26 ms·

Apple already shipped attestation on the web, and we barely noticed

• superkuh 3y ago
  Google/Microsoft/Apple essentially did this with HTTP/3 too. None of their shipped browsers are able to connect to a non-"CA TLS" HTTP/3 endpoint. To host a HTTP/3 website visitable by a random normal person you have to get continued approval (every 3 months min) from a third party CA corporation for your website.
  • 2OEH8eoCRo0 3y ago
    What do you mean approval? You'd need a cert from an entity like Let's Encrypt?
    • superkuh 3y ago
      Yep. LetsEncrypt is great but everyone centralizing in them is not so great. Normal browsers having the ability to connect to a bare HTTP endpoint in HTTP/3 would solve any problems that might arise from this centralization. It's a straightforwards and easy thing to fix for the HTTP/3 lib devs and mega-corp browsers using those libs. But no one cares about it.
      • packetlost 3y ago
        Kinda surprised there isn't a few CAs that set up Let's Encrypt-like automated infrastructure that charge a small subscription fee for certificates. I'd pay $1-$3/m or so for preventing a mono-culture + big attack surface, but don't really want to give up the convenience of Let's Encrypt. I know there's a big barrier to entry for being a CA (as there should be), but it shouldn't be impossible.
        • Avamander 3y ago
          > Kinda surprised there isn't a few CAs that set up Let's Encrypt-like automated infrastructure that charge a small subscription fee for certificates. There are other ACME-compatible CA's.
          • packetlost 3y ago
            Oh? Examples?
            • capableweb 3y ago
              https://zerossl.com/ https://zerossl.com/ is a popular alternative. https://www.buypass.com/ https://www.buypass.com/ is another one I haven't personally tried.
              • ehhthing 3y ago
                Also Google Trust Services has free certificates although you need a Google Cloud project for it.
                • capableweb 3y ago
                  Not sure Google is a great alternative if you want to prevent further centralization of CAs :)
              • packetlost 3y ago
                Oh cool, I couldn't find those on Google. I'll check them out
        • seabass-labrax 3y ago
          I think that Let's Encrypt gets a lot of undeserved criticism for being the only major ACME-compatible CA. Yes, it's not so good to have monopolies on authenticity, but Let's Encrypt was founded by Mozilla, the EFF and the University of Michigan and was endorsed by the FSF. That's a pretty good set of organisations when considering the general status of the internet, and a set that doesn't overlap with the major players in consumer technology (Apple, Microsoft and Google).
      • cj 3y ago
        https://www.smashingmagazine.com/2021/08/http3-core-concepts-part1/ https://www.smashingmagazine.com/2021/08/http3-core-concepts... > While TLS 1.3 can still run independently on top of TCP, QUIC instead sort of encapsulates TLS 1.3. Put differently, there is no way to use QUIC without TLS; QUIC (and, by extension, HTTP/3) is always fully encrypted. Basically there is no HTTP/3 without a TLS certificate. I'm not sure what "problems that might arise from centralization" might be. There are many different TLS certificate providers from different CA roots. Is your gripe that you don't like TLS? Judging by how long the migration from TLS 1.1 to 1.2 took, I assume we're at least 10-15 years away from a world where everything is encrypted by default without backwards compatibility (if we ever get there at all).
        • superkuh 3y ago
          >Is your gripe that you don't like TLS? I'm flabberghasted that that's what you took away from my comments. I thought I was very clear. My issue is the lack of HTTP support in HTTP/3 implementations shipped by the mega-corps (CA HTTPS only). CA TLS is definitely the least worst solution we have and I am not against it. I am saying major browsers' HTTP/3 implementations lack of bare HTTP support in HTTP/3, combined with short TLS cert lifetimes these days, is effectively attestation and that's bad. "Basically there is no HTTP/3 without a TLS certificate." is bad. It could be slightly mitigated by the mega-corp implementations of HTTP/3 they ship accepting non-CA root based self-signed certs with a scaremongering click-through. But that's also no longer an option. If no company running a CA will give you a cert you'll simply be unvisitable (on HTTP/3). It makes the web something only for commercially approved sites.
          • ehhthing 3y ago
            > If no company running a CA will give you a cert you'll simply be unvisitable (on HTTP/3). This isn't technically correct. I believe on the security warning page you can type "thisisunsafe" (just blindly do it) and it'll let you through. At the very least this works for bypassing HSTS.
          • snowwrestler 3y ago
            It’s the opposite of the attestation scheme under discussion, because it requires the server to satisfy attestation, while the client can be whoever. Whereas the Apple and Google schemes require the client to satisfy attestation. I agree with you on the necessity of maintaining support for bare HTTP in the Web ecosystem. But I think you’re not likely to get as much support on this, simply because far fewer people run servers than clients. I kind of doubt that clients will ever connect exclusively via HTTP/3. I think browsers keep bare HTTP support. Maybe at some point it may be hidden behind a client config flag.
      • cyberax 3y ago
        Why? Just skip the CA verification when you use HTTP/3. Done. While this is less secure than a verified certificate, it still avoids plaintext on the wire and requires an active MITM to eavesdrop.
      • detourdog 3y ago
        I think the whole changing identity all the time is the exact opposite of a human system. The type of system only a computer could love. This seems like a such a wrong headed approach. LetsEncrypt favors constantly changing magic handshakes over long term good social behavior. Imagine a network where machines that misbehaved were ostracised instead of being able to register certificates frequently. I see the promise in the Fediverse as it's ability to develop reputations.
  • agwa 3y ago
    There are two reasons this is not comparable to the remote attestation proposal that Google is currently proposing: 1. The only things that WebPKI CAs are required to attest to is that domain validation was properly completed and that the private key is not compromised. The system is designed (in both intent and practice) for any website to be able to easily get a certificate, and even the most untrustworthy, undesirable websites can and do get certificates on the regular. In contrast, Google's remote attestation proposal is clearly intended to assess the trustworthiness/desirability of the client. 2. The TLS requirement imposes a burden on website operators but provides a clear benefit for end users, which is totally in line with the Internet's Priority of Constituencies[1]. In contrast, Google's attestation proposal places a burden on end uses for the benefit of website operators, which violates the Priority of Constituencies. Additionally, I must note that Firefox also requires a TLS certificate for HTTP/3 (as they did for HTTP/2). Not sure why you'd omit Mozilla from your list of browser makers doing this, but it's a misrepresentation to imply that this is something only "mega-corp browsers" do, when there is actually broad agreement that this is a good thing. [1] https://datatracker.ietf.org/doc/html/rfc8890 https://datatracker.ietf.org/doc/html/rfc8890
    • oceanplexian 3y ago
      All of these proposals are in fact the same thing. They're designed to obfuscate, complexify, and over-engineer the Internet to fuck people over. I don't care if my Magic the Gathering fan site has an auto-rotated 3 month expiry TLS certificate to "protect" the users. Those of us who have been online before the 21st Century see this exactly for what it is. A cash grab and a increasing mechanisms to tighten the screws of monopolies like AWS, Google, Apple, and Microsoft, and to lock down our devices and the web into a walled garden that only the tech giants can control.
      • Avamander 3y ago
        > I don't care if my Magic the Gathering fan site has an auto-rotated 3 month expiry TLS certificate to "protect" the users. You don't based on your threat model. Other people have other threat models. I don't want potentially tampered/malicious content/JavaScript hitting my browser, I can also simply not visit your site. Such a simplification can not be made on the wide (and hostile) web. TLS is trivial enough to be the norm. We can also draw parallels with food safety. Feel free to cook whatever you wish however you wish at your own home. If you want to offer it to people passing by on the street you have to follow food safety rules.
• gjsman-1000 3y ago
  Called it out a year ago: https://news.ycombinator.com/item?id=32282305 https://news.ycombinator.com/item?id=32282305
• disposition2 3y ago
  It looks like this can be disabled (on iOS)[1]: - Go to Settings - Select your user account at the top - Go to 'Password & Security' - Scroll down to Advanced and disable 'Automatic Verification' 1. https://blog.cloudflare.com/how-to-enable-private-access-tokens-in-ios-16-and-stop-seeing-captchas/ https://blog.cloudflare.com/how-to-enable-private-access-tok...
  • thoughtsimple 3y ago
    You can turn it off in macOS 13 as well. https://support.apple.com/en-us/HT213449 https://support.apple.com/en-us/HT213449 System Settings->iCloud Settings (your name)->Password & Security->Automatic Verification.
    • philote 3y ago
      I guess that's only for Safari, but not Chrome if you have that installed as well? Also, what if you never signed into your iCloud account? Is it impossible to disable?
      • madeofpalk 3y ago
        It's specifically a Safari technology. Chrome does not implement this.
        • kevincox 3y ago
          And can't without Apple's blessing as it isn't a "verified" browser.
      • lapcat 3y ago
        > Also, what if you never signed into your iCloud account? Is it impossible to disable? If you're not signed in, then it's not enabled, because the iCloud account is essential to the process: "An Apple server validates your device and Apple ID."
  • progbits 3y ago
• willcipriano 3y ago
  Why can't you fake remote attestation? I imagine it's a bit more involved than swapping a user agent but is there some magic mechanism that makes it impossible to spoof?
  • sidewndr46 3y ago
    On Intel & similar platforms, some forms of attestation are bidirectional. There is both a remote server attesting to the code's validity and the local device is able to attest that the code is ran in a manner that doesn't permit the user to modify or inspect it. This is the basis of almost all practical DRM methods and is provided under the guise of the Trusted Platform Module. One interesting application of this kind of technology was to remove the 'analog hole'. When playing protected content, even the video stream from your PC to your monitor is actually encrypted in a manner that ostensibly prevents anyone from interecepting it.
    • aftbit 3y ago
      Sorry for the nitpick, but that isn't the analog hole. The analog hole occurs when your monitor displays the video. At that point, you can point a camera at it and record the video, albeit with a loss in quality. Removing the analog hole would require pushing the attestation and encryption one layer further, into your brain or eyes.
      • sidewndr46 3y ago
        My perspective is the analog hole is all of the above: your eyes, the display, and the composite video connection (for an old standard definition TV) Closing 1 is better than closing none
    • mschuster91 3y ago
      > One interesting application of this kind of technology was to remove the 'analog hole'. When playing protected content, even the video stream from your PC to your monitor is actually encrypted in a manner that ostensibly prevents anyone from interecepting it. And yet, despite these fucking morons in the standard committees wasting (probably) millions of dollars in implementing CSS, HDCP and whatnot, and often enough bricked existing devices by revoking keys, HDCP strippers remain available for a dozen dollars or so on ebay, or AnyDVD so you don't have to bother with any copy protection at all.
• arianvanp 3y ago
  I think this is less invasive though. The Google proposal runs before content loaded into the DOM. Which means it can be used to do things like programmatically detect and block code injection like ad blockers. PATs are purely a server side thing. They don't give this kind of control. And don't perform a signature over the content
  • jsnell 3y ago
    PATs give exactly the same control. You could trivially require a PAT on the first page load, before the browser gets to receive any of the content. And header-based protocol can always be converted to a JS-driven protocol just by having the requests be issued from JS. Content-binding is a necessity for the actual intended use case of these protocols (abuse prevention), but useless for the thing people are afraid of (DRM for the web).
  • mike_hearn 3y ago
    How is it different? The server can just not send you content if you don't present a PAT.
• Santosh83 3y ago
  Maybe I'm wrong but Web Attestation will also be a death knell for Linux devices (not Android/Chrome OS) as far as being able to use them as equal clients to use the Web goes. They're simply too diverse and 'hackable' as a plotform for remote attestation to work reliably and thus they'll be excluded altogether (except a few 'blessed' distros that will then become industry controlled, and not Linux in spirit anymore).
  • smoldesu 3y ago
    If this happens, I expect the majority of Windows and Android devices to stop working too. They are also a diverse and hackable platform that is apparently insufficient for a future where I have to attest to owning certain hardware. > except a few 'blessed' distros that will then become industry controlled, and not Linux in spirit anymore You know, I hear this a lot but seldom hear the details of how it might happen. Industry-controlled UNIX is the reason Linux exists - if you take the spirit away from Linux, it gets forked into another community project. Unless you're stripping it of it's GPL license, Linux will be "Linux in Spirit" until it stops being used altogether.
    • Avamander 3y ago
      Not the majority, just a *lot* of older ones. New Android phones have hardware-backed SafetyNet, new Windows devices have Trusted Boot (not to be confused with Secure Boot). Both can and will be used to attest the browser environment. Linux devices will get hit (unless I guess we see locked down signed kernels, Chromebook-like things).
      • treprinum 3y ago
        It's really slowly boiling frog situation playing out over the past 20 years. Since Aegis bootloader outlined how trusted computing will be created with predictions of allowing Internet access only to attested devices/people, we seem to be at the brink of somebody flipping the switch. Other predictions contained historic data/web changing as politically convenient with nobody being able to access/view the old original anymore due to only attested devices available.
• lifeisstillgood 3y ago
  I kind of get both sides here. If we take the "see the best of others intentions" then a web that is populated by identified humans (and their authorised proxies!) is likely to be the "cleanest", most ideal web space we can see (a web full of sock puppets and link farms is not ideal). The clearest end point for this is some government issued digital ID that just asserts who you are, acts as a login etc. You can see this as a stepping stone to there. if you squint. Is it the idealism of the 70s coke to life? No. Is it some sane compromise - I think so. What if we cannot trust our government ? Sorry it is pretty sure that no internet is going to solve that. That's on the real world.
  • Avamander 3y ago
    > The clearest end point for this is some government issued digital ID that just asserts who you are, acts as a login etc. Already exists in a bunch of countries. Works better in some than in others. The issue is that you don't want everything tied to that ID. In a less than ideal world, ideally the ID would just attest that some random pseudo-ID is real. Like Webauthn, kinda.
    • hellojesus 3y ago
      How would a user ever verify that every attlestation/id check isn't recording their web activity?
      • Avamander 3y ago
        Hash and sign functions usually don't allow reversal of those operations. Attestation doesn't require more cryptography. It's kinda silly to start discussing implementation details of something that doesn't exist. Not to mention considering the alternative which is quite a bit more invasive than having an attested private pseodoidentity would be.
        • hellojesus 3y ago
          I'm less concerned with reversing hashes and more concerned with tracking via the attlestation provider. What is stopping them from recording the value returned to you that is then passed to the site you tried to visit? Does the data provided to the integrity checker allow for identification? Could the original vendor pass some value to use in the integrity check to prevent replay attacks, and could that value itself encode your personal information?
• gooob 3y ago
  what even is the reasoning they have for proposing and implementing this?
  • deleted 3y ago
    [deleted]
  • capableweb 3y ago
    Pretty clear from the announcement ("Challenge: Private Access Tokens" - June 9, 2022 - https://developer.apple.com/news/?id=huqjyh7k https://developer.apple.com/news/?id=huqjyh7k): > Private Access Tokens are powerful tools that prove when HTTP requests are coming from legitimate devices without disclosing someone's identity The value add is pretty clear and good, but the downsides are probably bigger than the value add, so personally I wouldn't say the compromise is worth it.
    • gooob 3y ago
      oh yeah, i read up on it from the explainer right after commenting. should've updated that sorry
  • ezfe 3y ago
    Allow Apple devices to browse the web with fewer captcha interruptions, etc. and be more trusted as non-bot devices.
    • FabHK 3y ago
      > Allow Apple devices to browse the web with fewer captcha interruptions In particular, while using a VPN or Tor. So in one sense it’s even a pro-privacy move, insofar as it allows to distinguish a human user on a legit device using a VPN from a bot using a VPN (upon which the server can present a captcha or denial to the latter, but not the former, making it less onerous for average users to use a VPN).
      • concinds 3y ago
        I hate how websites hinder VPN users. Google Search often shows me captchas on Mullvad, and sometimes blocks my request entirely (no captcha). Screw them. I don't see the issue here at all. Apple added this because otherwise the web would be completely broken in iCloud Private Relay due to the constant catchas and hardwalls. Google wants to add it to kill adblockers entirely. It's not even the same ballpark.
• sam0x17 3y ago
  But signing necessarily is happening on the user's device... what is to stop brave/etc from also signing their outgoing requests with the same key your local Chrome install is using? On a mobile device I can see how this would work but how would this ever work on (non-apple) PCs without exposing the key to anyone willing to poke around a bit?
  • ReactiveJelly 3y ago
    I think the idea is, there is a chain of trust from a TPM (So you don't have access to the private key, ever) through the bootloader, OS kernel, Windows Update, and vendor-blessed web browser, to the server. So Brave would fail when Windows says, "hm, your hash doesn't match any recent Edge version, so you don't get to issue a key signing request to the TPM." Or it will allow the request but when it arrives at the server as "Windows, non-Edge browser" they'll hit you with the endless CAPTCHAs or just boot you out as a hacker. It's not the web I grew up in.
    • sam0x17 3y ago
      Right but how does edge prove itself to the TPM, what's to stop [insert alt browser here] from performing the exact same actions [insert blessed browser here] performs when it interacts with the TPM. It could even emulate a legitimate browser internally for the sake of argument, but it seems like anything could just pretend to be a blessed browser. Sure, you can hash binaries, but you can just as easily mess with their memory space at runtime after the fact so to the TPM (or whatever system checks the hash) the binary checks out because all the modifications are side-loaded after the binary runs. It seems to me like you can only guarantee no tampering in an actually locked down system, like modern mobile devices.
      • jsnell 3y ago
        The browser doesn't interface directly with any of the hardware, the operating system does. And the integrity of the operating system can be attested to by the hardware via a chain of trust all the way to the secure bootloader.
• swayvil 3y ago
  Paranoia has become the norm. (He says from his securely anonymous account).
  • DANmode 3y ago
    There goes half of your cover!
• deleted 3y ago
  [deleted]
• jchw 3y ago
  I actually noticed this (and considered blogging to myself about it) but in practice the only reason why this was not seen as an issue (IMO) is because it being implemented only on Apple platforms meant that there was no possible way you could really limit your services using it. It was just an additional thing people could use as another signal. However, the Google proposal is explicitly concerned with pushing this as an always-on feature. > However, a holdback also has significant drawbacks. In our use cases and capabilities survey, we have identified a number of critical use cases for deterministic platform integrity attestation. These use cases currently rely on client fingerprinting. A deterministic but limited-entropy attestation would obviate the need for invasive fingerprinting here, and has the potential to usher in more privacy-positive practices in the long-term. All Apple implementing it ahead of time is proof of is that anyone hoping Apple will save us is naive.
  • codedokode 3y ago
    > A deterministic but limited-entropy attestation would obviate the need for invasive fingerprinting here, and has the potential to usher in more privacy-positive practices in the long-term. In reality: an attestation will be used along with fingerprinting.
• captainmuon 3y ago
  Remember AllAdvantage? That was a service around the turn of the century that showed you ads on your desktop and paid you for it. But only if you were actively using the PC. People used mouse wigglers to fake it and there was a little arms race. This tech would be their wet dream. You could tell if a request is from a real browser or from a script. You could disable attestation if an untrusted driver is used (to simulate inputs) or the web browser is automated otherwise. Really disturbing tech.
  • kccqzy 3y ago
    > You could tell if a request is from a real browser or from a script. Today websites already know if the request is from a real browser or not just by integrating with reCAPTCHA or hCAPTCHA. This is just taking a very popular category of security product and tightly integrating it with the browser itself. Today, you can take a philosophical stance and categorically refuse to use any website that uses reCAPTCHA/hCAPTCHA. Tomorrow you can take a philosophical stance and refuse to use any website that uses PAT.
    • t0astbread 3y ago
      The big difference then vs. now is that with CAPTCHAs you can (generally) choose to complete them from a wider range of browsers and devices that have no corporate approval (unless it's that one Cloudflare CAPTCHA that gets stuck in an infinite loop). So even if it's painful, you can still access most websites. With attestation you don't have that choice.
    • S201 3y ago
      You're missing a huge difference here: A captcha works on top of the existing web. I can use it on any platform to prove that I am a human. Whereas the proposal/implementation here effectively locks out any platform not explicitly allowed by the website operators. That is a huge blow to anything not from Google/Apple/Microsoft. Open source and any potential new entrants to the market would be dramatically limited if not killed entirely.
• tempodox 3y ago
  > limiting access to features or entire sites based on whether the client is approved by a trusted issuer. In practice, that will mean Apple, Microsoft & Google. Wait, does that mean they decide what websites I can visit? That doesn't sound dystopic at all.
  • water9 3y ago
    [flagged]
  • kevincox 3y ago
    No, it is the other way around. The website decides if your software stack is allowed to view them. 1. Windows to old? Blocked. 2. Running FreeBSD? Blocked. 3. Patched your version of Chrome? Nope. 4. Your Linux distribution isn't approved? Blocked. 5. You want to use some obscure Chromium derivative? Absolutely not. 6. Running a RISC-V machine? LOL get lost. Basically the user-agent is no longer the agent of the user. Instead the website can select which hardware and software stack can be used to access the website. The inevitable outcome is that a huge number of sites will only allow OSes from Microsoft, Apple and Google running official browsers by the same three megacorps. Everything else will be blocked.
    • hellojesus 3y ago
      We then devolve into an arms race of kernel 0days in order to access services while running FreeBSD?
      • kevincox 3y ago
        It is true that there is a large software stack that needs to be "perfect" for this to work flawlessly. But look at iOS. It does appear that highly motivated corporations can keep a fairly secure stack of this size. iOS jailbreaks are few and far between. They do regularly occur, but not often enough for this to be a convenient solution.
        • hellojesus 3y ago
• water9 3y ago
  Its flat out bad business to exclude customers period. Figure out a way to have your customers not fight in line sure, but never shorten the line unless it is absolutely necessary (ie criminal)
  • freedomben 3y ago
    It's worse business to get hacked or sued, especially if you're a bank.
    • water9 3y ago
      Oh, so you think it’s not possible to get a new identity?
  • Mindwipe 3y ago
    Losing half a percent of your traffic to get rid of 80% of spam, malware and DDOS attacks is pretty much always worth it and good business.
    • water9 3y ago
      That tradeoff exists in your mind only. IRL it's not like that.
• 0xbadcafebee 3y ago
  I am actually rooting for the web to die, so I say bring on all the competition-killing features Google can muster. It's only in the face of an extreme and impossible choice that people will finally wake up. Giving up the entire user-facing compute ecosystem to a hypertext markup viewer has held back technological advancement for nearly two decades. Computer chips are now 4 nanometers and solid state storage is reaching the speed of RAM. But we're still churning out platform content line-by-line, by hand, like digital punch cards, because apparently it's technologically impossible to invent the equivalent of PowerPoint for web pages, or, god fucking forbid, not using HTML, CSS, and JS to create customer-facing applications. Yes, the web is a great success story. But it's also backwards and ancient, and has been limping along by stuffing an entire operating system into a program made for viewing hypermedia. Are we going to wait 20 years to advance past these limitations? 40 years? 100 years? At what point will people finally fucking say "hey, maybe let's not kill ourselves jumping through hoops just to show pictures of cats and tax prep programs?"
  • pphysch 3y ago
    You have over 16000 karma on this here orange site. You do realize it will follow the cat pics and tax prep programs to oblivion, right?
    • 0xbadcafebee 3y ago
      I would give all my karma for the rest of my life if it could convince the industry to make it easier for average humans to create things faster, easier, and better, without writing code. Do graphics designers have to write code to create a poster for a concert? Do executives have to write code to create a powerpoint slide? Do financial analysts have to write code to balance taxes in excel? Do students have to write code to compose rich-text formatted documents? Do kids have to write code to create entire cities in minecraft? No, no, no, no, no. But if you want to create a personal home page, hoooo boy, get ready to learn 3 SaaS services, 5 languages, 7 frameworks, 14 tools, and 28 paradigms. When I was 16 and found Visual Basic, I created a networked, graphical application for sharing homework in about a week. Not knowing anything about programming. That is what we should be doing to make applications. Not fucking around with god damn HTML, CSS, JS, Flask, Squashify, Zentillion2, Uberstuber, Flimflam Candygram 4.0, and more. Just give me Visual Basic that will compile for a phone, tablet, and a desktop. We could get so much more done with much fewer people, time wasted, complexity, cost. We wouldn't be beholden to "the web". Computers could actually grow to do more than is allowed by the "browser ecosystem", if we didn't have to use browsers to make and run apps.
• uwagar 3y ago
  im gonna remove even https from my server. gotta go http in protest against this nonsense. i'm already pissed off that firefox warns people that my site is unsafe for them when i dont even stick a cookie on them and yet provide useful Free software.
  • Avamander 3y ago
    That's like pissing in your own pants to try and keep warm and you weren't cold in the first place.
    • uwagar 3y ago
      i mean if i'm not tracking the user at all, why should i use https?
      • hellojesus 3y ago
        To prevent isp or mitm injection... ISPs have a history of injecting ads into http connections.
        • 0xbadcafebee 3y ago
          They're right though. The browser should have had a mode that ensures integrity without privacy (it's trivial; use PKI to sign the content, send the signature as a header, client validates the signature, and you have integrity over plaintext; or just a form of HSTS, if you don't need PKI, because if HSTS is good enough for certs, it's good enough for anything ELSE, right?). There could be protocol extensions that support clients only loading dynamic or identifying content for specific requests. All sorts of features could allow basic plaintext connections with public content to be as secure as HTTPS. But the browser oligarchy doesn't want to allow that. They want to force everything to be private, which has caused tons of issues on the internet. And actually, it has strengthened the oligarchy, by forcing us to use private services (such as DNS-over-HTTPS, VPNs, CDNs, etc) which locks more of the internet into the control of a tiny handful of super powerful companies. To the point where if one of them decides to change something, it ripples across the entire internet, and everyone is forced to adopt it or break everything. Crazier still... HTTPS isn't even that secure! Every year there are examples of valid certs being created for MITM. There are multiple vulns that work at any time. Mitigations that are optional and only a tiny fraction of the web use. And cert expiration, HSTS, and other issues still take down sites accidentally. But they force everyone to use it anyway!
• h4x0rr 3y ago
  Rip internet
• lbriner 3y ago
  The problem with most of these systems is they can never cope with any edge cases. This means it works fine for 99% of the population but the other 1% can get stuffed. It would be like having a robot deny you access to the office after work hours even though you only need to grab your car keys that you forgot. The system is designed to be secure so you can't talk your way past a robot. If it was a human, it would be much easier to reason with them (normally!) and find a solution that works. Techies gonna tech though. "If there was a problem yo I'll solve it, check out my tech while the DJ revolves it."
  • lbriner 3y ago
    Another problem is what is the actual root of the attestation? If it was the means to say, "yes this is a real person" it might be useful but this is simply system attestation so no real way of knowing whether it would stop bad actors from doing bad stuff and whether it would be misunderstood and misused like many other systems (CORs anyone?) The logical conclusion of this system is "if you have a legit system, you are legit; if you don't you aren't".
  • kccqzy 3y ago
    > If it was a human, it would be much easier to reason with them (normally!) and find a solution that works. The Internet has shown that if you drive down the cost of interacting with this human gatekeeper to zero (you can be anywhere in the world rather than a specific place and time), social engineering attacks inevitably result. That's how we get hackers getting into your bank accounts just because they are eloquent and they make a great case reasoning with the human gatekeeper.
• chrjxnandns 3y ago
  Does Microsoft already do this with Edge,Safari, and Chrome? https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions#supported-browsers https://learn.microsoft.com/en-us/azure/active-directory/con...
• renewiltord 3y ago
  Interesting. Makes puppeteer and friends hard. Perhaps also makes it hard to have an alternative browser. Doesn't sound good.
  • fruitreunion1 3y ago
    yeah, I liked being able to archive and scrape web content with yt-dlp, gallery-dl, and similar tools
• danShumway 3y ago
  The most important section of this article: > This feature is largely bad for the web and the industry generally, like all attestation (see below). > That said, it's not as dangerous as the Google proposal, simply because Safari isn't the dominant browser. Right now, Safari has around 20% market share in browsers (25% on mobile, and 15% on desktop), while Chrome is comfortably above 60% everywhere, with Chromium more generally (Brave, Edge, Opera, Samsung Internet, etc) about 10% above that. > With Safari providing this, it can be used by some providers, but nobody can block or behave differently with unattested clients. Similarly, Safari can't usefully use this to tighten the screws on users - while they could refuse to attest old OS versions or browsers, it wouldn't make a significant impact on users (they might see statistically more CAPTCHAs, but little else). > Chrome's usage is a larger concern. With 70+% of web clients using Chromium, this would become a major part of the web very quickly. With both Web Environment Integrity & Private Access Tokens, 90% of web clients would potentially be attested, and the "oh, you're not attested, let's treat you suspiciously" pressure could ramp up quickly. ---- It's bad that Safari is shipping attestation, but a big reason why Safari often gets a pass on negative features that Google doesn't get a pass on[0] is because Chrome has a 60% market share, many sites are tested only in Chrome, and Chrome's marketshare is only likely to grow in the future once we finally get Apple to finally allow alternate browsers on iOS. In contrast, Safari's marketshare is pretty much tied only to iOS and Mac, and they don't even have a monopoly on Mac. Like it or not, it matters more when Chrome breaks the Internet. I'm not saying we should ignore Safari (we definitely shouldn't), but if that "double standard" makes anyone upset, perhaps that's a good reason to break Google up and introduce more browser diversity. If Chrome didn't have a 60% marketshare over the entire web, it would be possible to extend more grace to the people proposing experimental features within Chrome. The extra scrutiny and tougher standards, and even the lower leeway to make mistakes are partially consequences of being the dominant browser in the marketplace. I'm sorry, but the standards are higher when you're in a position where it's possible for you to break everything. ---- [0]: see Manifest V3, which is also based heavily on Safari's own adblocking restrictions, which are similarly harmful to adblockers but tend to get a lot less attention.
  • jsnell 3y ago
    So Apple may provide a way to prevent their users from seeing captchas, but their competition is not allowed to. You see why this is a morally bankrupt position to hold, right? "Tired of seeing all those captchas? Get an iPhone or a MacBook."
• toyg 3y ago
  This might be where the internet really gets forked, as it's been predicted over and over since the '90s. On one side, we'll have a "clean", authority-sanctioned "corpweb", where everyone is ID'ed to the wazoo; on the other, a more casual "greynet" galaxy of porn and decentralized communities will likely emerge, once all tinkerers get pushed out of corpnet. It could be an interesting opportunity to reboot a few long-lost dreams.
  • bestouff 3y ago
    ... until your phone and OS web browser will refuse to connect to the "greynet", or that just attempting to do so has you categorized as being a potential outlaw.
    • readyplayernull 3y ago
      ... that in turn will trigger a new age of open devices, browsers and OSes.
      • RcouF1uZ4gsC 3y ago
        There are only a few companies that can produce state of the art chips and those companies are easily regulated by the government. These open devices would be running slow hot CPUs compared to the newer faster chips that the non-open devices would be running.
        • willcipriano 3y ago
          You don't need state of the art. We had supercomputers in our pockets a decade ago.
          • Jolter 3y ago
            Still most consumers are unwilling to pay a premium for open hardware software. A thinner phone with a faster experience and better battery life seems to be all we care about. C.F. how repairable devices are a marginal part of the smartphone market. Most people are not even willing to pay a few cents extra for a banana that didn’t cause cancer on plantation workers.
• vessenes 3y ago
  This feels like such a juicy and divisive area to me. There are an immense number of use cases where we'd like to know we're talking to a 'trusted' hardware and software stack on the web. For many years now, we have just assumed there is little to no trust in the stack, and architected and built accordingly. It adds an amazing amount of complexity and cost, limits features, and makes everything way, way harder than if you could assume a trusted stack. At the same time, as is being pointed out quite vocally right now, 'trusted' is a very, very difficult concept when large tech monopolies are involved. On the one hand, it's difficult because there are only a few companies in the world that can field large tech teams that deal with persistent threat actors, and therefore, it would be very nice to be able to trust the security promises made. And, if those promises are trustworthy, they are better promises than any individual can make for their own software and platfoms. On the other hand, if you're a hacker (in the platonic sense), 'trusted' immediately codes to 'monopoly-backed', along with 'probably back-doored by a local government agency' and we head one more step down the primrose path of control, lack of innovation and finally perhaps a fascistic technology future controlled by a few players. Ultimately, I think the solution here can only be successful if it involves a trustable, open hardware certification technology that's not registry based, e.g. can create strong local proofs that are independently verifiable. There are a few tech companies I know of working on this on the silicon side, but it's a very difficult problem, and I'm not clear if there's really enough demand to make them viable right now. I guess I personally come down to leaving this turned on in Safari for now, and seeing what happens over the next year or two.
  • zb3 3y ago
    In practice "trusted Android" means Android shipped with Google adware and spyware (and possibly much more vendor-specific bloatware) which you can't remove. One can clearly see that it might not really be about trust..
  • saurik 3y ago
    For me it is about for whom the supposed "trust" or "security" is offered: DRM-tech is discussed using these terms, but the goal is to afford trust to the developer or content owner, not the user.
• codedokode 3y ago
  Cannot attestation in Chrome be "fixed" by patching an attestation function so that it always returns true (even if there is an adblocker)?
  • Avamander 3y ago
    Maybe initially (like Widevine L3). Then they'll expect your OS to attest the browser's integrity and your firmware to attest the OS's integrity.
  • c0l0 3y ago
    That is not possible, because the User Agent (UA) does not return a simple boolean value to the endpoints that requests attestation.That endpoint requests a cryptographic proof that originates at a shared root of trust between that endpoint and the device you are using (which has an embedded secret that its user cannot extract, and which was blessed by this shared root of trust with a cryptographic signature at the device's factory). Being able to generate that proof will attest that your device, its operating system, the software it has installed, as well as the UA have all been deemed acceptable (i.e., cryptographically signed by something/someone that root of trust has extended its trust to) by the attestation arbiter - so probably either Apple, Google, or Microsoft.
  • tamimio 3y ago
    I think most likely it will be something like private/public key challenge I don’t think you can just tweak it from your side, but I could be wrong.
  • devsda 3y ago
    First, there's nothing to patch as it would probably need a cryptographic challenge response flow and not a simple yes or no. Even if there's a patch, it would be difficult because there are other pieces of attestation that are already in place all the way upto the browser. You cannot patch executables because os can verify executables via code signing signatures. You cannot "patch" important parts of your OS (outside any zero days) with secure boot enabled(they can reject user keys for attestation).
• meandmycode 3y ago
  Some of the takes about why attestation is bad seem purposely false because the author dislikes the feature. If attestation isn't triggered then prior behaviour will happen (captcha etc).. this is a progressive feature.. and the point of the attestation isn't to prove you're using an approved device, it's to prove a human is actually present, of which, a verified software stack is needed, otherwise the feature is useless..
  • dahwolf 3y ago
    It doesn't prove that a human is present at all.
    • meandmycode 3y ago
      It actually does, that's entirely it's purpose.. I know it takes a little effort to actually go and research yourself, but here you go https://developer.apple.com/videos/play/wwdc2022/10077/ https://developer.apple.com/videos/play/wwdc2022/10077/
      • dahwolf 3y ago
        You must have never heard of test automation with real devices? No human there, still passes this check.
        • meandmycode 3y ago
          Even if that's true (apple is a bit ambiguous here because they say passcode login is enough), this is still connected to a need to login physically, it sets a much higher cost of acquisition for most.. plus this isn't relevant.. the tech is still aimed at proving real human interaction, even if it's not perfect at that today..
  • deleted 3y ago
    [deleted]
  • Zinu 3y ago
    > If attestation isn't triggered then prior behaviour will happen That’s up to the web server to decide, it could just block you instead, and there is incentive to do exactly that. > attestation isn't to prove you're using an approved device That’s what it is doing though, so it can and will be used for that.
• fxtentacle 3y ago
  Once this goes mainstream, someone will offer a service where a robot arm operates an iPhone for you and streams back the screen video. Like remote desktop into a VM, except that it's a real device which passes all of the attestation. And it'll be glorious for spammers to finally be counted as "more human" than actual humans (using Android) ...
  • tamimio 3y ago
    ahmm, I did the robot arm already in a previous project where you can control all the fingers remotely over the the internet, we just need to figure out the streaming part and we got ourselves a startup :) >https://tamim.io/random_shares/robot_arm_over_internet_tamimi.mp4 https://tamim.io/random_shares/robot_arm_over_internet_tamim...
  • EvanAnderson 3y ago
    Once you've got that going feed the stream and control functionality to an AI. Then it can browse the web as a "verified human".
• tshaddox 3y ago
  I have a genuine question: why is this worse than normal captchas which the human must interact with directly? Or is any mechanism that attempts to prevent certain methods of “unattested” web access (e.g. curl or screen readers) bad for the same reasons? And if the answer to the second question is “yes,” it makes me wonder why we’re even okay with (non-personal) content in the web being login-walled or pay-walled.
  • Avamander 3y ago
    Because you can complete captchas on "unsanctioned" devices, such as your Linux PC or the DIY Windows PC you built for your grandma.
  • tamimio 3y ago
    Because as long as this mechanism isn’t automated and should be done manually, it would be impossible to have an aggressive captchas for example because you will lose all users, but if most users are now automated, expect a captcha or similar every time you load a page or scroll while using your privacy-friendly browser, rendering the whole process unbearable.
    • tshaddox 3y ago
      I certainly see how that would be frustrating, but this is also true of login walls or paywalls even without considering any automation. As an example, I think it's bizarre that the Hacker News guidelines encourage links which are paywalled.
      • tamimio 3y ago
        >I think it's bizarre that the Hacker News guidelines encourage links which are paywalled. 100% agree!! You can’t even complain about it either! That’s why I always upvote (even though I personally don’t like such systems) who post the archive link for such articles.
• Mindwipe 3y ago
  It did make me laugh in the other threads when people were saying "Safari will save us!" Like the only chance of Apple not doing this is if they were deliberately trying to sabotage web apps.
• mdale 3y ago
  In practice we depend on attestation via federated login and a series of captchas for some indicator of humanness for services that are freely available to avoid significant abuse and attacks. With captchas no longer being practical there is some need of federated attested value of a network actor? Maybe there is a use for Blockchain after all :P to anonymously bucket human actions like buying something or device registration chain sourced from manufacturer or cell phone service provider in such a way that it has a short TTL and has to be regularly revalidated. It need not be perfect but we are entering new territory with LLMs that can easily represent human agency short of some web of trust or signed identity mapped back to something.
• skybrian 3y ago
  A possible difference between private access tokens and the web integrity proposal is the idea of “holdback” which means that for some reasons chosen at random it would fail to work, and any websites that use it would be forced to have alternative fallback mechanisms. Why bother, then? This is for things like captchas and credit card risk scores. It’s useful to be able to know that some users are low risk (not a bot, not being phished) and then to have additional verification for others. It’s listed under “open questions” but I think it would go a long way towards preserving an open web.
  • dahwolf 3y ago
    The type of websites requiring advanced anti-abuse tactics currently make heavy use of fingerprinting techniques. Google's idea that fingerprinting will cease to exist if this is implemented is a joke.
    • skybrian 3y ago
      If all efforts at coming up with a suitable replacement are thwarted, I think it's safe to say that fingerprinting will continue and increase. It's not like businesses are going to stop caring about bots and fraud. Fraud and anti-fraud are big businesses.
• tamimio 3y ago
  As long as the mechanism will be open source standard and isn’t controlled by corporations AND the user browsers are in control to enable/disable it, sure.
  • VoxPelli 3y ago
    It is an open standard: https://datatracker.ietf.org/doc/html/draft-ietf-privacypass-auth-scheme https://datatracker.ietf.org/doc/html/draft-ietf-privacypass... "Privacy Pass tokens are unlinkable, one-time-use authenticators that can be used to anonymously authorize a client" People from Apple, Google and Cloudflare are all editors of the spec and eg Fastly has also blogged about it: https://www.fastly.com/blog/private-access-tokens-stepping-into-the-privacy-respecting-captcha-less https://www.fastly.com/blog/private-access-tokens-stepping-i... Excerpt from Fastly's article above: > When you put this together, no one entity can link client identity to website activity. And yet, this authorizes access to a website – all while eliminating human interactions.
    • hellojesus 3y ago
      What mechanism exists to prevent the attester from colluding with the issuer or origin to track users? Could a government subpoena these entities to track entire user history down to the tpm key?
• sdwvit 3y ago
  I have spent a lot of time working on integrating private access tokens into my project, and I believe I understand how it works. I do not agree with the article’s points on why this bad. PATs are meant to reduce browsing friction, not increase it. Now if you are trying to google something under a spammy vpn node, you get either a captcha or fully blocked. With PAT, your device can guarantee you are not a spammer, and system would let you through without captchas or timing you out. This is all it does. If your device is not capable of signing PAT, then it is supposed to just fallback to default behavior.
  • freedomben 3y ago
    You're not thinking fourth dimensionally. Yes that's how it is now. But the majority of users aren't using PATs so if you want people using your website you have to provide a reasonable experience for unverified users. Once 99% of users are using PATs, you'd be stupid not to require them. Severely degrading (through captchas) or outright blocking unverified clients would be trivial. Hell, I'd wager firewall software will even show you these blockages as "blocked attack" or "blocked dangerous client" or something like that.
  • howinteresting 3y ago
    Even if we assume that captchas are the only thing this can be restricted to (which, if attestation is widely deployed, they won't be restricted to), why is it good to make people using locked-down Apple devices with logged in Apple IDs have fewer captchas? It's a protection racket.
• sebastianconcpt 3y ago
  This proposal amounts to attestation on the web, limiting access to features or entire sites based on whether the client is approved by a trusted issuer. In practice, that will mean Apple, Microsoft & Google. I'm afraid that it doesn't mean Apple, Microsoft & Google but the ruling party of governments. In other words, the mix of propaganda and censorship controlled by the party. Truly dystopian.
• mongol 3y ago
  Which websites would be interested in this? For online shopping, not so much, if it decreases sales, it is bad for them. Social media? Perhaps, but I can go without that if it comes to that. What I fear most is access to banks, tax office and similar. I need to access that and I currently use Linux. I am not keen on switching.
  • kotaKat 3y ago
    I mean, last I checked things like the McDonald's app on Android need to pass SafetyNet attestation, which seems really stupid just to buy a burger...
• mschuster91 3y ago
  > Attestation blocks users' control of their own devices, by design. A key goal is that users using modified software should not be attested as legitimate. I would like to be able to browse the web on my rooted Android phone please. There's no way any fully user-modifiable OS or hardware can ever be attested in the way these proposals intend. Oh so that shit is why I regularly run into Cloudflare issues on my rooted Android tablet. Not enough that I have to fight cat and mouse with Play Store, Netflix, Google Pay and my banking apps, but now half the Internet. Seems like they ramped up the bullshit silently at the same time for everyone on mobile but not on an expensive iOS device. I used to respect Cloudflare. Not a single second longer. Fuck you all for being complicit.
• reaperducer 3y ago
  This article does a pretty good job of explaining what's going on. For non-technical folks, think of it as "Papers, please!" for the internet.
• freedomben 3y ago
  > That said, it's not as dangerous as the Google proposal, simply because Safari isn't the dominant browser. Right now, Safari has around 20% market share in browsers (25% on mobile, and 15% on desktop), while Chrome is comfortably above 60% everywhere, with Chromium more generally (Brave, Edge, Opera, Samsung Internet, etc) about 10% above that. I don't agree, in fact I think it's equally as bad for Apple to do it as Google. Apple has completely let us down. If Google forced it through but Apple refused, it would never be practical to enforce it. The numbers may not be as high, but they're plenty high enough that you couldn't cut all iDevices out. Apple and Google and Microsoft are the only three that really matter.
  • Y-bar 3y ago
    You should meet my web developer colleagues. They consistently insist that I should switch from Firefox to Chrome any time I point out that something they implemented was not cross-browser compatible. Never once have anyone said that I should switch to Safari to get something to work. I think that speaks volumes.
  • supriyo-biswas 3y ago
    Apple has PATs though, which could serve as a replacement for WEI.
  • elishah 3y ago
    > If Google forced it through but Apple refused, it would never be practical to enforce it. The numbers may not be as high, but they're plenty high enough that you couldn't cut all iDevices out. Yes. Up until now, the amount of Google bullshit that Safari has saved us all from is _staggering._ It is unfortunate that this won't be another catastrophe deflected. This is also why I'm concerned about legislation requiring Apple to open up sideloading onto their devices. As much as I love the idea of people having control over their own systems, in practice I'm afraid that it's just going to be the final nail that solidifies Google's complete control over the web all the way out to the client.
    • manderley 3y ago
• chayesfss 3y ago
  [dead]
• lifeisstillgood 3y ago
  One interesting (to me) thought is that while HNers are generally worried about what we can lose here (in the curated world) many non techies are likely to see such a bifurcation in car transport. At some point soon self driving cars are going to get good enough that they can be used on many roads and cities - but I seriously doubt they will be good enough to be used in a mixed environment (pedestrians, human drivers, snow ice etc). So there will be a push to have self driving cars (convenient taxi style) on isolated roads - sort of a weird inversion of pedestrianisation. Maybe Barcelona style super blocks with only 15mph self driving cars allowed? I don't know - but the impact will be people who used to drive their petrol manual cars around town find parts of town locked off. And it's not anti-car it's anti-freedom-car. Just a passing thought
  • hnlmorg 3y ago
    We already have that in the form of public transport. The reason people get cars is because they want the convenience of door to door transport. If self driving cars cannot do that then people aren’t going to bother with self driving cars.
• modeless 3y ago
  Yesterday, the sentiment on Google's early proposal was "company breakups start to make a lot of sense", "Go f yourself, Google", "It's maddening and saddening", "[the people involved] reputations are fully gone from this". Today it turns out Apple not only proposed but implemented and shipped the actual feature last year. "It could be an interesting opportunity to reboot a few long-lost dreams". "I kind of get both sides here". "I guess I personally come down to leaving this turned on in Safari for now, and seeing what happens". Granted, the overall sentiment is still negative but the difference in tone is stark. The reality distortion field is alive and well, folks.
  • kccqzy 3y ago
    Totally agreed. Apple's marketing is simply the best. Google on the other hand, repeatedly let its reputation erode by a loud minority of Google haters without doing any PR to control the narrative. As if they still believe that one echo of "don't be evil" could still reverberate after twenty years.
    • redeeman 3y ago
      > loud minority of Google haters translation: loud minority of people who has a clue what Google really does
      • icantbebothered 3y ago
        [flagged]
      • deleted 3y ago
        [deleted]
    • yyyk 3y ago
      Apple long understood that the best way to sell a product is not as a product but as a cult.
  • acedTrex 3y ago
    They aren't implementing it as a common browser standard
• novok 3y ago
  A lot of the push for these things come from fraud, and a lot of fraud comes from badly designed payment systems that allow more fraud in exchange for connivence. How could we reduce this fraud cost by designing a payment system that isn’t so fraud prone and reducing the economic incentive for these things to exist?
  • pessimizer 3y ago
    > A lot of the push for these things come from fraud That's not where the push comes from, it's a pretense. They could just as easy want to force your machine to attest that there's no known child pornography on it. Or even that there's not any text or images that could be seen as information about birth control. How about attesting that an LLM-controlled state-issued daemon is always running on your box, and monitoring everything you do for suspicious activity?
• sfoley 3y ago
  > With Safari providing this, it can be used by some providers, but nobody can block or behave differently with unattested clients. What mechanism prevents websites from blocking or behaving differently for unattested clients? The article doesn't make that clear. Also: Apple's attestation implementation introduces an external real-time single-point-of-failure, but given that the failure mode is just "show a captcha", it doesn't seem too severe. Is it even possible to implement a broader attestation infrastructure without introducing a similar single point of failure? TLS PKI, for example, does not rely on an external "live" server; the private keys live on the origin.
• deleted 3y ago
  [deleted]
• uwagar 3y ago
  basically they are deplatforming us from the web.
• SillyUsername 3y ago
  Can somebody explain how this is any different to only running in a certain browser, with a certain user agent, or DRM, or with certain authentication etc? Surely it's up to companies to choose who they want to segregate, it's not a democracy?
• conradev 3y ago
  The author is referring to this standard: https://privacypass.github.io/ https://privacypass.github.io/ Apple uses it for its iCloud Private Relay service. The blind token is used so that Cloudflare can verify that a given device pays for iCloud Private Relay without revealing their identity. Attestation is when such a blind token is proving the integrity of the software running on the device, not proving arbitrary properties. Privacy Pass could actually enable a fast, semi-decentralized system of anonymizing proxies. If Apple exposed the “is System Integrity Protection enabled” bit to the web, then that amounts to attestation to me. But yes, Apple can do this whenever it wants, and companies want Apple to do it, and it’s scary. They’ve already done this for Apple Pay, Widevine and HDCP.
  • saurik 3y ago
    FWIW, Cloudflare also seems confused, so it is no wonder that we are? :( https://blog.cloudflare.com/private-attestation-token-device-posture/ https://blog.cloudflare.com/private-attestation-token-device... > At WWDC 2022, Apple announced Private Attestation Tokens. Today, we’re announcing that Cloudflare Access will support verifying a Private Attestation token. This means that security teams that rely on Cloudflare Access can verify a user’s Apple device before they access a sensitive application — no additional software required. > Private Attestation Tokens do not require any additional software to be installed on the user’s device. This is because the “attestation” of device health and validity is attested directly by the device operating system’s manufacturer — in this case, Apple. > This means that a security team can use Cloudflare Access and Private Attestation Tokens to verify if a user is accessing from a “healthy” Apple device before allowing access to a sensitive corporate application. Some checks as part of the attestation include: > Is the device on the latest OS version? > Is the device jailbroken? > Is the window attempting to log in, in focus? > And much more.
    • hellojesus 3y ago
      What prevents the client from receiving a valid token and then passing it off to another entity for that entity to use in their request? Could you have token farms that just generate tokens and provide them to "unhealthy" devices?
• gyudin 3y ago
  Okay, so it's gonna upset how many users? 20% of 1% of desktop users on Linux and BSD at best?
  • hellojesus 3y ago
    Also anyone that wants to use an ad blocker or have some privacy.
• nativeit 3y ago
  “Private Access Tokens are a powerful alternative that help you identify HTTP requests from legitimate devices and people without compromising their identity or personal information. We'll show you how your app and server can take advantage of this tool to add confidence to your online transactions and preserve privacy.” —- That doesn’t sound the same as what Google’s proposing. Am I wrong?
• jl2718 3y ago
  This protocol is private because “trust me”.
• icantbebothered 3y ago
  Apropos of nothing, TIL some Apple iOS devices have a “Lockdown Mode” to be used in critical circumstances. https://support.apple.com/en-ca/HT212650 https://support.apple.com/en-ca/HT212650 “Lockdown Mode is an optional, extreme protection that’s designed for the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats. Most people are never targeted by attacks of this nature.” However evil they are, privacy/security appears to be a case of putting their money where their mouth is. Interesting.
• Alifatisk 3y ago
  Oh, it's not only on iOS [1]. It's Android too [2]. 1. https://developer.apple.com/documentation/devicecheck/validating_apps_that_connect_to_your_server https://developer.apple.com/documentation/devicecheck/valida... 2. https://developer.android.com/google/play/integrity https://developer.android.com/google/play/integrity
• illiac786 3y ago
  Really hard to have a normal discussion about this. It's about not seeing captchas on iOS devices. There is a lot of thought that went into the privacy of this solution, just read up on it. Yet, everyone in the comments I have read so far discuss how bad it would be if a system would personally identify them while denying access to the web for users refusing to be personnally identified. It's about *captchas* not denying access, and there is no personal identification. Sure you can say "I think it's dangerous and the tech could evolve in the future into something dystopian", but don't immediately start discussing this dystopian solution as if it was the actual proposal, that is simply disingenuous and confusing.