Can attestation of the browser be used as personally identifying information? It obviously must be one more data point in identifying the user?
Google is already pushing WEI into Chromium
421–430 of 876 posts
Re: Google is already pushing WEI into Chromium
#422Earlier quoted context omitted.
WEI turns non-compliant browsers into second-class citizens. You’re perfectly free to use whatever compliant browser engine and OS combo you like today – but in a world with WEI, you’ll have to use Approved Chrome on an Approved OS on Approved Hardware with Approved Signing Keys, or you won’t be able to sign into your bank.
isn't this good? banks can raise security while we can still use any browser to check hackers news! or this 3 cows story?
No, it isn't good.
Despite what some on the political spectrum try to say, the Internet has become a basic human right. It is required in schools in America. In many cases, it is required to even interact with certain government entities. Allowing governments and corporations to force users to a specific browser on a specific operating system just to interact with their site goes against everything the web is supposed to be -- an open platform for the free exchange of ideas.
This proposal is a slap in the face to all of that and basically allows governments and corporations to force users to use what those governments and corporations choose.
This is net neutrality all over again, just in a different vein.
I, for one, will continue supporting Mozilla and Firefox and will never again use Chromium-based browsers, or any browser which supports this. I just hope I can keep browsing the sites I need to.
Re: Google is already pushing WEI into Chromium
#423Earlier quoted context omitted.
Has anyone compiled a list of those pushing forward and/or working on WEI?
https://github.com/RupertBenWiser/Web-Environment-Integrity/...
Probably also consider all Google employees complicit. All of them -- especially those who could easily just choose to work someone else, like their developers -- are either in favor of, or okay with, Google's mission to destroy the web.
Re: Google is already pushing WEI into Chromium
#424Earlier quoted context omitted.
They get 80% of their funding from Google. Do you think they are going to change to a “privacy first” search engine? And Firefox already supports Google’s WideVine DRM https://support.mozilla.org/en-US/kb/enable-drm What makes you think they won’t support this?
Are you sealioning me?
I think it’s kind of naive to think a company that gets 80% of its funding from Google is going to go out of its way to protect you from the same company or that it won’t implement the same proposed DRM standard when it already implemented the older one.
Re: Google is already pushing WEI into Chromium
#425As someone who is a somewhat new to web technologies, can someone really explain why this is bad? I saw the techical discussions in the PRs made to the WEI repo but it was all super technical that I was not able to understand the arguments made for and against it.
It's a change to the browser that gives site-owners the ability to require a positive attestation of non-modification before running. The stated goal of this change is to make it more difficult for end-users to block ads. As the spec states, blocking ads violates the deal you make with content creators to use your attention to ads as a form of payment. In practice, this will make it harder, but not impossible, to run…
This has been litigated to hell on HN, but no, there is no implicit contract when loading a webpage that your user agent will display ads or any other content as envisioned by the publisher. A user agent has always been intended to be something that displays content according to the wishes of the user. Even this "modest proposal" phrases itself in terms of user desires (albeit completely disingenuously). Ads have become prevalent because most users go with the default and don't install content filters to block them, but this does not create some obligation for all users to display ads. Rather, the core dynamic remains that ads essentially display at the pleasure of users.
There is no option to "implements the attestation as something like 'return true'". There is a chain of verification from the hardware manufacturers building in software surveillance, through OS developers treating the device owner as an attacker, this proposal of carrying the same user-hostile dynamic through browsers, and finally to the website that by verifying the signatures can force a user to only use software that enforces all of the above.
You should very much object to this! Today, "unsupported browser" is a CYA term that doesn't really mean much besides that the website has limited testing budget (and who doesn't?). With this proposal it would become a hard blocker. Goodbye Linux/BSDs/etc. Goodbye `make install`. Goodbye virtual machines. Goodbye computers that last longer than the rapid e-waste treadmill of mobile phone land. You will of course be able to keep running user-representing operating systems, old computers, "jail" breaking them, etc. You just won't be able to access banking websites, followed by web stores, then general sites. Basically anywhere today that hassles users with CAPTCHAs will be looking to implement these restrictions eventually (which is basically everywhere).
Re: Google is already pushing WEI into Chromium
#426Earlier quoted context omitted.
Some Google services I regularly depend on (like YouTube and Google Meet) don't work as well on Firefox as they do on Chrome, in ways that actually matter. Besides that I think most websites work fine.
Yes. Google uses chrome-only APIs in a few of its own products and falls back not so gracefully. Which sort of underscores the monopoly point. There’s no universal free/cheap alternative to Meet, further entrenching Chromium.
How about Jitsi? https://meet.jit.si/
It's free and open source, works everywhere, has stuff like background replacement, and doesn't require signup at all.
Re: Google is already pushing WEI into Chromium
#427Is there a technical explanation of what exactly is being pushed here?
Web is an open protocol. It is okay for both browser and server to support some third party extension, and Google owns 95% of browsers. But how can it be forced onto all the servers?
Re: Google is already pushing WEI into Chromium
#428Re: Google is already pushing WEI into Chromium
#429Earlier quoted context omitted.
Unfortunately Firefox doesn't have a good UI/UX after all. The last time I checked, multiple profiles support is somehow half-baked.
Not sure why you're getting downvoted, but this is a big deal IMO. We're here because Chrome has been the better product for a long time. Firefox not doing things people want well enough will hurt its adoption, which will impact its capacity to influence the Web. Add to Mozilla's perceived not-very-good management and you have a death spiral on your hands, and more power to Google and Apple to shape the Web towards t…
Mozilla in the past ignored the criticism users had regarding UI/UX changes and went with deploying this bulky mobile-oriented interface for desktops. And here we are.
This itself is one issue; there are also all sorts of adventures they decide to go for little to not at all related to the browser development, and which are conducted to convince people all around the world that they're a good humane corporation that cares. Igh.
Re: Google is already pushing WEI into Chromium
#430We are in post-efficiency era. Power is driving profits and that's what companies compete for. Efficiency (value-to-cost ratio) is now a technical detail, soon to be automated away by AIs. The same is happening in politics - efficiency is a technical detail delegated to civil servants while politicians focus on power. The world is a small pond full of sharks so hungry they eat each other.