Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Environment Integrity API Proposal

github.com

Post reply on HN
Print view View original

111–120 of 460 posts

Re: Web Environment Integrity API Proposal

#111

Post by JeremyNT »

Previously:

https://news.ycombinator.com/item?id=36800789

https://news.ycombinator.com/item?id=36785516

https://news.ycombinator.com/item?id=36800744

https://news.ycombinator.com/item?id=36808231

https://news.ycombinator.com/item?id=36791711

https://news.ycombinator.com/item?id=36789691

https://news.ycombinator.com/item?id=36816208

https://news.ycombinator.com/item?id=35862886

By the HN guidelines this is a repost, but it would be a mistake IMO to delete it. This would mark the end of the open web, but for whatever reason this issue has never really bubbled to the surface here before. It feels like something is different this time.

Re: Web Environment Integrity API Proposal

#112

Post by freeone3000 »

jabbany wrote: post #25
freeone3000 wrote: post #16

Fork chromium and have it return true. Problem, websites?

It's signed? Sure you can fake the results of an attestation in your fork, but your fork would be using your own key to sign the response, a key that the site can reject.

Ah, we’ll also have to extract the key from chrome. It’s no worse than WideVine.

Re: Web Environment Integrity API Proposal

#113

Post by Buttons840 »

jabbany wrote: post #30
dmantis wrote: post #7

The literal attempt to censor web usage of Linux and BSD desktops, other FOSS clients, custom Android ROMs, etc with an open reasoning "to sell you ads". They don't even try to masquerade it.

Yeah I mean the first of their examples is literally: > Users like visiting websites that are expensive to create and maintain, but they often want or need to do it without paying directly. These websites fund themselves with ads, but the advertisers can only afford to pay for humans to see the ads, rather than robots. This creates a need for human users to prove to websites that they're human, sometimes through task…

> This creates a need for human users to prove to websites that they're human, sometimes through tasks like challenges or logins.

Is... is the Verification Can actually going to happen? https://i.kym-cdn.com/photos/images/original/000/983/286/ea5...

Re: Web Environment Integrity API Proposal

#114

Post by jbk »

rpastuszak wrote: post #80
jbk wrote: post #65

Earlier quoted context omitted.

> How can this view be with this spec, which he is the main author of? Surely Ben sees the parallels? It can be reconciled with love for money and total lack of moral fiber. Aka « I don’t give a shit about my actions destroying every one, as long as I go get paid »

I think it's very easy to treat people in such a binary manner. I get it. What this guy's doing is shameful, but I've seen dozens of otherwise lovely people, working for charities, spending much more time on socially-important and useful work than 90% of the crowd here... and the same people would push barely legal (if not illegal) targeting on masses of people, arguing to push cigarette ads in markets that still all…

> I think it's very easy to treat people in such a binary manner. I get it.

It’s not generally easy, but I think I’m in the position to say that.

The guy has the choice of company to work with and has the choice in the company and what department to work in.

Re: Web Environment Integrity API Proposal

#115

Post by troupo »

saurik wrote: post #5

This is pretty much the inevitable end-game of the web, in no small part funded by ad-based business models (as the analog gap pretty much destroys most attempts to use this stuff to do copy protection) and enabled by developers who have insisted we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) into the browse…

> we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) into the browser as possible.

"powerful-but-easy-to-code APIs for OS-level access" are actual hard-to-implement-right functionality that is often pushed to browsers with very little discussion or considerations.

Re: Web Environment Integrity API Proposal

#116

Post by troupo »

emilsedgh wrote: post #51
spystath wrote: post #20

Earlier quoted context omitted.

> how do we protest this? You do not and you cannot. It was written in stone once Chrome dominated the browser market. What Chrome (Google) wants, Chrome (Google) gets. Despite all the good engineering Google wants to sell ads, that's all there is to it. And the result is this proposal. > The saving grace here might be that Firefox won't implement the proposal. It's irrelevant and we are an irrelevant minority. Unles…

This is not the right attitude. Google wanted AMP. Google didn't get AMP. AMP is dead.

Before it died it crippled the web, the search, publishers' ad revenues etc.

Re: Web Environment Integrity API Proposal

#117

Post by apostacy »

enumjorge wrote: post #54
tentacleuno wrote: post #13

Earlier quoted context omitted.

> who is finally putting their foot down and deciding that we are all going to be forced to either used fully-locked down devices The person who wrote the proposal[0] is from Google. All the authors of the proposal are from Google[1]. I've been thinking carefully about this comment, but I really don't know what to say. It's absolutely heartbreaking watching something I really care about die by a thousand cuts; how do…

> The saving grace here might be that Firefox won't implement the proposal. As others have said, FF doesn't have a lot of leverage left to influence those type of decisions, but Safari might. Not sure what their position is on this proposal. The one pager has a section on stakeholder feedback [0], but doesn't name them for some reason. [0] https://github.com/RupertBenWiser/Web-Environment-Integrity/...

Looking at it in terms of leverage and market-share is a huge mistake that Mozilla keeps making. Mozilla doesn't have a platform like Google does. What exactly is Mozilla even competing for? Popularity?

They should hunker down and make the best browser they can, implementing their best web. It worked 20 years ago, and in many ways the circumstances are the same. We have tech monopolies proposing ludicrous "content security" mechanisms. Where would Mozilla have been if they tried making some sort of half baked "less evil" form of Microsoft Janus DRM[1]?

People are going to get sick of how intrusive DRM is becoming, and there should be an alternative waiting for them.

Every person who has content they thought they purchased "expire" and be erased from their device, or who can no longer use their expensive projector after the latest mandatory update.

I evangelized heavily for Firefox in the 1.x days. People were sick of IE6, and were glad to have Firefox. I worked at a computer store and probably converted 100+ people.

[1]: https://en.wikipedia.org/wiki/Janus_(DRM)

Re: Web Environment Integrity API Proposal

#118

Post by Buttons840 »

andrethegiant wrote: post #100
leodriesch wrote: post #17

Earlier quoted context omitted.

They seem to have closed down comments on it, I'm seeing > An owner of this repository has limited the ability to comment to users that have contributed to this repository in the past.

> I’m giving everyone a heads up that I’m limiting comments to contributors over the weekend so that I can try to take a breath away from GitHub. I will reopen them after the weekend https://github.com/RupertBenWiser/Web-Environment-Integrity/...

The firestorm will be worse by then. I predict this RFC will not allow comments.

Re: Web Environment Integrity API Proposal

#119

Post by gizmo686 »

riffraff wrote: post #37
tapoxi wrote: post #15

Earlier quoted context omitted.

I mean Firefox caved to support EME. This isn't the early days of the web anymore either, the enthusiasts are a small minority of global web traffic that this will probably succeed even with a large scale boycott.

I think in this case Firefox is in a different position: if it didn't support EME netflix wouldn't work. But in this case it could report "sure, this is a real user alright" by being its own attester, can't it?

That depends on how the attestation is done.

If done correctly, TPMs on every computer would be preloaded with signing keys (probably microsoft). The web browerser would then ask the TPM to sign the Platform Configuration Registers, which are a hash of a challenge nonce, the system firmware/kernel/configuration/etc. This signature is then sent (along with a description of the system configuration) to an external attester. This external attester validates that:

A) the claimed configuration is "secure" (trusted kernel, bootloader, browser, etc) and

B) The TPM's signature attests to the configuration.

The validator then generates its own signed message that can be sent to the server.

In practice, I think this is logistically unworkable in todays computing environment. But with enough big players pushing for it, I don't see anything fundamentally impossible.

Re: Web Environment Integrity API Proposal

#120

Post by benatkin »

It's an Orwellian name, but makes a certain amount of sense. That's the most effective kind of Orwellian name.

Even still, I think that it is wrong to give something a convenient name that espouses some virtue. They should have chosen something like Web Environment Verification API.

I think it's spyware, and I don't like it. It reminds me of the Stripe API, where you have to run some JavaScript on your site that snoops on your interactions and reports stuff to Stripe that it uses to detect fraud. https://news.ycombinator.com/item?id=22937303

Post reply on HN