Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

arstechnica.com

Post reply on HN
Print view View original

341–350 of 484 posts

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#341

Post by pmontra »

afandian wrote: post #17
pmontra wrote: post #12

Earlier quoted context omitted.

This is bad but how is it going to affect the usefulness of my personal web site, that will never use that API to check who's reading it, not or human? Same thing for a lot of sites, probably the vast majority of them.

One day Google may well flag your sure as lower security, refuse to let you show ads, or disappear you from search results.

I never had ads on my site and if it disappears from search results, no problem. I'll give the URL to the very few people that might be interested to browse it. I probably know all of them, plus a number of bots.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#342

Post by geysersam »

azemetre wrote: post #151
judge2020 wrote: post #85

Earlier quoted context omitted.

Even if Google were forced to partition off employees and give up control of Chrome, they would still be allowed to be an influential force that gets a seat at the Chrome decision-making table, just the same as Meta, Apple, etc if they were to want it. How would this have changed the existence of the Web Integrity API?

Similar arguments were made about AT&T and I think the country survived. Break them up, then use the precedent to break up every other big tech co. A competitive market is way more important than Google.

Breaking up big tech would unlock so much value and innovation

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#343

Post by EvanAnderson »

xvector wrote: post #337
urda wrote: post #237

Earlier quoted context omitted.

They have also violated an important Code of Conduct [1], to the point of even aggressively closing valid complaints [2]. The Googlers RupertBenWiser [3] and yoavweiss [4] are really just toeing the Google line. What's super gross is even yoavweiss tried to play pretend that the original issue they forced closed, without comments or reading, was "spam" [5]. I believe both of these users are acting in very-bad-faith,…

Do not dox individuals. You do not understand their situations, pressures, etc.

Unless the parent comment was edited to remove some details your bar on “doxxing” somebody is pretty low. Linking to somebody’s public GitHub profile isn’t revealing any private information. Both participated in the discourse on GitHub— it’s not like finding their profiles would be difficult.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#344

Post by neop1x »

LispSporks22 wrote: post #15

They're going to prevent me from running an adblocker in this "web integrity" environment, aren't they.

I am using various browser extensions which make browsing a better experience for me like Dark Reader to make all webs dark. Sometimes I write userscripts for TamperMonkey to add missing functionality or get rid of some annoyance. That all will probably be impossible thanks to this attestation BS. :S

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#345

Post by Avamander »

userbinator wrote: post #131

It's great to see this getting more attention. User-agent discrimination (i.e. "go away if you're not using the latest version of Chrome") needs to become illegal. As long as I'm not overloading your service or similar, what hardware or software I use must not be restricted. The same goes for other deliberate obstacles to accessibility and interoperability --- creating a "standard" that's so complex and churned frequ…

> It's great to see this getting more attention. User-agent discrimination (i.e. "go away if you're not using the latest version of Chrome") needs to become illegal.

UA should be fully deprecated already. It rarely achieves its goals at this point. There are better alternatives.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#346

Post by grajmanu »

rezonant wrote: post #254
grajmanu wrote: post #251

The attestation need not be done by Google or web browser owner themselves. This can be done by operating systems or any third party attestation just like a simple version of certification attestation. I think even though the intention behind the idea is good, the integrity of the company that suggested this is so doomed that we are all afraid. I think such proposals will come and need to come so that gradually these…

Practically speaking yes, the OS (and further down the TPM/enclave) will be the root of attestation. Google here is starting with Google Play Integrity (previously known as SafetyNet), which is an OS-level attestation authority. On Windows, this attestation would probably be done via TPM/Secureboot and Windows integrity APIs. That's what's scary about it, because it has the potential to make large parts of the web in…

I agree and I understand the damning nature of change.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#347

Post by Avamander »

dzikimarian wrote: post #266
crote wrote: post #91

Earlier quoted context omitted.

Ehhh, it depends. In theory one could imagine a scenario like a bank website refusing to be accessed unless the entire OS & browser stack pass attestation - as that would rule out things like keyloggers, malicious browser extensions, and session hijacking. In practice it'll just be used to lock down content and force unskippable ads on users, of course.

IT in big banks is usually horrible and their security departments would close you and your family in a cage if it was possible and helped them avoid liability. If attestation exposes let's say your password policy, be sure you'll be required to set it for monthly changes the moment they can do that. I don't want them to have a say in how I run my devices.

Absolutely this. Banks are notorious for cargo culting. Their ideas of security are often inane.

I'm also sure it'll end up with things like "your browser is too up-to-date" or crap like that.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#348

Post by neop1x »

javajosh wrote: post #102

Surprising even myself, I actually like this proposal. It does two things, one which is good, and the other which is not as bad as people are saying. The good thing is to give browsers a way to attest to their inviolability to systems on the other end. This is generally useful! In particular, it opens up a huge potential for people to run what are effectively servers in their browsers - which was TBL's vision for the…

Devices and browsers will become locked down & attested blackboxes, manufactured by a handful of attested companies. Those companies will have trouble finding employees because less and less people will be interested in low-level stuff and security as there will be no devices and software to learn this stuff on. There will be less and less debugging options and "Software developer" will just be a dumb ape copy&pasting example corporate code, writing to the megacorp's support (based in india) if something won't work.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#350

Post by lapcat »

izacus wrote: post #283
lapcat wrote: post #224

Earlier quoted context omitted.

> iPhone users are using Manifest V3 _every single day_ in their Safari. There was never another option for them. This is false. Safari supports Manifest V2 and has no plans to deprecate it. I'd guess that you're confused because Safari lacks support for webRequest BlockingResponse: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

Whatever it's called, it has all the downsides of Manifest V3 that are being criticized for Google. Just slapping another name on it doesn't make the issues go away.

> it has all the downsides of Manifest V3

This is not true either. There are many different aspects to Manifest V3, such as restrictions on script execution.

Post reply on HN