Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google is already pushing WEI into Chromium

github.com

Post reply on HN
Print view View original

821–830 of 876 posts

Re: Google is already pushing WEI into Chromium

#821

Post by creatonez »

Eduard wrote: post #684
solardev wrote: post #603

Earlier quoted context omitted.

It's far, far too late for this. The W3C is already irrelevant, not that it ever mattered much. The internet is made by big companies. Not standards bodies. The WHATWG has the actual living standards, and Google, Apple, Cloudflare and Amazon make the actual software. Nobody cares about the W3C. And Mozilla is long past dead.

> The W3C is already irrelevant, not that it ever mattered much. This sounds myopic, or what do you mean? W3C is not only about HTML and CSS innovation, but is responsible for and/or involved in a diverse set of relevant standards — many of which "big companies" don't show as much interest in contributing to. https://en.m.wikipedia.org/wiki/World_Wide_Web_Consortium#St...

Browsers don't really tack W3C standards, they track WHATWG standards. W3C has been an effectively dead organization for the last 15 years.

Re: Google is already pushing WEI into Chromium

#822

Post by creatonez »

rabite wrote: post #508
tolmasky wrote: post #197

Mozilla should call for Google's removal from the W3C over this implementation of Web Environment Integrity. "But Chrome has 65% market share, what good is the W3C without them?” If Google can take unilateral action to fundamentally change the basic principles of the web, then the W3C is already useless. This will give Google a clear choice: if they want to maintain the idea that the W3C matters, they should withdraw…

Good luck getting anything from Mozilla, Google is their largest source of revenue by far. Over half.

Mozilla publicly opposes Google's actions all the time, especially when it comes to web specifications. One time they publicly endorsed an ad blocker intended to DoS google's ad servers with nonsense data, an extension that the Chrome Web Store considered to be malware.

Re: Google is already pushing WEI into Chromium

#823

Post by calgarymicro »

andersa wrote: post #136
thesuperbigfrog wrote: post #96

It looks like they do not care if they have consensus or approval for WEI, they are implementing it regardless. Wherever you live, you should contact your government representatives and regulators and put a spotlight on this issue for what it is--monopoly abuse of power. Grassroots efforts are great and it is good to let your friends, family, and associates know what they are doing and why it is wrong. However, gover…

Why do you think they don't have consensus or approval from all the people that matter? This is far too big for that. Google, Apple, Microsoft, Cloudflare, etc, are all working together on this. Governments will like it for "security", and 99% of users won't care.

> Google, Apple, Microsoft, Cloudflare, etc, are all working together on this.

Are they? Is there any evidence those companies support the proposal? I haven't seen any statements to that effect, but I might have missed something.

Re: Google is already pushing WEI into Chromium

#824

Post by joshuamorton »

troupo wrote: post #762
joshuamorton wrote: post #737

Earlier quoted context omitted.

This links to the chromium repo where it is behind a dev flag.

They do origin trials (behind flags) for all new features. They still release a bunch of them later without any consensus etc.

Sure, but not all (or even most) chrome features are web standards, so it makes sense that those are deployed without consensus, because there isn't anyone to get consensus with.

Re: Google is already pushing WEI into Chromium

#825

Post by andersa »

calgarymicro wrote: post #823
andersa wrote: post #136

Earlier quoted context omitted.

Why do you think they don't have consensus or approval from all the people that matter? This is far too big for that. Google, Apple, Microsoft, Cloudflare, etc, are all working together on this. Governments will like it for "security", and 99% of users won't care.

> Google, Apple, Microsoft, Cloudflare, etc, are all working together on this. Are they? Is there any evidence those companies support the proposal? I haven't seen any statements to that effect, but I might have missed something.

Perhaps this specific proposal is only Google's doing, but the concept in general, absolutely.

For example, these provide essentially the same attestation service for native apps consuming APIs, validating that the phone is not rooted, and the OS and app are unmodified:

https://developer.android.com/google/play/integrity

https://developer.apple.com/documentation/devicecheck/

Apple and Cloudflare combined to take it to the browser last year and basically no one noticed:

https://blog.cloudflare.com/eliminating-captchas-on-iphones-...

Of course that will be hooked up to Google's new thing as soon as possible!

Microsoft has also been preparing it with the whole TPM integration in Windows 11 and mandatory inclusion of such hardware in all prebuilt PCs since ~2015. That's what the Chromium integration builds on - Google can't actually do the foundation for this themselves on Windows.

You can absolutely bet that all of these companies are on board with whatever Google is doing.

Re: Google is already pushing WEI into Chromium

#826

Post by calgarymicro »

andersa wrote: post #825
calgarymicro wrote: post #823

Earlier quoted context omitted.

> Google, Apple, Microsoft, Cloudflare, etc, are all working together on this. Are they? Is there any evidence those companies support the proposal? I haven't seen any statements to that effect, but I might have missed something.

Perhaps this specific proposal is only Google's doing, but the concept in general, absolutely. For example, these provide essentially the same attestation service for native apps consuming APIs, validating that the phone is not rooted, and the OS and app are unmodified: https://developer.android.com/google/play/integrity https://developer.apple.com/documentation/devicecheck/ Apple and Cloudflare combined to take it t…

I know about the Safari captcha system (the only one of those that's truly analogous to WEI). Nobody cared about it because Safari's market share is very small. I would care if those companies jumped on the Google proposal because Google has the market share to force this through and make it ubiquitous, which is why I was wondering whether those companies had come out in support of this specific proposal. If they had/will, that would make WEI totally inevitable.

Re: Google is already pushing WEI into Chromium

#828

Post by andersa »

calgarymicro wrote: post #826
andersa wrote: post #825

Earlier quoted context omitted.

Perhaps this specific proposal is only Google's doing, but the concept in general, absolutely. For example, these provide essentially the same attestation service for native apps consuming APIs, validating that the phone is not rooted, and the OS and app are unmodified: https://developer.android.com/google/play/integrity https://developer.apple.com/documentation/devicecheck/ Apple and Cloudflare combined to take it t…

I know about the Safari captcha system (the only one of those that's truly analogous to WEI). Nobody cared about it because Safari's market share is very small. I would care if those companies jumped on the Google proposal because Google has the market share to force this through and make it ubiquitous, which is why I was wondering whether those companies had come out in support of this specific proposal. If they had…

I imagine we'll seem them "come out in support" by quietly deploying the feature in their browsers.

Re: Google is already pushing WEI into Chromium

#829

Post by calgarymicro »

andersa wrote: post #828
calgarymicro wrote: post #826

Earlier quoted context omitted.

I know about the Safari captcha system (the only one of those that's truly analogous to WEI). Nobody cared about it because Safari's market share is very small. I would care if those companies jumped on the Google proposal because Google has the market share to force this through and make it ubiquitous, which is why I was wondering whether those companies had come out in support of this specific proposal. If they had…

I imagine we'll seem them "come out in support" by quietly deploying the feature in their browsers.

Apparently the proposal is working its way through the W3C, so they'll have to take official and public positions on it eventually.

Re: Google is already pushing WEI into Chromium

#830

Post by rileymat2 »

cpeterso wrote: post #819
rileymat2 wrote: post #135

Earlier quoted context omitted.

I have had a couple of banking websites, I want to say wellsfargo corporate card login in, as well as video conference sites.

If a website doesn’t work in Firefox (due to a bug in Firefox or the website or because the website blocks Firefox), please file a bug report on https://webcompat.com/ Mozilla developers will then try to reach out to the website’s owners, add a fix or workaround in Firefox, or (as a last resort) spoof Chrome’s User-Agent string to bypass the website’s Firefox block.

In some sense, doesn't the existence of that site kind of strongly indicate that the GP's point is correct. That there are spotty incompatibilities?
Post reply on HN