Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Environment Integrity API Proposal

github.com

Post reply on HN
Print view View original

81–90 of 460 posts

Re: Web Environment Integrity API Proposal

#81

Post by Aerbil313 »

emilsedgh wrote: post #51
spystath wrote: post #20

Earlier quoted context omitted.

> how do we protest this? You do not and you cannot. It was written in stone once Chrome dominated the browser market. What Chrome (Google) wants, Chrome (Google) gets. Despite all the good engineering Google wants to sell ads, that's all there is to it. And the result is this proposal. > The saving grace here might be that Firefox won't implement the proposal. It's irrelevant and we are an irrelevant minority. Unles…

This is not the right attitude. Google wanted AMP. Google didn't get AMP. AMP is dead.

This is not even just Google. Apple, Microsoft, Cloudflare, everyone's in. https://gabrielsieben.tech/2022/07/29/remote-assertion-is-co...

Re: Web Environment Integrity API Proposal

#82

Post by jabbany »

madeofpalk wrote: post #71
jabbany wrote: post #45

Earlier quoted context omitted.

Step 1: Sites require a "secure" (read proprietary) browser like "Google Chrome", "Microsoft Edge", "Safari" or refuse to operate. Step 2: "Secure" browsers change the behavior of their implementation of the Content Blocker API so an industry-accepted "secure" site lile Google Ads can opt-out of being blocked ("You wouldn't want a misconfigured content blocker to accidentally break a verified secure site right?") Ste…

I don't understand how the Apple that introduced their Content Blocker APIs would choose to invest into this API to kneecap their own content blockers?

They wouldn't have to. Unless you use an iDevice you're not using an Apple made browser. (The content blocker API is WebKit so it's used across multiple browsers)

As for revenue from Apple users, they already want to have control over that and would be more than happy if Google and co voluntarily stopped serving their users so they can make ad money off of them on their own terms.

Re: Web Environment Integrity API Proposal

#83

Post by drbawb »

There is one thing I'm not quite clear on here:

  >The attestation is a low entropy description of the device the web page is running on.
  >The attester will then sign a token containing the attestation and content binding (referred to as the payload) with a private key.
  >The attester then returns the token and signature to the web page.
  >The attester’s public key is available to everyone to request.
I'm assuming "attester" here means "hardware authenticator." How is the attestation low entropy if it's presumably signed by a key that is unique & resident to my device? There is nothing higher entropy than a signature w/ "my" private key. That is literally saying "I [the single universal holder of the corresponding private key] signed this attestation." These days that key is realistically burned into my device at manufacturing time, and generally even if I can enroll keys on "my" device (big if), there is a very limited number of keyslots on hardware authenticators. Certainly not enough slots to present a random throwaway identity to each webpage.

I don't understand how you can have public/private key crypto as the basis for attestation and also have privacy? The two seem mutually exclusive. Is the private key supposed to be shared among a large cohort? (Which seems rather unwise, as it would make the blast radius of a compromised key disastrously huge.)

Re: Web Environment Integrity API Proposal

#84

Post by wmf »

madeofpalk wrote: post #71
jabbany wrote: post #45

Earlier quoted context omitted.

Step 1: Sites require a "secure" (read proprietary) browser like "Google Chrome", "Microsoft Edge", "Safari" or refuse to operate. Step 2: "Secure" browsers change the behavior of their implementation of the Content Blocker API so an industry-accepted "secure" site lile Google Ads can opt-out of being blocked ("You wouldn't want a misconfigured content blocker to accidentally break a verified secure site right?") Ste…

I don't understand how the Apple that introduced their Content Blocker APIs would choose to invest into this API to kneecap their own content blockers?

I can imagine a situation where "low-quality" sites get ad blocked and "high-quality" sites get DRM.

Re: Web Environment Integrity API Proposal

#86

Post by kykeonaut »

I am not a hopeful romantic, but the EU has been investing on vendor neutral web-browsers like Nyxt [0] and the UR Browser [1] through the Horizon Europe program. I doubt that legislators (at least in the EU) will view this as a positive development, assuming EU legislators know what they are doing. On the other hand, lobbying by big tech is still very much a threat.

[0] https://nyxt.atlas.engineer/

[1] https://www.ur-browser.com/

Re: Web Environment Integrity API Proposal

#87

Post by cesarb »

jabbany wrote: post #73
caesil wrote: post #9

Whether you like it or not (and I certainly don't), you've gotta sort of admire the sheer vision of a fifteen-year project to build a browser so good it comes to monopolize the industry, all because you've had the foresight to realize that monopoly will be crucial to securing your position as the adtech hegemon. An underrated masterpiece of evil genius.

I wouldn't necessarily view it as malice from the beginning. It's entirely likely that early Chrome was really trying to solve usability problems in hosting complex applications like GMail. A goal that was attempted throughout history, as seen from the days of ActiveX, Java Web Applets, Flash, etc. But capitalism does what it does best, and will happily take advantage of (and try to prolong) a natural monopoly situat…

> I wouldn't necessarily view it as malice from the beginning. It's entirely likely that early Chrome was really trying to solve usability problems in hosting complex applications like GMail. A goal that was attempted throughout history, as seen from the days of ActiveX, Java Web Applets, Flash, etc.

I would say that the actual goal early Chrome was really trying to solve, was to prevent the browser monopoly of the day from being used against Google. It's similar to how Valve invested on Steam OS, as insurance in case Microsoft used its operating system monopoly to degrade the Steam experience relative to Microsoft's application store.

Re: Web Environment Integrity API Proposal

#88

Post by PaulDavisThe1st »

emilsedgh wrote: post #51
spystath wrote: post #20

Earlier quoted context omitted.

> how do we protest this? You do not and you cannot. It was written in stone once Chrome dominated the browser market. What Chrome (Google) wants, Chrome (Google) gets. Despite all the good engineering Google wants to sell ads, that's all there is to it. And the result is this proposal. > The saving grace here might be that Firefox won't implement the proposal. It's irrelevant and we are an irrelevant minority. Unles…

This is not the right attitude. Google wanted AMP. Google didn't get AMP. AMP is dead.

AMP is dead, but long live King AMP, now known to subjects as King WEI

Re: Web Environment Integrity API Proposal

#89

Post by rpastuszak »

Aerbil313 wrote: post #78
saurik wrote: post #5

This is pretty much the inevitable end-game of the web, in no small part funded by ad-based business models (as the analog gap pretty much destroys most attempts to use this stuff to do copy protection) and enabled by developers who have insisted we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) into the browse…

Yeah this is really the endgame. I think the issue is systemic though, this is more than just ad money. Bots and automatability of the web was always an anomaly and a flaw, as the web was and is always designed for humans. Strict human verification was always a need. One can say we did achieve this with 2FA and such, but what is technology all about? Convenience. If it's more convenient, people will prefer remote ass…

It is systemic, but I think you underestimate how deeply the adtech money and everything surrounding it is embedded in our mindset. It's essentially the Goodhart's Law taken to the extreme, where every single new iteration of the system brings in new middlemen, new misaligned incentives, then putting those middlemen between the person providing a service and the person who'd like to pay for it.

Here's an exercise: try to draw a diagram of all parties required to display a video ad on your page. I suggest starting with the OpenRTB and VAST specs. It's creepy.

The biggest shame here is that most people are convinced that we need advertising because otherwise people would not pay for content.

Re: Web Environment Integrity API Proposal

#90

Post by cesarb »

tentacleuno wrote: post #13
saurik wrote: post #5

This is pretty much the inevitable end-game of the web, in no small part funded by ad-based business models (as the analog gap pretty much destroys most attempts to use this stuff to do copy protection) and enabled by developers who have insisted we shove as much difficult-to-implement functionality (by which I am talking about CSS complex stuff, not powerful-but-easy-to-code APIs for OS-level access) into the browse…

> who is finally putting their foot down and deciding that we are all going to be forced to either used fully-locked down devices The person who wrote the proposal[0] is from Google. All the authors of the proposal are from Google[1]. I've been thinking carefully about this comment, but I really don't know what to say. It's absolutely heartbreaking watching something I really care about die by a thousand cuts; how do…

> It's absolutely heartbreaking watching something I really care about die by a thousand cuts; how do we protest this?

Death by a thousand cuts can also happen in the other direction. Even if we do not have a single decisive way to oppose this disastrous proposal, we can fight it in as many ways and on as many avenues as possible. Spreading the word about it widely is an important first step, so that those best placed to oppose it know that they should act.

Post reply on HN