5 ms·

Yes. Signed Exchanges mean the publisher signs the content using their private key. A third party can provide delivery like a CDN, but they cannot modify the c

Yes. Signed Exchanges mean the publisher signs the content using their private key. A third party can provide delivery like a CDN, but they cannot modify the content, or the signature would no longer match. The useragent (browser) enforces this. This gives the secure control of the content back to the publisher, unlike the trust model of CDNs or the AMP Cache.

calcifer 6y ago
> The useragent (browser) enforces this. This assumes the user agent is actually an agent of the user, and not the AMP provider, which is demonstrably [1] not the case. [1] https://github.com/w3ctag/design-reviews/issues/467#issuecomment-581944600 https://github.com/w3ctag/design-reviews/issues/467#issuecom...
- gregable 6y ago
  Chrome does enforce the matching signature. Browsers without Signed Exchange support will not likely ever get a signed exchange as they do not advertise support for it in the `Accept` request header.
  - freeone3000 6y ago
    Chrome enforces that the signature being served by google is the same signature as the one being served by google. It's a useless verification. If Google were so inclined, they could very well just change the <link> tag too.
  - gregable 6y ago
    @freeone3000, that's incorrect, in the case of Signed Exchanges. Chrome will verify the document's signature against the publisher's public certificate. This will be `nytimes.com` for example. It is not using Google's certificate for this verification, and Google does not possess the private key required to modify the content and update the signature.
    - freeone3000 6y ago
      The actual mechanism by which a signed exchange is implemented is prone to man in the middle attacks by removing the Signature field wholesale. You are not requesting info from nytimes.com, you're requesting info from amp.google.com and trusting that the backing data is accurate. There's no need for a certificate to be presented at ALL! Unless it can be determined that such a header should exist, there's no way to verify its absence.
      - gregable 6y ago
        All this means is that any server can choose to present any bytes, even with TLS, as a response to any request. This isn't a novel observation. If a signed exchange includes a URL, that URL must be signed for the browser to respect the field.
        freeone3000 6y ago
        Right, but this means proposing signed exchanges as a solution to AMP's strategies is kind of nonsense, since it's a semantic problem whether a page is acting as a proxy for another, and a technological solution doesn't work here.
  - calcifer 6y ago
    I think we are talking about different things here. You, as an AMP engineer are talking about how Chrome implemented this [1], but I'm talking about how Chrome is not a user agent, because it demonstrably acts as Google's agent, not the user's. [1] Which is unverifiable, we just have to take your word for it.
    - lallysingh 6y ago
      Isn't chrome open source? Can't you verify it?
      - toupeira 6y ago
        Chromium is Open Source, Google Chrome isn't.
        lallysingh 6y ago
        The last time I checked, the only closed source parts were some profile sync keys and some media codecs.
        o-__-o 6y ago
        Oh well please keep checking for us, since all of us do not have access to Google Chrome source code. Thank you for taking on this responsibility, sure hope you don't get hit by a bus.
glenstein 6y ago
>A third party can provide delivery like a CDN, but they cannot modify the content, or the signature would no longer match. To make sure I understand, does this mean that in principle a third party other than Google can deliver the AMP pages? Is google working to facilitate that AMP hosting is open to everyone and calibrating their searches point to any and all alternative AMP hosters?
- madeofpalk 6y ago
  When you search for a term on Google.com, should that load request HTTP assets from multiple potentially-untrusted third parties?
  - prepend 6y ago
    If that best matches my query, then yes.
    - lern_too_spel 6y ago
      If a result matches your query, you would like the publisher to know even if the user never clicks on the result? Reread GP's comment.
  - glenstein 6y ago
    How is this reconciled with lern_to_spel's reply to my comment, where they claim this is already implemented and there already are such third parties? Are Google searches right now that use AMP exposing users to risks because they are currently requesting assets from potentially untrustworthy third parties?
- lern_too_spel 6y ago
  AMP hosting is already open to everyone, and multiple third parties other than Google deliver AMP pages.
  - glenstein 6y ago

calcifer 6y ago

> The useragent (browser) enforces this. This assumes the user agent is actually an agent of the user, and not the AMP provider, which is demonstrably [1] not the case. [1] https://github.com/w3ctag/design-reviews/issues/467#issuecomment-581944600 https://github.com/w3ctag/design-reviews/issues/467#issuecom...

gregable 6y ago
Chrome does enforce the matching signature. Browsers without Signed Exchange support will not likely ever get a signed exchange as they do not advertise support for it in the `Accept` request header.
- freeone3000 6y ago
  Chrome enforces that the signature being served by google is the same signature as the one being served by google. It's a useless verification. If Google were so inclined, they could very well just change the <link> tag too.
- gregable 6y ago
  @freeone3000, that's incorrect, in the case of Signed Exchanges. Chrome will verify the document's signature against the publisher's public certificate. This will be `nytimes.com` for example. It is not using Google's certificate for this verification, and Google does not possess the private key required to modify the content and update the signature.
  - freeone3000 6y ago
    The actual mechanism by which a signed exchange is implemented is prone to man in the middle attacks by removing the Signature field wholesale. You are not requesting info from nytimes.com, you're requesting info from amp.google.com and trusting that the backing data is accurate. There's no need for a certificate to be presented at ALL! Unless it can be determined that such a header should exist, there's no way to verify its absence.
    - gregable 6y ago
      All this means is that any server can choose to present any bytes, even with TLS, as a response to any request. This isn't a novel observation. If a signed exchange includes a URL, that URL must be signed for the browser to respect the field.
      - freeone3000 6y ago
        Right, but this means proposing signed exchanges as a solution to AMP's strategies is kind of nonsense, since it's a semantic problem whether a page is acting as a proxy for another, and a technological solution doesn't work here.
- calcifer 6y ago
  I think we are talking about different things here. You, as an AMP engineer are talking about how Chrome implemented this [1], but I'm talking about how Chrome is not a user agent, because it demonstrably acts as Google's agent, not the user's. [1] Which is unverifiable, we just have to take your word for it.
  - lallysingh 6y ago
    Isn't chrome open source? Can't you verify it?
    - toupeira 6y ago
      Chromium is Open Source, Google Chrome isn't.
      - lallysingh 6y ago
        The last time I checked, the only closed source parts were some profile sync keys and some media codecs.
        o-__-o 6y ago
        Oh well please keep checking for us, since all of us do not have access to Google Chrome source code. Thank you for taking on this responsibility, sure hope you don't get hit by a bus.

glenstein 6y ago

>A third party can provide delivery like a CDN, but they cannot modify the content, or the signature would no longer match. To make sure I understand, does this mean that in principle a third party other than Google can deliver the AMP pages? Is google working to facilitate that AMP hosting is open to everyone and calibrating their searches point to any and all alternative AMP hosters?

madeofpalk 6y ago
When you search for a term on Google.com, should that load request HTTP assets from multiple potentially-untrusted third parties?
- prepend 6y ago
  If that best matches my query, then yes.
  - lern_too_spel 6y ago
    If a result matches your query, you would like the publisher to know even if the user never clicks on the result? Reread GP's comment.
- glenstein 6y ago
  How is this reconciled with lern_to_spel's reply to my comment, where they claim this is already implemented and there already are such third parties? Are Google searches right now that use AMP exposing users to risks because they are currently requesting assets from potentially untrustworthy third parties?
lern_too_spel 6y ago
AMP hosting is already open to everyone, and multiple third parties other than Google deliver AMP pages.
- glenstein 6y ago