Google is already pushing WEI into Chromium • Hacker News Board

Re: Google is already pushing WEI into Chromium

#491

Post by empty_banana » Wed, Jul 26, 2023, 3:05 PM UTC

idlewords wrote: post #206

encody wrote: post #186

It's small, but here's a real actionable item that you can do to help: Put a gentle "Use Firefox" (or any other non-Chromium-based browser) message on your website. It doesn't have to be in-your-face, just something small. I've taken my own advice and added it to my own website: https://geeklaunch.io/ (It only appears on Chromium-based browsers.) We can slowly turn the tide, little by little.

This advice has strong 1998 vibes.

I don't think seeing something like "Works best on Chrome" is rare. Also blocking websites at all for other browsers than Chrome.

Re: Google is already pushing WEI into Chromium

#492

Post by jjoonathan » Wed, Jul 26, 2023, 3:05 PM UTC

carapace wrote: post #370

qjx wrote: post #312

Earlier quoted context omitted.

Yoav Weiss has a blog post from 6 days ago on his website. https://blog.yoav.ws/ for a personal blog it has quite a lot of PR speak

> When thinking about a new proposal, it's often safe to assume that Occam's razor is applicable and the reason it is being proposed is that the team proposing it is trying to tackle the use cases the proposal handles. Ockham's Razor doesn't apply in an adversarial situation.

Yep. You'll cut yourself on Ockham's Razor if you bring it to a fight.

Re: Google is already pushing WEI into Chromium

#493

Post by mordae » Wed, Jul 26, 2023, 3:05 PM UTC

Requiring remote attestation of devices not owned by the relying party should be illegal unless it is a revocable opt-in and only used to protect interests of the user, not service provider.

Re: Google is already pushing WEI into Chromium

#494

Post by JohnFen » Wed, Jul 26, 2023, 3:08 PM UTC

zeteo wrote: post #100

c0l0 wrote: post #5

I feel like I have to repeat this, since so much is at stake here, where it is about the preservation of the web as we know it today, at the peril of having it turned into yet another walled garden: The only way around the dystopia this will lead to is to constantly and relentlessly shame and even harass all those involved in helping create it. The scolding in the issue tracker of that wretched "project" shall flow l…

It won't do anything. You don't think they've anticipated random angry outbursts going into this? Plus, the people you're harassing are simply implementing a policy that they don't have the power to change. The only pressure that Google has been shown to consistently respond to is political . Get a couple of senators (... of the right party) to send them a mild rebuke and they will indeed retreat a little (... and tr…

> the people you're harassing are simply implementing a policy that they don't have the power to change.

I'm not on board with harassing people (sad that I have to include this disclaimer).

That said, the people are not simply implementing this. They're actively and publicly justifying and defending it.

Re: Google is already pushing WEI into Chromium

#495

Post by realharo » Wed, Jul 26, 2023, 3:08 PM UTC

bartvk wrote: post #388

realharo wrote: post #291

Earlier quoted context omitted.

Firefox is also missing a don't allow any website to play audio unless explicitly enabled setting (mute tabs by default, except on allowed sites), as far as I can tell.

I think it has? Go to Settings, and search for Autoplay (or in the left navigation, select Privacy and Security and scroll to Permissions). Click the Settings button next to Autoplay, and set the default to whatever you like (amongst them "Block Audio").

That's not the same thing. Chrome's setting can force audio to be muted regardless of user interactions or manually started playback, until the website settings are changed to allow sound.

Re: Google is already pushing WEI into Chromium

#496

Post by dontreact » Wed, Jul 26, 2023, 3:10 PM UTC

FireBeyond wrote: post #487

dontreact wrote: post #472

Earlier quoted context omitted.

Is it possible for them to implement this API in such a way that it will fail 5% of the time or so, making it impossible for websites to deny individuals based on failing attestation? https://github.com/RupertBenWiser/Web-Environment-Integrity/...

... until Google decides to dial that down to zero for "experience", or Hulu / Netflix makes you disable/whitelist/whatever to access their site.

But as mentioned above, isn't doing so against Google's own self interest? It seems like the project is explicitly stating their goal isn't to allow for websites to do this, and they are implementing it in a manner consistent with that.

One thing about your comment above: Hulu can't start implementing attestation until Google turns the knob to 0 because they can't start randomly dropping 5% of Chrome users. So in your comment above it should be "and" not "or". If I understand correctly Hulu cannot act unilaterally with the currently planned implementation of this.

If let's say they did turn the knob for Chrome, wouldn't it take a while for websites to start implementing this? For me not knowing as much about this it feels like this is a step in an ambiguous direction which could be good or bad still. But since it's Google everyone is thinking ahead in the causal chain. Can you help me understand why this is such a big and clearly bad step against the open web? Thank you!

Re: Google is already pushing WEI into Chromium

#497

Post by Mindwipe » Wed, Jul 26, 2023, 3:12 PM UTC

prox wrote: post #414

Mindwipe wrote: post #348

Earlier quoted context omitted.

The battle is already lost legislatively. Multiple US states, France, Germany and the UK are going to make the web unnavigable unless you type your credit card number or scan your face for age verification in two out of every three sites. We are going to need to at least try to create ways to secure those credentials in as zero trust model as possible. (Note that the legislation is a disaster, but it is done. Nobody…

Time to build a fresh web. Get me my hypercards!

> Time to build a fresh web. Get me my hypercards!

A fresh web doesn't exempt you from the legal requirements unfortunately.

This year has seen the biggest state attacks by legislators on any electronic distribution of speech across most Western states for fifty years, and by and large the technology community has completely failed to even engage with that never mind stop it. We are all going to have to live with the consequences for decades.

Re: Google is already pushing WEI into Chromium

#498

Post by sph » Wed, Jul 26, 2023, 3:13 PM UTC

danlindley wrote: post #328

The web is not dying, it is being killed. And the people that are killing it have names and addresses. Shame on Rayan Kanso Shame on Peter Pakkenberg Shame on Dmitry Gozman Shame on Richard Coles Shame on Kinuko Yasuda Shame on Rupert Ben Wiser: https://github.com/RupertBenWiser/Web-Environment-Integrity Google needs to be broken up.

Shame on all knowledgeable people that happily keep using Chrome and giving Google money. That make the web more centralized by giving more and more power to entities that benefit from this like CloudFlare.

HN is full of people that are indirectly helping to push these changes forward. You're preaching to the choir, and the choir is too lazy to switch browsers or learn how to configure a web server, so they just shrug and carry on.

Re: Google is already pushing WEI into Chromium

#499

Post by atq2119 » Wed, Jul 26, 2023, 3:13 PM UTC

FooBarBizBazz wrote: post #462

rkangel wrote: post #381

Earlier quoted context omitted.

I switched to Firefox for the idealogical reasons above and was pleasantly surprised to find that it was a net improvement. The only site I have compatibility issues with on desktop is MS Teams and even then it's only for voice/video calls, everything else works fine. Firefox Android is a slightly less happy place. The password manager doesn't work very well (am moving away from the built-in one) and I can't log in o…

Firefox Android OOMs whenever it sees an article from The Guardian.

This is just more anecdata, but I'm exclusively using Firefox on Android and have never had issues with The Guardian. In fact, at this very moment there is a Guardian article linked on the front page, and I've visited it without an issue.

I don't doubt your experience, but it's clearly not universal.

Re: Google is already pushing WEI into Chromium

#500

Post by pzo » Wed, Jul 26, 2023, 3:14 PM UTC

londons_explore wrote: post #55

One of the proposals for WEI is to make it probabilistically fail. Ie. on a given device, for 10% of websites, WEI pretends to be unsupported. That means websites can't deny service where WEI is unsupported. Yet it still allows statistical analysis across bulk user accounts. If WEI was implemented like this, I would support it as being good for the web ecosystem.

If you have 50% of people having adblock then websites loosing 10% of traffic because of WEI probabilistically fail it still seems like win for big tech if they force user to their approved unmodified OS/browser.