- cross-posted to:
- tech@kbin.social
- stravanasu ( @pglpm@lemmy.sdf.org ) English163•11 months ago
I don’t understand why so many opinion pieces and news keep on saying that Web Environment Integrity could be abused and that’s why we should oppose it. This misses the point a great deal.
Implementation of Web Environment Integrity in browsers IS ITSELF AN ABUSE, because I have the right to go around the web without continually proving who I am, even less against a 3rd party.
It’s as if someone said that some officer (and not even a government one) should always be by your side when you go out, ready to certify who you are, whenever you speak with people on the street – and even with friends. Would you accept that?
Are we totally out of our minds??
- 1984 ( @1984@lemmy.today ) 44•11 months ago
I can only assume these opinion pieces are written by people who use Google for everything they do and trust them.
Dumb fucks, to quote Zuckerberg…
- Skull giver ( @skullgiver@popplesburger.hilciferous.nl ) 8•7 months ago
[This comment has been deleted by an automated system]
- Joph ( @Joph@programming.dev ) English47•11 months ago
That works until you are forced to interact with a website that only works with it, either by work or school.
- Barry Zuckerkorn ( @BarryZuckerkorn@beehaw.org ) English9•11 months ago
That’s already the case with most corporate managed BYO device policies. The typical scenario is that an employer gives you the choice:
- Use the company-owned and company-managed device. No root/admin access, no privileges to install unauthorized software, sometimes policies against personal accounts or files or use.
- Bring your own device, but consent to the company’s IT department managing your security and potentially monitoring your use. If you’re going to connect this device to the company’s LAN (through wifi or VPN or otherwise), you’re going to let us lock it down.
It’s a legitimate concern that these types of things would normalize corporate-managed devices in our personal lives as consumers, and worth resisting in that space, but I don’t think it would actually change the status quo in the corporate world to go from proprietary device management lockdowns to some kind of public standard for lockdowns.
- randomwords ( @randomwords@midwest.social ) English11•11 months ago
Which is exactly why I will never do 2. Provide a device if you want control. I will not give you the ability to wipe my personal phone remotely just to check my work email on it.
- WarmSoda ( @WarmSoda@lemm.ee ) 3•11 months ago
Exactly. If you’re going to lock down and control a device I’m going to need that device provided to me.
- 1984 ( @1984@lemmy.today ) 10•11 months ago
Sure. Trust them to keep that button around… :)
- Buttons ( @Buttons@programming.dev ) English4•11 months ago
How would WEI work? What signals does my computer send to convince the other computers that my computer is doing what they want? Is it based on some “trusted computer” hardware level bullshit that’s already there? (I just want my computer to do what I want.)
- shrugal ( @shrugal@lemm.ee ) 3•11 months ago
That’s not part of this spec, all it says is that the attester produces a cryptographic proof. What it checks and what that proof means is for the attester to decide.
Google and Apple say they would “just” check if the user is logged into their Google/Apple account, as a way to proof that they are human and not a bot. That would be bad enough, because you should not have to have an account with these companies to browse the web. But they could easily make it even worse, by requiring you to install a kind of anti-cheat software that scans your device, and only provide the proof if they like the results. Heck they could just exclude everyone who visited a certain website in the past or who’s name starts with an F if they wanted to, because that’s how broad and dangerous this proposal is!
Big companies should not be able to decide if people are allowed to visit certain websites or not, even if they say they have the best intentions.
- Baut [she/her] auf. ( @BautAufWasEuchAufbaut@lemmy.blahaj.zone ) English2•11 months ago
Without having read anything about WEI at all: Microsoft already supports something similar by using Windows Hello (Edge). It’s using your TPM to make sure the hardware/OS wasn’t tampered with. On Android, this is comparable to safetynet/Play Integrity.
- azron ( @azron@lemmy.ml ) 126•11 months ago
So like 8% of the market, mostly from Mozilla?
- sadreality ( @sadreality@kbin.social ) 30•11 months ago
Well… Normie stream love their 69 chrome versions so that’s where we are at… Competition
- narc0tic_bird ( @narc0tic_bird@lemm.ee ) 118•11 months ago
Will have to wait and see how Apple reacts with Safari. Mozilla dismissing the proposal is big, but Apple has the second largest mobile OS marketshare with iOS, and so Safari is very relevant for websites to support it.
- Toribor ( @Toribor@corndog.social ) English29•11 months ago
Doesn’t Safari already have their own version of this?
- meseek #2982 ( @ultratiem@lemmy.ca ) 48•11 months ago
Lmao, no. Google is out of their minds. Apple has zero interest in controlling browsers or ads.
https://money.cnn.com/2017/08/31/technology/business/apple-net-neutrality/index.html
- 𝕸𝖔𝖘𝖘 ( @01189998819991197253@infosec.pub ) English100•11 months ago
From the article:
“We work hard to build great products, and what consumers do with those tools is up to them — not Apple, and not broadband providers,” Cynthia Hogan, VP of public policy at Apple
Prove it, then. Unlock the bootloader. Allow us to install our own apps. Let us install our own OS on the hardware. I get they don’t want to open source their iOS, that’s fine. They say “what consumers do with those tools is up to them”, but then they lock those tools down TIGHT. Actions speak much louder than words. They say those tools are ours? They need to show us that this is true.
- shrugal ( @shrugal@lemm.ee ) 45•11 months ago
I’m sorry to disappoint you, but this is basically the same thing: https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/
- sik0fewl ( @sik0fewl@kbin.social ) 33•11 months ago
Then what’s this? https://httptoolkit.com/blog/apple-private-access-tokens-attestation/
- meseek #2982 ( @ultratiem@lemmy.ca ) 9•11 months ago
A part of Apple’s long term, multi-stage deployment to phase out passwords entirely. They announced it last year during WWDC and said it will be messy and not without hurdles, but they’re committed to having strong cryptography without need for password at all.
Related: https://www.wired.com/story/apple-passkeys-password-iphone-mac-ios16-ventura/
A far cry from what Google is trying to do or their long term plans (we all know Google is trying to siphon more ad revenue).
Google’s proposition is as bad for Apple as it is for the rest of us.
- that_one_guy ( @that_one_guy@beehaw.org ) 27•11 months ago
Honest to god doublethink right here.
- sin_free_for_00_days ( @sin_free_for_00_days@sopuli.xyz ) 2•11 months ago
It’s crazy when I see it. And I see it far too often these days.
- aberrate_junior_beatnik ( @aberrate_junior_beatnik@midwest.social ) English13•11 months ago
Passkeys (which are broader than just Apple) and this are not related at all. Regardless, Apple absolutely has interest in controlling browsers. Hell, they already do it on iOS, where you can’t use any rendering engine other than theirs.
The only reason they might be against this is because they feel they can’t control it the way they want.
- dan ( @dan@upvote.au ) 1•11 months ago
I don’t think it’s related at all. You can implement passwordless technologies like FIDO2 and Webauthn without browser attestation.
A far cry from what Google is trying to do or their long term plans
It’s literally very similar technology though, and none of us know Apple’s long-term plans for it. It’s well-known in the digital ad industry that Apple are trying to increase the size of their ad network. Locking down tracking (app tracking transparency) is also advantageous to them as it only applies to third parties - Apple can still track users.
- thatsnothowyoudoit ( @thatsnothowyoudoit@lemmy.ca ) 8•11 months ago
They do indeed: https://httptoolkit.com/blog/apple-private-access-tokens-attestation/
From the article:
The focus here is primarily on removing captchas, and as such it’s been integrated into Cloudflare (discussed here) and Fastly (here) as a mechanism for recognizing ‘real’ clients without needing other captcha mechanisms.
Fundamentally though, it’s exactly the same concept: a way that web servers can demand your device prove it is a sufficiently ‘legitimate’ device before browsing the web.
- takeda ( @takeda@beehaw.org ) 4•11 months ago
So basically boiling frog slowly.
- darkkite ( @darkkite@lemmy.ml ) 2•11 months ago
not to my knowledge
- SloganLessons ( @SloganLessons@kbin.social ) 58•11 months ago
Google: “How cute, anyway as I was saying…”
- whoareu ( @kionite231@lemmy.ca ) 9•11 months ago
Google doesn’t care 🙁
- whoiscraig ( @whoiscraig@aussie.zone ) English50•11 months ago
Good.
- Vinnyboiler ( @Vinnyboiler@feddit.uk ) English49•11 months ago
I can’t honestly see how any other company can single-handedly stop Google if they go though with this. Google has the ability to strong arm this proposal by having Youtube and Google search dependent on Web Environment Integrity. There are enough alternative to web search but I can’t see how anyone can fight Google’s dominance in video hosting to stop them.
You would almost have to have every other major website intentionally break on Chrome to even the playing field, and if Google still don’t back down you are left with a divided internet.
- vriska1 ( @vriska1@lemm.ee ) English49•11 months ago
If you oppose this, don’t just comment and complain, contact your antitrust authority today:
US:
https://www.ftc.gov/enforcement/report-antitrust-violation
EU:
https://competition-policy.ec.europa.eu/antitrust/contact_en
comp-greffe-antitrust@ec.europa.eu
UK:
https://www.gov.uk/guidance/tell-the-cma-about-a-competition-or-market-problem
France:
https://signal.conso.gouv.fr/fr/tel-internet-media/faire-un-signalement
Germany: @kartellamt@social.bund.de (anti-cartel bureau) of @BMWK https://www.bundeskartellamt.de/DE/Kartellverbot/Anonyme_Hinweise/anonymehinweise_node.html https://www.bundeskartellamt.de/DE/Missbrauchsaufsicht/missbrauchsaufsicht_node.html
Philippines:
https://www.phcc.gov.ph/file-a-complaint/
India:
https://www.cci.gov.in/antitrust/
https://www.cci.gov.in/filing/atd
Canada:
https://www.competitionbureau.gc.ca/eic/site/cb-bc.nsf/frm-eng/GHÉT-7TDNA5
- Echo Dot ( @echodot@feddit.uk ) 10•11 months ago
The UK government won’t do anything, they’re probably all for this, assuming they understand it.
- Buttons ( @Buttons@programming.dev ) English7•11 months ago
Thank you. Took the words out of my mouth.
If all browsers and standards organizations oppose this idea, but Google does it anyway and it succeeds and takes over, can you imagine how easy the anti-trust case will be?
- WarmSoda ( @WarmSoda@lemm.ee ) 6•11 months ago
Hell yeah. Top of the line comment right here. Thank you
- LemmyLurker ( @LemmyLurker@beehaw.org ) English2•11 months ago
Thanks for the nudge, I wrote to the EU registry.
- CreativeTensors ( @CreativeTensors@beehaw.org ) English32•11 months ago
What I’m getting from this is that some monopoly busting is sorely needed.
- richyawyingtmv ( @richyawyingtmv@lemmy.ml ) 22•11 months ago
EU commission, really. That’s the only way
- /home/pineapplelover ( @pineapplelover@lemm.ee ) 8•11 months ago
Cause I for sure know us Americans will do jack shit about it
- vriska1 ( @vriska1@lemm.ee ) English10•11 months ago
You should contact your FTC
- jmcs ( @jmcs@discuss.tchncs.de ) 6•11 months ago
The FTC has been trying to flex its muscles more recently, the problem is going to be getting through the courts
- Blackmist ( @Blackmist@feddit.uk ) English12•11 months ago
I think YouTube and Google Search are the least of our worries. There will be companies who would have a field day picking up the pieces if that happened.
It’s everyone else using it that suddenly means you can’t run an ad/script blocker on the ickier parts of the web that really need it. The modern internet is an unusable mess, and only ad blockers make it tolerable again.
- takeda ( @takeda@beehaw.org ) English12•11 months ago
LOL, sorry but if it is control over my computer vs youtube going away my reasponse is “bye bye, YouTube, don’t let the door hit you on the way out”
- Jdreben ( @Jdreben@beehaw.org ) English9•11 months ago
I agree with you personally, but it’s the second most used platform after Facebook I think so it does have an insanely massive userbase.
- sin_free_for_00_days ( @sin_free_for_00_days@sopuli.xyz ) 5•11 months ago
Yeah, I made the same argument and had a bunch of morons talking about how inconvenienced they would be if they couldn’t visit a website.
- shrugal ( @shrugal@lemm.ee ) 2•11 months ago
You know, most major web servers are open source projects (Apache, nginx, …). They could in theory decide to check for the browser that’s accessing a website and just return an error If it’s a variant that supports WEI. Ofc people could fork them and remove the check, but many might just use them as is.
Just a thought though, this would be a very radical and hugely controversial step.
- YⓄ乙 ( @yoz@aussie.zone ) 47•11 months ago
Good fucking riddance
- floofloof ( @floofloof@lemmy.ca ) English71•11 months ago
It’s “dismissed” as in “they say it’s rubbish”. It doesn’t mean they won’t ultimately be forced to use it.
- YⓄ乙 ( @yoz@aussie.zone ) 15•11 months ago
😪
- Buttons ( @Buttons@programming.dev ) English5•11 months ago
Just imagine how easy the anti-trust case will be. “The entire industry opposed Google, Google won anyway. I rest my case.”
- floofloof ( @floofloof@lemmy.ca ) English41•11 months ago
Microsoft are staying suspiciously quiet then. And what about Apple?
- shrugal ( @shrugal@lemm.ee ) 40•11 months ago
Apple already added basically the same thing about a year ago: https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/
- floofloof ( @floofloof@lemmy.ca ) English13•11 months ago
Is this technically equivalent to Google’s proposal? Apple say that their version was developed in collaboration with Google, so it would be surprising for Google to go and deploy a second version of the same thing, were it not for the fact that Google always has two competing versions of everything.
And I guess the main reason people are more concerned about Google’s version is that they are so dominant in the browser market.
- shrugal ( @shrugal@lemm.ee ) 27•11 months ago
The details are a bit different. PATs use HTTP headers during a request while WEI is a JS browser API. But otherwise the general structure and end result are the same. A website requests an integrity check, an attester checks your device, and if the attester doesn’t like your device then you’re SOL.
- tunetardis ( @tunetardis@lemmy.ca ) 26•11 months ago
Edge is a Chromium browser isn’t it? Then again, so is Brave and the article indicates they are making a point of removing this stuff from their build. Safari is it’s own thing though afaik.
- Fushuan [he/him] ( @fushuan@lemm.ee ) 21•11 months ago
Brave is a chromium fork with custom stuff, they can just not implement it if they want.
- floofloof ( @floofloof@lemmy.ca ) English17•11 months ago
There needs to be a unified fight against this, that involves not only browser companies but also the businesses running major websites. If it goes through and Google manages to persuade websites to use it, all the other browsers will be forced to implement it if they want to continue existing. And then no more freedom for web users.
- 𝕸𝖔𝖘𝖘 ( @01189998819991197253@infosec.pub ) English23•11 months ago
You’re right. But it’s so much worse than that.
Imagine, for a minute, that this passes. If a website exists that a specific entity disagrees with (say… a whistleblower forum, or accounts of how Google is abusing its powers, or accounts of a Government is abusing it’s citizens), all that would need to happen, is for the “integrity authority” to deny access to that site, and it will be censored. Whereas now, a website has to be taken offline (in most cases) to be effectively censored, if this passes, the “integrity authority” would just need to say nay.
Imagine never hearing of the Snowden files, or George Floyd, or the Russian-Ukraine war. Not because they didn’t exist or didn’t happen, but because you ‘weren’t allowed’ to see them by an entity who benefits from you not seeing them or knowing about them.
If this passes, we would be -officially- entering a dystopia.
- Scrubbles ( @scrubbles@poptalk.scrubbles.tech ) English15•11 months ago
It’s kind of the opposite of this though, it’s not censorship. It’s not that you aren’t allowed to visit other sites, it’s that sites can choose to let you in or not.
The scary part is we don’t know what makes that decision, and from Google’s proposal is that it could just be anything they decide. So it’s not censorship, but it is saying “You aren’t playing by our rules (like by using an ad blocker, or you visited too many whistleblower forums, or we just plain decided we don’t like you) so you don’t get to use gmail/your bank/whoever decides to implement this”
- 𝕸𝖔𝖘𝖘 ( @01189998819991197253@infosec.pub ) English1•11 months ago
That’s true. But the “integrity authority” has the power to censor. Maybe that’s not how it will be used now, but the infrastructure will be there and ready to use.
When I see these things come about, I’m always reminded of that quote, “Your scientists were so preoccupied with whether they could, they didn’t stop to think if they should”
- floofloof ( @floofloof@lemmy.ca ) English3•11 months ago
Won’t there need to be backwards compatibility with sites that don’t implement this? The default would have to be that the browser is allowed to see a site that doesn’t require attestation. So if the whistleblower or political site just didn’t implement this, would that be a way around it?
- 𝕸𝖔𝖘𝖘 ( @01189998819991197253@infosec.pub ) English4•11 months ago
At first, maybe. But not ultimately. If you compare it to TLS, for example, if the site use TLS 1.0, your browser will simply not load the site. This web integrity thing is similar.
Another, maybe more relevant, example, is Flash. Once Google decided Flash will no longer be supported on their browser, Flash died. I actually don’t disagree with the killing of Flash, but the idea is similar.
- dan ( @dan@upvote.au ) English2•11 months ago
I actually don’t disagree with the killing of Flash
I miss it sometimes. There’s still no good way to have lightweight vector animations that wen designers or animators can work on (no code required), that work the same cross-browser. There’s some JS libraries but they often need developer involvement (a designer can’t always set everything up themselves) and tend to be quite heavy libraries (which slows down the page, which reduces your ranking in search engines)…
- Paradox ( @Paradox@lemdro.id ) English3•11 months ago
Google can already do that. It’s called “safe browsing” and if your site ever gets on the wrong side of it good luck. It’s easier to get off a spamhaus registry than it
- conciselyverbose ( @conciselyverbose@kbin.social ) 5•11 months ago
The businesses running major websites want this more than Google does.
- TheEntity ( @TheEntity@kbin.social ) 10•11 months ago
Safari is its own thing, but so is Mozilla. It affects everyone, it affects the very landscape of the web.
- meseek #2982 ( @ultratiem@lemmy.ca ) 6•11 months ago
Apple won’t do anything of the sort. They were in support of net neutrality and are committed to an open, free web. One of their chief complaints against Adobe back when Flash was at its all time peak as just that: it gave Adobe control of the web. They pushed for HTML5 and other alternatives.
Google is alone in this. However, I feel they can’t do it without Microsoft. At least not to the effect they are hoping so I totally see MS jumping on this as they have been firing on all cylinders with regards to “Windows as a service”. All they care about is building their own monopoly.
- VCTRN ( @victron@lemm.ee ) English24•11 months ago
Brave can suck it too.
- Stumblinbear ( @Stumblinbear@pawb.social ) 3•11 months ago
Why so?
- nik0 ( @Venomnik0@lemm.ee ) 13•11 months ago
I believe I remember they had a crypto thing going on
- ichbinjasokreativ ( @ichbinjasokreativ@beehaw.org ) 5•11 months ago
they will show you their own ads through operating system notifications, but without collecting your personal data to do so. the program is also entirely opt-in and is thus disabled by default, so the user has to knowingly and willingly enable it.
- dan ( @dan@upvote.au ) 2•11 months ago
without collecting your personal data to do so.
Meaning the ads will be significantly lower quality. I doubt they have anywhere near as good performance as regular ads, meaning they’ll likely have sketchier ads that are willing to pay more to reach a less specific audience.
- Phoenix [she/they] ( @phoenixes@beehaw.org ) 1•11 months ago
They also “pay” an absolute pittance if you have them enabled — something like 2 cents per ad, if I remember my calculations correctly. Literally nobody should be considering that trade worth it.
- Stumblinbear ( @Stumblinbear@pawb.social ) 1•11 months ago
Yeah but who cares about that
- kate ( @kate@lemmy.uhhoh.com ) English9•11 months ago
They guy that founded brave only did so after getting fired from Mozilla for homophobia
- AfterAll ( @AfterAll@beehaw.org ) English5•11 months ago
WHAT!? That’s wild, and the first I’m hearing of this.
- Mannivu ( @Mannivu@feddit.it ) English5•11 months ago
I heard this for the first time too, but it looks like they’re right https://web.archive.org/web/20191223181612/https://leafandcore.com/2016/09/03/brave-is-a-browser-that-could-save-the-web-but-its-from-an-awful-person/
- CarnyVeil ( @CarnyVeil@beehaw.org ) 15•11 months ago
At this point, why don’t the companies who run Chrome derivatives work together to build a fork that evolves separately from Chrome? Edge, Vivaldi, Opera, etc. will never get the marketshare on their own to rival Chrome, but together, they could make a dent with a unified browser engine.
- takeda ( @takeda@beehaw.org ) 19•11 months ago
Gecko (Firefox engine) already is worked on, why not contribute there instead of losing community? If anything why those browsers use engine that is controlled by a single company?
- atyaz ( @atyaz@reddthat.com ) 17•11 months ago
Alternative plan: why not use gecko? I know it’s more work to do so, but I would call that the lesser of two evils at this point.
- b_antunes ( @b_antunes@startrek.website ) 10•11 months ago
Because it’s very expensive to do so, unfortunately.
- ruination ( @ruination@discuss.tchncs.de ) 9•11 months ago
As it very well should be. Fuck Google.
- crow ( @crow@beehaw.org ) 8•11 months ago
Looking on the bright side here, this will be good for applications that depend heavily on Chromium such as Steam. It won’t be much good, but it’s something.
- fsniper ( @fsniper@kbin.social ) 4•11 months ago
Did Opera announced any intent?
- u_tamtam ( @u_tamtam@programming.dev ) 2•11 months ago
Brave and Vivaldi (and edge) have no say in the matter, they are practically in the business of rebranding chrome for what it is and contributed to reinforcing goggle’s monopoly. I have absolutely no sympathy for them.
At least Brave forks Chromium and they have a bunch of patches they apply to the codebase. I mean yeah, they still contribute to the Chromium monopoly but calling them just a rebrand is a bit unfair in my opinion