Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google is already pushing WEI into Chromium

github.com

Post reply on HN
Print view View original

871–876 of 876 posts

Re: Google is already pushing WEI into Chromium

#871

Post by joshuamorton »

troupo wrote: post #870
joshuamorton wrote: post #865

Earlier quoted context omitted.

Yes and the standard development process starts by designing a spec proposal and testing it! That's the first step. If the proposal ends up not being implemented, the implementation may be removed, but you still need the implementation to write the spec, that's more or less how WHATWG works. All of the following are true statements: - Not all chrome flags are related to spec proposals - Not all spec proposals are rel…

> You seem to be taking things that are factual, normal, everyday, aspects of the WHATWG working process and trying to imply that chrome is doing something unusual, or untoward with its process here, but it isn't. It's doing what is necessary to make a proposal with WHATWG: have a trial. And yet, we've seen many such proposals go through this process because Chrome is paying lip service to it. Whatever Google wants i…

I don't follow, is the issue that Google is lying about trying to standardize something (what you claimed before, and which clearly isn't true), or that they're implementing things that aren't standardized[1] and which you dislike (true, but, like, fine. You can use other browsers)?

If chrome implements WEI and it isn't standardized, you're not going to be knocked off the internet if you use firefox. That's extremely silly.

[1]: Keep in mind that things that aren't standardized include third party cookie behavior, so the behavior that FF and Safari have, that you support, isn't standardized either. If you're fully against browsers implementing nonstandard apis or features, you can't be in support of third party cookie sandboxing at all.

Re: Google is already pushing WEI into Chromium

#872

Post by slowmovintarget »

smolyeet wrote: post #806
slowmovintarget wrote: post #676

Earlier quoted context omitted.

I was just able to finally move my wife back to Firefox. Chrome just stopped working on her Mac. Wouldn't pull up a page. Everything else worked. She's now happily using Firefox with a non-hobbled version of uBlock Origin.

I don’t think this indicative of chrome being bad on Mac. What did you try to resolve the issue? Because I could say chrome always works for me (which would be true in my experience), but that doesn’t mean it always does.

Clearing all state (all saved data and cookies), Incognito mode, disabling the few extensions she was running. When it got to the point where the only thing left to do was reinstall Chrome, we installed Firefox instead.

Re: Google is already pushing WEI into Chromium

#873

Post by derefr »

ddalex wrote: post #853
derefr wrote: post #779

Earlier quoted context omitted.

> Agreed. Eventually the attestor will be measuring “proof of life” with the camera, for example. Ultimately, it's all just instructions being sent to your computer to be executed, and "your computer" is whatever you say it is. Everything (e.g. Intel SGX et al) can be emulated in a sandbox. That's how modern DRM is defeated.

Not if the HW has baked in private keys that you can't read, but which are known to the attester.

Even in that case, your computer is still an arbitrarily-programmable Turing machine; it contains this one hardwired + proprietary component that the remote end is looking to speak to, but that component isn't in control of the system; rather, it's controlled by the system. This just moves the job of deception one target over. Rather than just turning the logic sent by the remote end into a "brain in a vat" fed a false reality by your Cartesian https://en.wikipedia.org/wiki/Evil_demon of a custom OS, you also turn its local emissary, the DRM TPM chip, into another "brain in a vat" fed lies by an enclosing evil-demon hardware platform.

The only way this attack can even be avoided in principle is to restrict distribution of the DRM TPM chip — ala Nintendo's NES CIC lockout chip that never left Nintendo's hands except in the form of finished first-party-assembled game cartridges. But even that only prevents mass production and sale of devices that defeat your DRM; any sufficiently motivated attacker can still buy a legitimate device from you that includes the DRM TPM chip, rip the DRM TPM chip out, and feed it to their evil-demon hardware to enable it to faithfully attest a lie over the network.

In short: if this was truly a practical additional layer of defense, there'd be tons of use-cases for it — game consoles, set-top boxes, kiosk computing (e.g. ATMs), etc.

But you don't see anyone using DRM TPM chips for these systems, because it's not a practical additional layer of defense: such chips would increase BOM for these systems, while only defending against attacks that weaker defenses (namely software DRM, or programmable-firmware DRM like Intel SGX) already defend against; and while not doing anything more to stop the truly motivated attackers than current layers of defense already do — as your Netflix pirate media-scraping bots, your EVE Online gold-farming bots, etc. all have the monetary incentive and capital to invest to build exactly these evil-demon systems.

Re: Google is already pushing WEI into Chromium

#874

Post by jacooper »

tolmasky wrote: post #197

Mozilla should call for Google's removal from the W3C over this implementation of Web Environment Integrity. "But Chrome has 65% market share, what good is the W3C without them?” If Google can take unilateral action to fundamentally change the basic principles of the web, then the W3C is already useless. This will give Google a clear choice: if they want to maintain the idea that the W3C matters, they should withdraw…

Mozilla doing something instead of just talking ? Doubtful

Re: Google is already pushing WEI into Chromium

#875

Post by AdamN »

JohnFen wrote: post #658
AdamN wrote: post #133

Earlier quoted context omitted.

For the tech illiterate recommend Safari. For tech people, appeal to their privileged position and the importance of defending the web by choosing any other browser (or Safari). Both users can keep Chrome installed as a fallback - that will help with convincing too.

> For the tech illiterate recommend Safari. That's only applicable to Apple users, though.

Tech illiterate people should be using MacOS anyway. Windows just gets worse every year. MacOS is actually more like classic Windows than Windows 11 is so it's actually easier to use for tech illiterate people.

Re: Google is already pushing WEI into Chromium

#876

Post by CatWChainsaw »

Xorakios wrote: post #810
SoftTalker wrote: post #644

Earlier quoted context omitted.

> It is unbelievable that over the course of 3 days, the potential future of the web has been put in such dire straits. "Move fast and break things." How many here used to cheer this approach?

I. And still do.

I'd like to think that if I were this type of assdouche I'd at least have the decency to be ashamed of it.
Post reply on HN