Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

arstechnica.com

Post reply on HN
Print view View original

401–410 of 484 posts

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#401

Post by JohnFen »

pessimizer wrote: post #137
JohnFen wrote: post #53

Earlier quoted context omitted.

Just talking about subcultures/communities that I've been a part of. Several of them only have a minimal presence on the public web, having moved to a network of private sites. A couple of them have assembled what amounts to a "shadow internet" that uses the internet for an encrypted communications channel but provides its own mailservers, IM servers etc. that don't interact with the internet proper. And, locally, th…

Are there people writing about this? edit: I'm studying ways to facilitate decentralized decisionmaking in small permissioned networks.

On the public web? I assume so, but I don't know. I only know about the communities I am a part of.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#402

Post by insanitybit »

gloosx wrote: post #290
insanitybit wrote: post #232

Earlier quoted context omitted.

> Why would Google want these capabilities in web browsers? "You're trying to access your AWS console, is your laptop patched?"

"Oh – it's not patched, screw web – I'll just use the aws-cli to do whatever I wanted 10x faster."

OK... except that in order to access your account you need to SSO, assuming your organization is doing things properly.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#403

Post by judge2020 »

grishka wrote: post #355
judge2020 wrote: post #352

Earlier quoted context omitted.

You can still control the code running on your computer. But the websites you send http requests to don’t have to respond.

You can't. On most modern systems there is software that runs with privileges above your OS kernel that you can't remove or modify because it is signed with the manufacturer's key. The key is part of a "trusted" boot chain. The root of trust is usually burned into the silicon in the fuses or the initial bootloader (boot ROM). TEE on Android, for example. Intel ME on PCs, and probably TPMs also have a firmware of thei…

Even so, on most of the platforms you list you can disable the security checks and attestation mechanisms with a custom OS, which mitigates the risk of letting a site know that your computer is running any specific version of an OS with the proper anti-tamper checks. If you find a device that doesn’t, you can just not buy that device. At a certain point it’s not constructive to say “you can’t build that” when there is enough of a consumer benefit/desire and business incentive to do so.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#404

Post by judge2020 »

devsda wrote: post #385
judge2020 wrote: post #353

Earlier quoted context omitted.

> As long as I'm not overloading your service or similar, what hardware or software I use must not be restricted. A lot of the push is not for bad actors literally DDOSing servers, but bad users degrading the service for other users. If most users of a service agrees to, for example, run an attestable environment to access a service, then that service should be able to refuse access to users who don’t buy into it.

> If most users of a service agrees to, for example, run an attestable environment to access a service With Chrome's near monopoly in browsers, most users will run an attestable environment when chrome ships it without ever knowing and agreeing to doing so. Even if Google manages to "collect" consent, this has so much potential to adversely impact everyone(including businesses) except Google in the long term that it…

If the customer is already running in an attestable environment, why would they disagree with attesting to that environment?

> this has so much potential to adversely impact everyone(including businesses) except Google in the long term

How so? It prescribes mechanisms to ensure websites don’t exclude certain browsers/OSes

> To protect against both risks, we are evaluating whether attestation signals must sometimes be held back for a meaningful number of requests over a significant amount of time (in other words, on a small percentage of (client, site) pairs, platforms would simulate clients that do not support this capability). Such a holdback would encourage web developers to use these signals for aggregate analysis and opportunistic reduction of friction, as opposed to a quasi-allowlist: A holdback would effectively prevent the attestation from being used for gating feature access in real time, because otherwise the website risks users in the holdback population being rejected.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#405

Post by chromoblob »

person3 wrote: post #291

This won't even work to solve the problem they're trying to solve. If I'm a scraper or someone that wants to drive fake ad impressions, what stops me from faking the attestation info? There's some mention in the original article about the attester validating the attestation data is signed on the client, but that just pushes the problem down the stack a bit. Someone could still spin up VMs, and just automate the scrap…

I failed to learn how this exactly works, but you're looking for the term 'remote attestation'. This aims to prove that your computer is only running the approved software by having the TPM look into the computer's memory, hash the running software and its configuration and signing the hash with a unique private key burned into the TPM that is impossible to extract without physically invading the chip.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#406

Post by Avamander »

archerx wrote: post #369
Avamander wrote: post #345

Earlier quoted context omitted.

> It's great to see this getting more attention. User-agent discrimination (i.e. "go away if you're not using the latest version of Chrome") needs to become illegal. UA should be fully deprecated already. It rarely achieves its goals at this point. There are better alternatives.

No, it helps me find scrapers and bots too lazy to spoof their UA, oh you’re using “curl”, “go-http-client”, or whatever non browser client? You get an instant block.

Detecting low-effort bots is really not worth keeping the pile of s** that is the UA header for.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#407

Post by tim333 »

mabbo wrote: post #32

> Exactly how the rest of the world feels about this is not necessarily relevant, though. Google owns the world's most popular web browser, the world's largest advertising network, the world's biggest search engine, the world's most popular operating system, and some of the world's most popular websites. So really, Google can do whatever it wants. This is the point that company breakups start to make a lot of sense.…

Dunno. I've got three browsers on the laptop. I usually use Chrome but if it's annoying I'd switch to one of the others. Likewise search and I don't use their OS.

I remember Google+ when they ignored feedback on users hating aspects of it and tried to force it on us using their dominant position and it didn't go very well for them.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#408

Post by tim333 »

rvz wrote: post #104
wiseowise wrote: post #14

> The goal of the project is to learn more about the person on the other side of the web … The intro says this data would be useful to advertisers to better count ad impressions, stop social network bots, enforce intellectual property rights, stop cheating in web games Go f yourself, Google. Browser’s purpose is to serve me web pages, not to learn about me.

As long as Google is still leading in the browser market share, they do not care or give a shit and will never change.

There's very little barrier to changing to Firefox etc.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#409

Post by thefurdrake »

BiteCode_dev wrote: post #314
rvz wrote: post #104

Earlier quoted context omitted.

As long as Google is still leading in the browser market share, they do not care or give a shit and will never change.

So many people are harsh Google critics, yet still never use duckduckgo, don't try to migrate from gmail, or stick to firefox. Complaining is easy, but apparently even small compromises like these are hard.

Firefox, kagi, and protonmail here.

F google.

Re: Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

#410

Post by grishka »

judge2020 wrote: post #403
grishka wrote: post #355

Earlier quoted context omitted.

You can't. On most modern systems there is software that runs with privileges above your OS kernel that you can't remove or modify because it is signed with the manufacturer's key. The key is part of a "trusted" boot chain. The root of trust is usually burned into the silicon in the fuses or the initial bootloader (boot ROM). TEE on Android, for example. Intel ME on PCs, and probably TPMs also have a firmware of thei…

Even so, on most of the platforms you list you can disable the security checks and attestation mechanisms with a custom OS, which mitigates the risk of letting a site know that your computer is running any specific version of an OS with the proper anti-tamper checks. If you find a device that doesn’t, you can just not buy that device. At a certain point it’s not constructive to say “you can’t build that” when there i…

The problem is not someone knowing something. The problem is that since 99% of people use their devices in stock configuration, "no attestation available" would be interpreted as "attestation not passed". We're already seeing that with banking apps on Android. It doesn't matter whether you've rooted your stock ROM or running something without Google services, the app will refuse to work either way.
Post reply on HN