, but oh. That's easy to bypass. Require two attestations back to back to see whether they differ, or put up a page saying, "can you please try again?" The open question is circling around the question, can we make it work in a way, such that it doesn't work for bad guys, but works for good guys.…

We can't even agree on who the good guys and bad guys are. Is a bank bad for excluding certain browsers?

> Is a bank bad for excluding certain browsers?

Yes, because it's stupid; they don't need to. The bank cares about correctly identifying who I am, not what client I am using. Nor do they exclude certain browsers because those browsers make it easier for a user to lie about who they are; they don't. Banks exclude certain browsers because their technically incompetent coders convinced their technically incompetent managers to do so.

Re: Your computer should say what you tell it to say

#173

Post by iraqmtpizza »

NoGravitas wrote: post #111
charcircuit wrote: post #71

>You can choose not to send this to the remote server, but you lose the ability to send an altered or randomized description of your device and its software if you think that's best for you. The EFF is being misleading here by conflating the attestation taken and fingerprintable information like a user agent. An attestation taken does not contain information about the device that can be used to identify since the dat…

> "End users are not the only stakeholders in the web." Wrong. RFC 8890 clearly states that the internet is for end users. https://www.rfc-editor.org/rfc/rfc8890.html

google is free to make a separate global network called the internot

Re: Your computer should say what you tell it to say

#174

Post by no_time »

chabad360 wrote: post #48
judge2020 wrote: post #12

Earlier quoted context omitted.

So much better written than the articles that were at the top of HN originally. People somehow thought this would mean checking for ad block? The original proposal specifically called out that browser extensions are completely unrelated to WEI, which just calls into existing OS and TPM-based attestation APIs and makes the status of this attestation available to sites.

> People somehow thought this would mean checking for ad block? No, the worry about adblock was that Google could now just remove the ability for that work in chrome and there would be nothing you could do, because your forked chromium wouldn't pass the attestation check (cause it would never be blessed by Google). This concern extends to other browsers as well. Because Google is making themselves the signing authori…

Not sure why you were downvoted. This is the exact scenario that will unfold in the mid term future.

Not to mention that chrome on android already does not have any access to extensions and thus adblocking. Isn't that awfully convenient? For GOOG that is.

Re: Your computer should say what you tell it to say

#175

Post by rzzzt »

wincy wrote: post #69
oaktrout wrote: post #34

Earlier quoted context omitted.

Or written with help from chat gtp, I've seen it hallucinate similar mistakes before.

Ah actually it is ChatGPT, you’ve made a common mistake. Perhaps you are an AI? As we all know, ChatGPT stands for “Chat General Purpose Tool”, as it is an artificial general intelligence.

I beg to differ, it is "Chat Guanosine TriPhosphate", a talkative nucleotide composed of guanine and three phosphate groups (the tri- prefix indicates three of something).

Re: Your computer should say what you tell it to say

#176

Post by flangola7 »

amadeuspagel wrote: post #161
freedomben wrote: post #93

I think a realistic description/story from real experience I've had as a security engineer might help some people understand why this will end up so bad. I've worked with banks, who are among the most security-minded of organizations. It's not because they're security nerds, it's because the cost of getting hacked is astronomical, and because regulations require them to be "as secure as possible." Banks won't be chom…

Right now, many banks require a mobile app, which can only be installed from an app store, which is only available on devices that you don't control. Even if they have a web interface, you need the mobile app to login.

What banks are those? My grandma isn't going to buy a smartphone to use her bank.

Re: Your computer should say what you tell it to say

#177

Post by hot_gril »

local_issues wrote: post #156
wwalexander wrote: post #6

Earlier quoted context omitted.

While I agree that the ACLU has become defanged, there are many more civil liberties to protect beyond simply free speech, which seems to be the only concern of FIRE.

I agree with you, but I don't see a big attack on freedom of religion, assembly (post COVID) or movement lately. Freedom of Speech is under massive, coordinated attack by gigacorporations and https://freddiedeboer.substack.com/p/please-just-fucking-tel...

Covid wasn't very long ago. But yeah, I'm fine with an org deciding to focus on speech.

Re: Your computer should say what you tell it to say

#178

Post by [deleted] »

yomlica8 wrote: post #118
tornato7 wrote: post #45

Earlier quoted context omitted.

Yes, but in theory if suspicious behavior was detected those devices could be permanently blacklisted from a website, making the investment challenging. If WEI goes through we'll probably see cheap PCs popping up on eBay that are unable to access certain websites.

You thought having your google account banned was bad now, wait until they ban all associated hardware with a heuristic routine and most of the web doesn't work for you anymore. That should really cut down on the account support requests they didn't want to deal with.

[deleted]

Re: Your computer should say what you tell it to say

#179

Post by convolvatron »

charcircuit wrote: post #71

>You can choose not to send this to the remote server, but you lose the ability to send an altered or randomized description of your device and its software if you think that's best for you. The EFF is being misleading here by conflating the attestation taken and fingerprintable information like a user agent. An attestation taken does not contain information about the device that can be used to identify since the dat…

your business model involves selling ads. but its being undermined by fraud. you should be able to _change the internet_ so the business model makes sense again.

Re: Your computer should say what you tell it to say

#180

Post by ToValueFunfetti »

semi wrote: post #151
zuminator wrote: post #43

Earlier quoted context omitted.

It reduces control of my computer because without it my computer can identify itself to websites and advertisers in the way that I want, but with it, it can only use its TPM assigned identity. You can argue (I'd disagree) that it's a good thing that I can't make my computer spoof as something else, but unquestionably it does reduce my control.

the better argument is just flipping the perspective. if your computer runs a web server this increase the control because without it other computers can connect to it and lie about their identity. that's not to say I think this is a good thing, I just don't think control over your computer is a good argument when both sides of a connection are computers, and both operators want not just control over their computer b…

>without it other computers can [...] lie about their identity

That's the point, I think. I own my computer, which means I decide whether it lies. If I want to serve "This website only works in Chrome" when it's actually cross-platform, that's my right. I might want the client to open the page in Chrome automatically, and I would have more control over the connection if I could do so, but that control would be over the client's computer. It's not a question of getting more or less control in general, but of getting rightful control over my own property.

> both operators want not just control over their computer but also what the other computer can do

Are you saying that my demand to not have a server control what my client does is an act of control over what their computer does? Like if I told you not to use your forklift to take my stuff, I'm asserting power over your property?

Post reply on HN