Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Environment Integrity Explainer

github.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: Web Environment Integrity Explainer

#21

Post by howinteresting »

gjsman-1000 wrote: post #13
hooverd wrote: post #11

Earlier quoted context omitted.

Trusted computing is all about ensuring that your machine is trusted to run payloads and you can't observe or interact with them. Sad! I see why the free software people call it treacherous computing

Shameless plug for the article I wrote 1 year ago now, "Remote Attestation Is Coming Back," which warned that this was coming to the web and had quite a discussion about that idea: https://news.ycombinator.com/item?id=32282305

Thank you for writing this. Remote attestation for consumer software is such a disturbing idea.

In the past the main adversarial pressure has been exploiting security vulnerabilities ("jailbreaking"), but the software industry is getting its act together re that.

Re: Web Environment Integrity Explainer

#22

Post by thesuperbigfrog »

Google marketing exec: "We need to lock down web browsers so we can make more money by showing ads."

"Ad blockers need to be prevented. The new WEIE APIs will ensure that ad blockers aren't running and that no DRM is being compromised."

"We also want to prevent ad fraud. With WEIE we can ensure that ad clicks are legit and that people are watching the ads we show. If we can't control the operating system like we can on Chromebooks and Android phones, then we need to control the web browser with cryptographic certainty."

Re: Web Environment Integrity Explainer

#23

Post by thesuperbigfrog »

jchw wrote: post #2

Absolute worst spec I've ever seen. Google needs to be loaded into a cannon and fired into the sun. > How does this affect browser modifications and extensions? > Web Environment Integrity attests the legitimacy of the underlying hardware and software stack, it does not restrict the indicated application’s functionality: E.g. if the browser allows extensions, the user may use extensions; if a browser is modified, the…

>> I don't believe they're being honest with how this will be used.

Getting browsers to adopt and implement Web Environment Integrity is Step 1.

Step 2 is where all Google web sites start requiring Web Environment Integrity to be used or they lock you out of the site.

Step 3 is where all websites serving Google ads require Web Environment Integrity to be used.

Step 4 Profit!

This is the beginning of the further DRM-ification and enshittification of the Web.

Re: Web Environment Integrity Explainer

#24

Post by jchw »

gjsman-1000 wrote: post #13
hooverd wrote: post #11

Earlier quoted context omitted.

Trusted computing is all about ensuring that your machine is trusted to run payloads and you can't observe or interact with them. Sad! I see why the free software people call it treacherous computing

Shameless plug for the article I wrote 1 year ago now, "Remote Attestation Is Coming Back," which warned that this was coming to the web and had quite a discussion about that idea: https://news.ycombinator.com/item?id=32282305

I remember this article! And of course, nothing has improved. It's ironic that in 1992, software publishers proclaimed that piracy would be the end of the computer age in the classic "Don't Copy That Floppy!" campaign. To me, it seems like nearly the opposite thing is going to end the computer age: integrity checking. Most computers are toys that we lease from companies that are bigger and more influential than governments, and using it in ways they don't like is against the law.

Re: Web Environment Integrity Explainer

#25

Post by ollien »

jchw wrote: post #2

Absolute worst spec I've ever seen. Google needs to be loaded into a cannon and fired into the sun. > How does this affect browser modifications and extensions? > Web Environment Integrity attests the legitimacy of the underlying hardware and software stack, it does not restrict the indicated application’s functionality: E.g. if the browser allows extensions, the user may use extensions; if a browser is modified, the…

> I can make modified bot browser that commits ad fraud as long as I don't use a rooted Android phone?

Yeah, this just incentivizes spammers to copy the parts of Chromium that do the attestation (or whatever browser has source available), and use that to pretend they're Chromium. There will always be workarounds. This seems to kill innovation and allow spammers to flourish.

I suppose I can understand an argument that they want to prevent scraping, but this is absolutely not going to stop that.

Re: Web Environment Integrity Explainer

#26

Post by Aerbil313 »

thesuperbigfrog wrote: post #23
jchw wrote: post #2

Absolute worst spec I've ever seen. Google needs to be loaded into a cannon and fired into the sun. > How does this affect browser modifications and extensions? > Web Environment Integrity attests the legitimacy of the underlying hardware and software stack, it does not restrict the indicated application’s functionality: E.g. if the browser allows extensions, the user may use extensions; if a browser is modified, the…

>> I don't believe they're being honest with how this will be used. Getting browsers to adopt and implement Web Environment Integrity is Step 1. Step 2 is where all Google web sites start requiring Web Environment Integrity to be used or they lock you out of the site. Step 3 is where all websites serving Google ads require Web Environment Integrity to be used. Step 4 Profit! This is the beginning of the further DRM-i…

No one can control the web unless every personal computing device on earth is closed source down to the hardware. Digital technology is a double edged sword. I agree that Google would definitely want complete control, but they just can’t do that. We’ll most likely rather see deglobalization of the web with trust shifting from FAANG to states.

Re: Web Environment Integrity Explainer

#27

Post by nicolas_17 »

reportgunner wrote: post #8

What if I tell my browser to not respond to these attestation requests? What about all the people who have an outdated browser and don't know how to update it? edit: One of the goals addresses this[0]: Continue to allow web browsers to browse the Web without attestation

Maybe you'll just have to fill a captcha on every other request, but technically you're still allowed to browse the web (:

Re: Web Environment Integrity Explainer

#28

Post by paulddraper »

predictabl3 wrote: post #20

I would love to know the personal motivations and moral feelings of those who work on features like this. Are they naive about how these features will be used? Do they not care? Do they not have a personal sense of responsibility for contributing to the end of open, free computing? It's been a while since I took a Big Tech paycheck, but I don't remember being this willing to go build nightmare tech when I was getting…

All of the above. Whatever puts food on the table and gas in the car

Re: Web Environment Integrity Explainer

#29

Post by llimos »

bitwize wrote: post #5
akyuu wrote: post #3

The first use case they mention is restricting ad fraud (and, presumably, ad blocking): > Users like visiting websites that are expensive to create and maintain, but they often want or need to do it without paying directly. These websites fund themselves with ads, but the advertisers can only afford to pay for humans to see the ads, rather than robots. This creates a need for human users to prove to websites that the…

"Your contract with the network when you get the show is, you're going to watch the spots. Otherwise you couldn't get the show on an ad-supported basis. Anytime you skip a commercial or watch the button you're actually stealing programming." Jamie Kellner's words still ring true today. When corporations make content available supported by advertisements, they are assuming a moral obligation on your part to see those…

You don't have a contract with the network. The advertisers do. The network is committed to deliver audiences to the advertisers in return for money. The way they do this is by showing content that the audience wants to watch. You don't owe neither of them nowt.

Re: Web Environment Integrity Explainer

#30

Post by funcDropShadow »

mike_hearn wrote: post #18
hooverd wrote: post #11

Earlier quoted context omitted.

Trusted computing is all about ensuring that your machine is trusted to run payloads and you can't observe or interact with them. Sad! I see why the free software people call it treacherous computing

TC is value neutral so the FSF slurs don't make sense. Consider what happens when the machine in question is a cloud VM. Then you can run workloads on a rented machine without the risk of the cloud vendor spying on or tampering with your server. Likewise if the machine gets hacked. These are highly desirable properties for many people. For example Signal uses TC so the mobile apps can verify the servers before doing…

> TC is value neutral so the FSF slurs don't make sense

Trusted computing is often used such that one might think, it implies the user can trust something (his computer). But it is the other way around. A service provider can trust a machine - that a user bought -- to not do what the user wants. That is misleading at best.

Post reply on HN