Request for Mozilla Position on an Emerging Web Specification Specification Title: Web Environment Integrity API Specification or proposal URL (if available): https://rupertbenwiser.github.io/Web-E...
I believe there’s a misunderstanding somewhere. I wasn’t suggesting anything; I was explaining how Web Environment Integrity could be altered in the future to kill extensions.
The current form of WEI does not have the ability to enforce anything. It isn’t itself DRM, and it can’t prevent extensions from running on pages. What it can do and the only thing it does, is tell websites about the browser environment.
Right now, the only thing it tells websites is the name of the browser. A website having the browser name can’t directly enforce page integrity. It’s already possible to find out the browser name through the user agent or by fingerprinting it with JavaScript.
If WEI is approved and implemented, that opens up the possibility for future additions to the specification. Those changes could require that the browser sends more info to websites. I gave the example of a change that would require WEI tells the website that the browser has an extension which could modify the page contents.
A website having that information would turn WEI into DRM. It gives the website the choice to refuse service to any browser that is running an extension that could change what the user sees.
I hope that was more clear. I don’t expect Google to make changes that immediately block extensions, and then be kind enough to allow some of them back. I suspect they would make changes that don’t prevent extensions, and then revise them to prevent certain types of extensions.
I think the concern I have is in what they said they will do. That is quite disturbing, and unless they are lying, that is where their intention is. Combined with web manifest v3, it’s clear they are quite motivated and they have a long term plan here. They’re dropping it piece by piece perhaps to remove opposition to it. Rather than stab someone to death, it’ll be death by papercuts. My view is we should take the paper off them now based on what we know, rather than waiting until they kill someone.
My concerns is beyond extensions, it’s when it goes towards browsers, and operating systems. My concerns is with the focus on attestation, is this is going to have the potential to tie in to TPM and could be potentially used for fingerprinting based on hardware regardless of what you try to do. There is a number of things in motion that independently seem benign but when combined together, are absolutely disturbing. Giving google control over what is and isn’t approved is dangerous. They simply cannot be trusted.
Yep, that is also a concern that I previously mentioned elsewhere [1][2] and even explain how it can be used to coerce adoption of browsers or assist in the installation of government-created spyware [3].
It’s not like I’m unaware of or rug-sweeping the existential threat that Web Environment Integrity poses to extensions, how Google likely has an ulterior motive behind it, or how it doesn’t actually benefit the end user in any possible way. I bring up or mention my stance on at least one of those points somewhere in the comment threads where I talk about WEI. I just don’t mention all of them in every reply I make, since they aren’t relevant to my replies.
The more replies I make, the more comments I get accusing me of wilfully ignoring some part of WEI or another. I don’t feel like that’s the case, but I recognize it’s difficult to extend charitability to me when my first comment in the thread seems to be anti-anti-Google.
Anyways, the whole point of this entire branch of comments and replies wasn’t “WEI is innocent.” It was to encourage others not make or trust un-cited explanations of technologies or events that have high stakes and emotional influence behind them.
It’s fine to point out the negatives of something, but it’s not fine to frame them as an explanation of the thing. Keep the explanations factual and informative to teach others about the topic and context, and then use examples to demonstrate the problems. Riling people up with factually-incorrect information and having them disseminate that information undermines our ability to be taken seriously by people who hold enough power to do something about the problem.
I believe there’s a misunderstanding somewhere. I wasn’t suggesting anything; I was explaining how Web Environment Integrity could be altered in the future to kill extensions.
The current form of WEI does not have the ability to enforce anything. It isn’t itself DRM, and it can’t prevent extensions from running on pages. What it can do and the only thing it does, is tell websites about the browser environment.
Right now, the only thing it tells websites is the name of the browser. A website having the browser name can’t directly enforce page integrity. It’s already possible to find out the browser name through the user agent or by fingerprinting it with JavaScript.
If WEI is approved and implemented, that opens up the possibility for future additions to the specification. Those changes could require that the browser sends more info to websites. I gave the example of a change that would require WEI tells the website that the browser has an extension which could modify the page contents.
A website having that information would turn WEI into DRM. It gives the website the choice to refuse service to any browser that is running an extension that could change what the user sees.
I hope that was more clear. I don’t expect Google to make changes that immediately block extensions, and then be kind enough to allow some of them back. I suspect they would make changes that don’t prevent extensions, and then revise them to prevent certain types of extensions.
I think most of what you have said is reasonable.
I think the concern I have is in what they said they will do. That is quite disturbing, and unless they are lying, that is where their intention is. Combined with web manifest v3, it’s clear they are quite motivated and they have a long term plan here. They’re dropping it piece by piece perhaps to remove opposition to it. Rather than stab someone to death, it’ll be death by papercuts. My view is we should take the paper off them now based on what we know, rather than waiting until they kill someone.
My concerns is beyond extensions, it’s when it goes towards browsers, and operating systems. My concerns is with the focus on attestation, is this is going to have the potential to tie in to TPM and could be potentially used for fingerprinting based on hardware regardless of what you try to do. There is a number of things in motion that independently seem benign but when combined together, are absolutely disturbing. Giving google control over what is and isn’t approved is dangerous. They simply cannot be trusted.
Yes, and websites will soon begin blocking any browser other than those in a very short allowlist.
Yep, that is also a concern that I previously mentioned elsewhere [1] [2] and even explain how it can be used to coerce adoption of browsers or assist in the installation of government-created spyware [3].
It’s not like I’m unaware of or rug-sweeping the existential threat that Web Environment Integrity poses to extensions, how Google likely has an ulterior motive behind it, or how it doesn’t actually benefit the end user in any possible way. I bring up or mention my stance on at least one of those points somewhere in the comment threads where I talk about WEI. I just don’t mention all of them in every reply I make, since they aren’t relevant to my replies.
The more replies I make, the more comments I get accusing me of wilfully ignoring some part of WEI or another. I don’t feel like that’s the case, but I recognize it’s difficult to extend charitability to me when my first comment in the thread seems to be anti-anti-Google.
Anyways, the whole point of this entire branch of comments and replies wasn’t “WEI is innocent.” It was to encourage others not make or trust un-cited explanations of technologies or events that have high stakes and emotional influence behind them.
It’s fine to point out the negatives of something, but it’s not fine to frame them as an explanation of the thing. Keep the explanations factual and informative to teach others about the topic and context, and then use examples to demonstrate the problems. Riling people up with factually-incorrect information and having them disseminate that information undermines our ability to be taken seriously by people who hold enough power to do something about the problem.