Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

arstechnica.com

Post reply on HN
Print view View original

31–40 of 484 posts

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#31

Post by arciini »

While I don't love this API's idea, I understand why they're doing it, and the API it describes really just sounds like any Captcha API today.

> Google's plan is that, during a webpage transaction, the web server could require you to pass an "environment attestation" test before you get any data. At this point your browser would contact a "third-party" attestation server, and you would need to pass some kind of test. If you passed, you would get a signed "IntegrityToken" that verifies your environment is unmodified and points to the content you wanted unlocked. You bring this back to the web server, and if the server trusts the attestation company, you get the content unlocked and finally get a response with the data you wanted.

The problem with Captchas today is that there are a lot of services you can use to bypass them. You send the token to a human, human gives you the solution-token, and you pass that to Google.

I can see why they want to make this more protected. As a user, if this lets me solve captchas less for certain sites, I'm OK with that. Of course, I don't think this API should be used for the entire web, but I definitely understand its use-case.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#32

Post by mabbo »

> Exactly how the rest of the world feels about this is not necessarily relevant, though. Google owns the world's most popular web browser, the world's largest advertising network, the world's biggest search engine, the world's most popular operating system, and some of the world's most popular websites. So really, Google can do whatever it wants.

This is the point that company breakups start to make a lot of sense.

When Google can do something that every one of it's users hates and none of us can do anything about it, they perhaps have too much market power.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#33

Post by ASalazarMX »

fidotron wrote: post #13

The Chrome team have used "the Open Web" as a euphemism for what is to all intents and purposes Google's great ad supported walled garden. That so few people see this for what it is is amazing, and then they get all surprised when Google act to preserve it and close the capability gap with native platforms.

It's an incredible hubris to pretend to gatekeep the whole Internet. Google´s being doing a pretty hansome profit, maybe not the meteoric rise they were used to before 2020, but still nothing to warrant such desperate measures to secure future profits.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#35

Post by rvnx »

arciini wrote: post #31

While I don't love this API's idea, I understand why they're doing it, and the API it describes really just sounds like any Captcha API today. > Google's plan is that, during a webpage transaction, the web server could require you to pass an "environment attestation" test before you get any data. At this point your browser would contact a "third-party" attestation server, and you would need to pass some kind of test.…

If you liked that idea, you may love "Privacy Pass" by Cloudflare: https://chrome.google.com/webstore/detail/privacy-pass/ajhmf...

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#36

Post by WirelessGigabit »

elforce002 wrote: post #27

Well, I think this move by google will divide the chromium project in 2 versions: one with and one without this "feature".

It doesn't matter. It's a DRM. If your version of the software doesn't contain the right keys none of this will work correctly.

Kinda like how Widevine works. No keys means lower quality.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#37

Post by InexSquirrel »

rpdillon wrote: post #24
pmontra wrote: post #12

Earlier quoted context omitted.

This is bad but how is it going to affect the usefulness of my personal web site, that will never use that API to check who's reading it, not or human? Same thing for a lot of sites, probably the vast majority of them.

Personal sites likely wouldn't be affected directly. What this will affect is the ecosystem of browsers that people are willing to use. My prediction is that it will slowly strangle independent browser development, which will turn the web into something akin to the Android/iPhone duopoly. This is kind of already the case with browser engines, but because this is DRM, it would extend that same effect to the actual dis…

> Basically the DRM equivalent of 'Please disable your ad blocker'. An interesting observation I've had in my own browsing behaviour is that the majority of sites I visit are time wasting visits. If any site presents the above message (or the equivalent - 'sign up to read' like Medium does), I find I just navigate away and do something else.

The bigger concern for me like you call out - major institutions like banks enforcing a separate company's requirements on me in order to interface with them.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#38

Post by warning26 »

I already hate SafetyNet™ on Android, which punishes people for rooting their phones. This basically appears to be trying to bring that to the web.

Want to go to an online banking site? Then we'll need to make sure your computer is unmodified and contains no unapproved software.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#39

Post by pornel »

elforce002 wrote: post #27

Well, I think this move by google will divide the chromium project in 2 versions: one with and one without this "feature".

Google will degrade their services for non-DRM browsers. They have a long history of "oops" with UA sniffs and serving slow buggy alternatives to Chrome-only JS.

You'll be filling in captchas 10 times a day, getting randomly locked out of your Google account in the name of security, and whatever new feature they add to their services, they'll find an excuse to require the DRM for it.

Post reply on HN