Earlier quoted context omitted.
What about Safari? It has significant market share. Seems like our best bet now
Already does device attestation. https://www.macrumors.com/how-to/how-to-bypass-website-captc...
[deleted]
Web Environment Integrity API Proposal
291–300 of 460 posts
Re: Web Environment Integrity API Proposal
#292Earlier quoted context omitted.
> That's already true of the web without this API. It doesn't change anything in regards to that. I fully disagree, I don't see how anyone could credibly make this claim. The web is open and customizable and neutral in a way that native platforms are not. Part of that is full device and OS neutrality where customizations and forks of browser engines do not generally[0] signal untrustworthiness to website operators. A…
>I don't see how anyone could credibly make this claim >device controlled A website is limited in what it can do by the browser it runs in. >unmodifiable Since responses are generated server side you can not modify what they send you. >broken on nonaproved hardware There are existing sites which don't support Linux or don't support mobile devices. >true neutrality of OS and hardware is incompatible with attestation A…
> Since responses are generated server side you can not modify what they send you.
You cannot modify what they send you, but you can and should modify the data received within your own computer, so that the program can receive and deal with modified data.
However, it ought to be possible to do so without needing to decrypt and encrypt it. The web browser should be able to use insecure proxies even for secure protocols so that you do not need to encrypt it twice (the communication with the server will still be encrypted).
Re: Web Environment Integrity API Proposal
#293Earlier quoted context omitted.
I was there too. People always say this, but just because a thing changed once does not mean it will happen again. In this case, the population scale alone has changed by over an order of magnitude. Just doing some quick searching - the first numbers that come up when you search for "how many people used the internet in the year 2000" are on the order of 350 million or so. Comparatively, now, in 2023, Reddit alone ha…
Yes. The solution is very simple: uninstall Chrome and Chromium. We are the people with the most influence on the tech. We are prescriptors. We are legion. – Yes but Chrome is a tad faster and I have my bookmarks and my favorites extension and blablablabla… — Then you are the root cause of the problem. If you are not ready to sacrifice an ounce of comfort to save the web, then you are the one killing the web. Simple:…
> The solution is very simple: uninstall Chrome and Chromium.
No. Firefox, beyond being slower, also keeps constantly displaying ads… for itself. Want to open a new tab? “Big Browser cares about your privacy, read how!” I just want to open a new tab!!! I’m working! Restarting? “Discover what’s new with Firefox”, “Hohoho, we care about your privacy, LOOK HOW MUCH WE CARE! ALSO WE HAVE NO ADS!” Worse, they suggest to solve privacy that I use Mozilla VPN. VPNs don’t solve privacy. Also, it’s a paid ad for a paid product.
Mozilla had also a staunch political slant, going as far as firing a CEO for a donation he made to the opposing group years ago. There is nothing neutral here, if you are not a leftist, it’s dangerous to use or even give your participation to that ecosystem.
Mozilla has failed to become the no-ads, better-ethics, privacy-aware navigator (pun intended). They keep performing worse actions than Google all the time.
Re: Web Environment Integrity API Proposal
#294Earlier quoted context omitted.
I doubt Apple will be our savior here. Apple is in a great position to implement this spec: their secure enclave and the systems they've developed around it are practically the state of the art. Also Apple is in bed w/ traditional media. (Apple News, Apple TV, iTunes, etc.) Microsoft has been doing the same[1] for years w/ Pluton on the Xbox to protect their IP. Google has been doing this on Android using, dm-verity,…
> I doubt Apple will be our savior here. Apple is in a great position to implement this spec: their secure enclave and the systems they've developed around it are practically the state of the art. You are probably right, but there is one self-interested reason why Apple might resist implementing this - Apple doesn’t like the web competing with apps, and this is basically giving the web a capability that right now onl…
> Apple doesn’t like the web competing with apps
Perhaps you haven’t been paying attention but macOS Sonoma—currently in beta, shipping this fall—has the best web app support we’ve seen in a mainstream operating system.
You can put a web app on the Dock using the Finder’s “Save to Dock” command for virtually any website or web app.
Not only do you get service workers, push notification, web app manifest support, etc. web apps have first class support in the Finder, Spotlight, Spaces, Mission Control, etc. [1].
[1]: https://developer.apple.com/videos/play/wwdc2023/10120/
Re: Web Environment Integrity API Proposal
#295Earlier quoted context omitted.
A good explanation of how he would reconcile his proposal and the ideas he's previously expressed: https://github.com/RupertBenWiser/Web-Environment-Integrity/...
This just seems like a generic “oh people might hate this proposal here’s a place where we mention this”, not a response to the question asked above.
Why isn't it a response to the question above asked? The question above seems to be saying that this API will be used to create walled gardens; the linked part of the design is about how to prevent the API from being used to create walled gardens.
Disclosure: I work at Google but not on this.
Re: Web Environment Integrity API Proposal
#296Earlier quoted context omitted.
> netflix, amazon, facebook etc might ... lock you out Is this supposed to be a bad thing? It's almost made to sound like surviving without them would be tantamount to starving, but frankly we might be better served without them.
I see Facebook locking you out (no great loss there) but I'm less convinced about Amazon or Netflix. They're not advertising-based businesses, so are not suffering with bots-consuming-ads problem. Put another way, my site is unappealing to bots, and frankly I don't care about bot traffic, because I don't have ads. So I don't feel the need to support this server-side. Equally Amazon makes money selling goods, not ads.…
Netflix hides it's app from the Google Play store if the device fails the system integrity check that this proposal is based on, they definitely care.
Re: Web Environment Integrity API Proposal
#297Earlier quoted context omitted.
> Also Apple is in bed w/ traditional media. True. Try to screenshot anything from Apple TV+ content. You'll get a black image.
Screenshotting Apple TV+ works fine for me on desktop Chrome, even with hardware acceleration enabled. I don't recall doing anything to circumvent normal behavior (not really in the habit of screenshotting things I'm watching).
That's why desktop chrome is served lower resolution content than, say, Safari, where they can block it.
Re: Web Environment Integrity API Proposal
#298Earlier quoted context omitted.
If browsers didn't natively support DRM then they would have to come up with external extensions (such as Flash) to support DRM. DRM isn't going away.
DRM should be inconvenient and expensive. There have always been ways to implement DRM security theater for the comfort of content providers in board rooms. The media ecosystem is not going to be enhanced by making DRM more restrictive. Netflix could completely deactivate all DRM today, and it would change nothing. Apple completely abandoned their "FairPlay" iTunes music DRM because it became evident that it was not…
Apple in no way abandoned FairPlay. Every file on Apple Music, and iTunes Match is protected with it. And those greatly outnumber transactional sales through the iTunes store, by an order of magnitude. The customer picked the DRMed version, every time.
Re: Web Environment Integrity API Proposal
#299Earlier quoted context omitted.
Spotify will not load in a browser without a DRM plugin
Yes, but that is fairly recent! Did anyone even notice? For years, you could siphon every song you listened to and save it locally. But did it affect anything? I did it for a little while, but then found it wasn't worth the trouble.
It affected Spotify enough to engineer a solution to stop it.
And five years isn't "fairly recent".
One would also note Spotify is a failing business, and it was failing even harder then.
Re: Web Environment Integrity API Proposal
#300Earlier quoted context omitted.
> There's really no excuse for a technically minded person to still be using Chrome for their day to day browsing. Sadly, Chrome is substantially more secure than Firefox.
It is extremely disingenuous to claim the only browser to still refuse to block third party cookies by default, because it helps their ad partners, is "more secure". The only way in which Chrome is more secure at anything appears to be securely forcing you to view ads via this API. And a shocking amount of malware fails to work when you use a running environment that 95% of society are not using. You are far safer on…
How are third-party cookies a security (not privacy) risk?