Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Chrome Proposal – Web Environment Integrity

chromestatus.com

Post reply on HN
Print view View original

41–50 of 99 posts

Re: Google Chrome Proposal – Web Environment Integrity

#41

Post by Gigachad »

predictabl3 wrote: post #8

Lots of people doom and gloom here about threats to user privacy and freedom. This is the one I'd be worried about. Thought it was annoying to not be able to use banking apps on a rooted Android? Think about how annoying it will be when you can't do much of anything, even on the Web, unless it's from a sealed, signed Apple/Google/Microsoft image-based OS... I realize the way Firefox's user share is going, it might no…

The frustrating thing is that this is both the final nail in the coffin for computing freedom, while also having a legitimate use case. I'm seeing new banks that flat out do not have a web UI at all. The reality is that desktop OSs and browsers have done nothing to stop the fact that it is trivial for a regular person to accidentally install malware which is completely transparent.

Online fraud and theft is exploding right now and the average person is simply not capable of securing a laptop so the companies have decided to only allow secure access through a phone which can usually be trusted to be malware free.

Re: Google Chrome Proposal – Web Environment Integrity

#42

Post by Ketan-fullstack »

hollerith wrote: post #33
spookie wrote: post #16

Earlier quoted context omitted.

Can confirm that it's palpable the segregation and poor treatment of Linux users. I need to make my browser talk as if it was on Windows just for websites to not treat me as garbage. Look, it isn't that bad, but enough to make me do it. It's obnoxious.

I haven't notice any poor treatment. I'm using Google Chrome on Fedora 38 and have recently used Chrome on a Mac and on Windoes.

netflix and prime videos throttle quality for linux users.

Re: Google Chrome Proposal – Web Environment Integrity

#43

Post by mattstir »

predictabl3 wrote: post #8

Lots of people doom and gloom here about threats to user privacy and freedom. This is the one I'd be worried about. Thought it was annoying to not be able to use banking apps on a rooted Android? Think about how annoying it will be when you can't do much of anything, even on the Web, unless it's from a sealed, signed Apple/Google/Microsoft image-based OS... I realize the way Firefox's user share is going, it might no…

> but I really, really hope Mozilla doesn't even remotely consider implementing this.

Apologies for the simple question, but wouldn't forks of popular browsers crop up without this attestation API implemented? Or is it a thing where websites themselves would potentially refuse traffic from browsers that didn't support it?

Re: Google Chrome Proposal – Web Environment Integrity

#44

Post by hollerith »

Ketan-fullstack wrote: post #42
hollerith wrote: post #33

Earlier quoted context omitted.

I haven't notice any poor treatment. I'm using Google Chrome on Fedora 38 and have recently used Chrome on a Mac and on Windoes.

netflix and prime videos throttle quality for linux users.

I'm willing to believe that. I consume my video entertainment on an ipad.

Re: Google Chrome Proposal – Web Environment Integrity

#45

Post by WirelessGigabit »

mattstir wrote: post #43
predictabl3 wrote: post #8

Lots of people doom and gloom here about threats to user privacy and freedom. This is the one I'd be worried about. Thought it was annoying to not be able to use banking apps on a rooted Android? Think about how annoying it will be when you can't do much of anything, even on the Web, unless it's from a sealed, signed Apple/Google/Microsoft image-based OS... I realize the way Firefox's user share is going, it might no…

> but I really, really hope Mozilla doesn't even remotely consider implementing this. Apologies for the simple question, but wouldn't forks of popular browsers crop up without this attestation API implemented? Or is it a thing where websites themselves would potentially refuse traffic from browsers that didn't support it?

They could, and they wouldn't get the keys needed to do this attestation. So no DRM content for you.

Re: Google Chrome Proposal – Web Environment Integrity

#46

Post by dahwolf »

There it is, the AI scraping detector. The hints in the text are obvious:

"This trust may assume that the client environment is honest about certain aspects of itself, keeps user data and intellectual property secure."

The smoking gun is "intellectual property". In a conventional browsing session the website has no idea what the human user is going to do with copyright-protected information published on the website. Hence, it assumes good intent and grants open access.

In the case of an AI scraper, assuming you detect it reliably, the opposite is true. Bad intent is assumed as the very point of most AI scrapers is to harvest your content with zero regard for permission, copyright or compensation.

To make this work, Google outsources the legal liability of distinguishing between a human and a bot to an "attester", which might be Cloudflare. Whatever Cloudflare's practice is to make this call will of course never be transparent, but surely must involve fingerprinting and historical record keeping of your behavior.

You won't have a choice and nobody is liable. Clever!

Not to mention the extra new avenue created for false positives where you randomly lose all your shit and access, and nobody will explain why. Or, a new authoritarian layer that can be used for political purposes to shut down a digital life entirely.

All of this coming from Google, the scraping company.

I have a much simpler solution: it should be illegal to train AI on copyrighted content without permission from the copyright holder. Training AI is not the same thing as consuming information, it's a radically new use case.

Re: Google Chrome Proposal – Web Environment Integrity

#48

Post by charcircuit »

nine_k wrote: post #27
charcircuit wrote: post #13

Earlier quoted context omitted.

You don't have to be a billion dollar corporation to become Play Protect certified. Being able to trust the security of a client can protect against many attacks and it is up to web sites to evaluate what to do with into information that a client is proven to be secure.

Fair. Two questions: - What is the least expensive device that can be certified like that? The least expensive process? - What is the highest level of openness such a device can offer to the user, and why? To my mind, it would be best to have an option of a completely locked down and certified hardware token, a device like a Yubikey, that could talk to my laptop, desktop, phone, or any other computing device using a…

>What is the least expensive device that can be certified like that?

I don't know. I haven't personally gone through the process.

>What is the highest level of openness such a device can offer to the user, and why?

You have to follow the CDD. https://source.android.com/docs/compatibility/13/android-13-...

and you of course must pass the compatibility tests. So it can be as open as you would like as long as you do not break the android security model.

>it would be best to have an option of a completely locked down and certified hardware token, a device like a Yubikey

That approach is limiting since secrets can't be passed to the host operating system and compute with secrets have to happen on the secure device.

Re: Google Chrome Proposal – Web Environment Integrity

#49

Post by [deleted] »

flangola7 wrote: post #37
Asooka wrote: post #11

Earlier quoted context omitted.

You do not, the user is responsible for the operation of their device. Most of the time this should be caught by whatever malicious software detector the user runs. Also, Chrome and Firefox very heavily guard against extensions being installed from outside of the usual way, i.e. by outside programs.

> You do not, the user is responsible for the operation of their device. As time goes on hand-waving the matter as "user's responsibility" is becoming a less and less acceptable answer. Hard assurances are being demanded and applied technologies are progressively patching the existing loopholes.

[deleted]
Post reply on HN