Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web

Google "will be able to request a token that attests key facts about the environment their client code is running in."

Google "will ultimately decide if they trust the verdict returned from the attester."

"Allow" Google "to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device."

I have replaced "web sites" and "web servers" in the original explainer text with "Google" for clarity of intent.

Why would Google want these capabilities in web browsers?

What does Google plan to do with them?

What follow-on actions is Google planning?

Google marketing exec: "We need to lock down web browsers so we can make more money by showing ads."

"Ad blockers need to be prevented. The new WEI APIs will ensure that ad blockers aren't running, that our ads are being seen, and that no DRM is being compromised."

"We also want to prevent ad fraud. With WEI we can ensure that ad clicks are legit and that people are watching the ads we show. If we can't control the operating system like we can on Chromebooks and Android phones, then we need to control the web browser with cryptographic certainty."

Getting browsers to adopt and implement Web Environment Integrity is Step 1.

Step 2 is where all Google web sites start requiring Web Environment Integrity to be used or they lock you out of the site.

Step 3 is where all websites serving Google ads require Web Environment Integrity to be used.

Step 4 Profit!

Web Environment Integrity is the beginning of the further DRM-ification and enshittification of the Web.

I don't think this is remotely the case. Quite a few tech-savvy people I know (some of them software developers) use Chrome and mostly don't care about whatever Google does with it. I mention "manifest v3" and get a blank stare. I talk about advertising and ad blockers, and most people don't care, with some of them not even using ad blockers.

We really live in a bubble, here on HN. Most people think of privacy as some abstract thing that they have little control over, and are mostly fine with that. And some are even also fine with government erosion of privacy, in the name of "save the children" style arguments, and of corporate erosion of privacy, in the name of getting free stuff in exchange for their personal information.

It's a sad state of affairs. If most people really did care strongly about these sorts of issues, then I think it would be baffling why we haven't seen more change here -- after all, Firefox is a perfectly viable alternative to Chrome that very few people use. But the lack of change is no surprise: most people don't care.

Faced with a choice between a vague future threat that might happen (an adversarial ISP or other MIM attack) and a certain future threat that will happen if we let it (incumbent gatekeepers locking down the Web), I'll take my chances with the former, and opt for less gatekeeping rather than more.