Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Environment Integrity Explainer

github.com

Post reply on HN
Print view View original

31–40 of 47 posts

Re: Web Environment Integrity Explainer

#31

Post by josephcsible »

jchw wrote: post #2

Absolute worst spec I've ever seen. Google needs to be loaded into a cannon and fired into the sun. > How does this affect browser modifications and extensions? > Web Environment Integrity attests the legitimacy of the underlying hardware and software stack, it does not restrict the indicated application’s functionality: E.g. if the browser allows extensions, the user may use extensions; if a browser is modified, the…

> We need to legally regulate remote attestation.

I'd go a step further. We need to ban it. It should be illegal to sell devices to consumers that already contain private keys, unless all of said keys are provided to the consumer at the time of purchase.

Re: Web Environment Integrity Explainer

#32

Post by josephcsible »

hooverd wrote: post #11
jchw wrote: post #2

Absolute worst spec I've ever seen. Google needs to be loaded into a cannon and fired into the sun. > How does this affect browser modifications and extensions? > Web Environment Integrity attests the legitimacy of the underlying hardware and software stack, it does not restrict the indicated application’s functionality: E.g. if the browser allows extensions, the user may use extensions; if a browser is modified, the…

Trusted computing is all about ensuring that your machine is trusted to run payloads and you can't observe or interact with them. Sad! I see why the free software people call it treacherous computing

Exactly. Trusted Computing means that the FAANGs and the MAFIAA can trust that your computer will put their interests ahead of your interests. There is zero benefit to you.

Re: Web Environment Integrity Explainer

#33

Post by thesuperbigfrog »

Aerbil313 wrote: post #26
thesuperbigfrog wrote: post #23

Earlier quoted context omitted.

>> I don't believe they're being honest with how this will be used. Getting browsers to adopt and implement Web Environment Integrity is Step 1. Step 2 is where all Google web sites start requiring Web Environment Integrity to be used or they lock you out of the site. Step 3 is where all websites serving Google ads require Web Environment Integrity to be used. Step 4 Profit! This is the beginning of the further DRM-i…

No one can control the web unless every personal computing device on earth is closed source down to the hardware. Digital technology is a double edged sword. I agree that Google would definitely want complete control, but they just can’t do that. We’ll most likely rather see deglobalization of the web with trust shifting from FAANG to states.

>> No one can control the web unless every personal computing device on earth is closed source down to the hardware.

It happens one step at a time:

https://gabrielsieben.tech/2022/07/29/remote-assertion-is-co...

Re: Web Environment Integrity Explainer

#34

Post by Aerbil313 »

thesuperbigfrog wrote: post #33
Aerbil313 wrote: post #26

Earlier quoted context omitted.

No one can control the web unless every personal computing device on earth is closed source down to the hardware. Digital technology is a double edged sword. I agree that Google would definitely want complete control, but they just can’t do that. We’ll most likely rather see deglobalization of the web with trust shifting from FAANG to states.

>> No one can control the web unless every personal computing device on earth is closed source down to the hardware. It happens one step at a time: https://gabrielsieben.tech/2022/07/29/remote-assertion-is-co...

Hell. Heck. Shit. That piece is really scary. I did NOT expect that. Remote attestation really is coming. What will happen to Linux? My beloved NixOS? New OSes, Theseus OS? What is the solution? Don't nation states see that this will give American companies too much power, even more than now, too much to really significantly matter?

I see no solution beyond the deglobalization of the entire tech stack (down to the very OSes) and multiple sources of trust in the form of multiple nation states. Maybe my government will make an official Linux distro and make it mandatory, so we can escape this coming shit.

Re: Web Environment Integrity Explainer

#35

Post by mike_hearn »

funcDropShadow wrote: post #30
mike_hearn wrote: post #18

Earlier quoted context omitted.

TC is value neutral so the FSF slurs don't make sense. Consider what happens when the machine in question is a cloud VM. Then you can run workloads on a rented machine without the risk of the cloud vendor spying on or tampering with your server. Likewise if the machine gets hacked. These are highly desirable properties for many people. For example Signal uses TC so the mobile apps can verify the servers before doing…

> TC is value neutral so the FSF slurs don't make sense Trusted computing is often used such that one might think, it implies the user can trust something (his computer). But it is the other way around. A service provider can trust a machine - that a user bought -- to not do what the user wants. That is misleading at best.

There are really only two ways TC is used in practice in today's economy:

1. Clients verifying cloud VMs. The "user" in this case is not the same person as "his" in "his computer".

2. Games consoles being verified by PS/Xbox online services. In this case the users are in effect verifying each other, because part of why they need such tough security is to stop online gaming being wrecked by cheaters.

At a stretch you could talk about credit card chips and the ATM network as (3) but that's far enough away from general computing that it doesn't really count.

In both cases these are firmly pro-consumer use cases. Unless you want to pirate or cheat in gaming of course, but there's plenty of users who don't want to subsidize your fun with their own suffering, so they're happy to rely on TC to stop that. It's a big part of why console gaming dominates PC gaming. It's wrong for the FSF to imply all those people are brainwashed dupes because they have a different value system to Richard Stallman.

Re: Web Environment Integrity Explainer

#36

Post by throwawaymobule »

cesarb wrote: post #17

The reason we can still run Linux on our desktops and laptops today, is that Linux was already popular enough back when Secure Boot was specified, so that Microsoft could be convinced to allow Secure Boot to be disabled and/or user-specified keys to be enrolled (and also to sign the bootloader for Linux distributions which follow a specific set of criteria when Secure Boot is enabled). Had desktop Linux not been popu…

I think Microsoft made it mandatory to allow disabling secureboot because they wanted their older OSs to work, didn't want devices getting bricked when a vendor poorly implemented it, and didn't want to get hit with another anti-trust suit. not necessarily in that order.

Re: Web Environment Integrity Explainer

#37

Post by chicob »

So, in short: Google and other companies shamelessly polluted the web with ads and personalized ad driven content, and since regular folks use ad blockers, and ad manipulating people abuse the very system those companies fostered, there is now a supposed need to get the house in order... ...by force feeding us ads and trackers, bypassing whatever still allows people to browse sanely.

Re: Web Environment Integrity Explainer

#38

Post by funcDropShadow »

mike_hearn wrote: post #35
funcDropShadow wrote: post #30

Earlier quoted context omitted.

> TC is value neutral so the FSF slurs don't make sense Trusted computing is often used such that one might think, it implies the user can trust something (his computer). But it is the other way around. A service provider can trust a machine - that a user bought -- to not do what the user wants. That is misleading at best.

There are really only two ways TC is used in practice in today's economy: 1. Clients verifying cloud VMs. The "user" in this case is not the same person as "his" in "his computer". 2. Games consoles being verified by PS/Xbox online services. In this case the users are in effect verifying each other, because part of why they need such tough security is to stop online gaming being wrecked by cheaters. At a stretch you…

> There are really only two ways TC is used in practice in today's economy:

Isn't that exactly the case, because the idea of using TC in every PC produced a huge backlash?

Re: Web Environment Integrity Explainer

#39

Post by mike_hearn »

funcDropShadow wrote: post #38
mike_hearn wrote: post #35

Earlier quoted context omitted.

There are really only two ways TC is used in practice in today's economy: 1. Clients verifying cloud VMs. The "user" in this case is not the same person as "his" in "his computer". 2. Games consoles being verified by PS/Xbox online services. In this case the users are in effect verifying each other, because part of why they need such tough security is to stop online gaming being wrecked by cheaters. At a stretch you…

> There are really only two ways TC is used in practice in today's economy: Isn't that exactly the case, because the idea of using TC in every PC produced a huge backlash?

No, 'fraid not. There was no backlash except amongst a tiny subset of ideologically motivated developers who aren't making the decisions in these companies anyway. See how the big cloud providers all have TC efforts without fuss. Smartphones implement a much less open form of TC too again, devs don't care or welcome it (less piracy), users don't care or welcome it (see how HN threads fill up with praise for Apple's walled garden when it gets discussed). Linux supports all this tech just fine as well.

The reasons it hasn't taken off in desktop PCs are rather complicated and mostly due to patchy hardware support for the use cases that most matter there. It's much harder to implement in a diverse hardware ecosystem because for devs to rely on a new hardware feature that isn't just performance requires a very wide installed base. Intel and AMD never agreed on the right way to do it, and getting device vendors on board was too difficult outside vertically integrated ecosystems like consoles.

Re: Web Environment Integrity Explainer

#40

Post by croes »

predictabl3 wrote: post #20

I would love to know the personal motivations and moral feelings of those who work on features like this. Are they naive about how these features will be used? Do they not care? Do they not have a personal sense of responsibility for contributing to the end of open, free computing? It's been a while since I took a Big Tech paycheck, but I don't remember being this willing to go build nightmare tech when I was getting…

They dropped "Don't be evil" for a reason.
Post reply on HN