Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For

There are seriously so many conflicting informations that this should be hanged from implementation before it its fully formulated (aside fact that it is bad idea and should be scrapped).

Firstly on Android Chrome implementation (testing) only Google Play is now implemented as attester and it does not seem that probable for it to change. (so presumably at least Chrome+Root wont work).

Second and Most Important - the mechanism does not allow for "willing to attest it" - it actually contains this phrase "The web server then checks that the token came from an attester it trusts" so it is disingenuous to say that "any single atestor" is OK - it must be attestor that server decided beforehand (so if server decide we only trust Google and Microsoft - and you have Mac, then tough luck. [more realistically Linux will be at issue]) - so we are getting system that can exclude certain OS and Browsers permanently without recourse - by server side.

@zb3 >doesn't it mean it will be the browser that decides which atestor can run on a given platform? That seems to be case in Chrome implementation* - and there is nothing about this in standard so unless other browsers would create another standard - this way seems likely.

This would be disastrous for any decentralized OS like Linux or BSD - it would be completely impossible for it to realistically work as it requires single "platform" by design - and I should remark "there is no single uniform thing in Linux".

* - note that server decides which attestors it trusts. Which means in essentia that sever decides which platforms it trusts.

Again this must be scrapped.

Part 2:

> Yet a lot people seemingly know its going to do this, that, and some other bad thing

Original https://news.ycombinator.com/item?id=36935843

New

Because any other option is not sensible:

1. Authors don't understand what tech they use. (not possible as they acknowledge issues)

2. Authors don't understand that something unrealistic is unrealistic.

Idea that you can give companies or corporations tools to check "did user modify his environment" and they would not use it to exclude users is stupid or disingenuous because advocates for this did exactly comment in such way: We want this proposal to do precisely that.

Again Google tries to defend it by saying "we will return invalid 'false' for some of the users/times of Chrome users" [to make sure that website will not do that] which for me is not only bad because it then creates "when google revokes this policy we are in even worse situation" but then leaves the issue how google decides "who" to give back this 'false':

I will reject times immediately not only because this can be easily circumvented by website [check n-times] to detriment of user but it would also contradict official documentation of WEI (same token for same input from user).

And this leads us to another point - if Google wants to return false negatives it would need to either keep information that is supposed to return 'false' - EU will not be very happy with that (also it does contradict this "chrome users"); or more likely it will be implemented in chrome.

Now when we established that implementation in chrome is most probable - we can also establish that:

A) Implement this on profile basis - companies will ask you to reset profile if you are this false negative.

B) Implement on connection basis - companies will ask you to refresh.

C) Implement on device age / os version / type - Google can even make the manufacturers happy with this one.

… as you can see at most this will be nuisance and if by some weird way:

Z) Implement on Super-complicated basis - this will be still possible because…

3. Google plays disingenuous word game with us here by saying - We won't destroy open web

Other Chromium browsers may ignore that Google X% false negative (Google may loose few % of users before it scrapes this policy). And there is 0 need for Google to actually do something when companies will misuse this API.

In simple words the part that should worry you is not that "Google will destroy web by using this API on Chrome and it services", what must worry you is that other companies will do that for Google and Google will wash their hands from this by saying "We wanted good but didn't work". You can see that tone from the Google - We don't want that so we created these "holdouts".

They are proposing thing that any sensible person see as clear cut attack (or stupid idea that can only work this way) on Privacy and Your Right to use Your Device (and for some people Your OS and/or Your Browser) as You want to use. They are at fault here.

What’s the alternative?

Google is an advertising agency. Advertising agencies do not stand for anything. Never did and never will. So please cut google some slack. It is their web after all.