5 ms·

Maybe I'm wrong but Web Attestation will also be a death knell for Linux devices (not Android/Chrome OS) as far as being able to use them as equal clients to us

Maybe I'm wrong but Web Attestation will also be a death knell for Linux devices (not Android/Chrome OS) as far as being able to use them as equal clients to use the Web goes. They're simply too diverse and 'hackable' as a plotform for remote attestation to work reliably and thus they'll be excluded altogether (except a few 'blessed' distros that will then become industry controlled, and not Linux in spirit anymore).

smoldesu 3y ago
If this happens, I expect the majority of Windows and Android devices to stop working too. They are also a diverse and hackable platform that is apparently insufficient for a future where I have to attest to owning certain hardware. > except a few 'blessed' distros that will then become industry controlled, and not Linux in spirit anymore You know, I hear this a lot but seldom hear the details of how it might happen. Industry-controlled UNIX is the reason Linux exists - if you take the spirit away from Linux, it gets forked into another community project. Unless you're stripping it of it's GPL license, Linux will be "Linux in Spirit" until it stops being used altogether.
- Avamander 3y ago
  Not the majority, just a *lot* of older ones. New Android phones have hardware-backed SafetyNet, new Windows devices have Trusted Boot (not to be confused with Secure Boot). Both can and will be used to attest the browser environment. Linux devices will get hit (unless I guess we see locked down signed kernels, Chromebook-like things).
  - treprinum 3y ago
    It's really slowly boiling frog situation playing out over the past 20 years. Since Aegis bootloader outlined how trusted computing will be created with predictions of allowing Internet access only to attested devices/people, we seem to be at the brink of somebody flipping the switch. Other predictions contained historic data/web changing as politically convenient with nobody being able to access/view the old original anymore due to only attested devices available.
- fsniper 3y ago
  If people can't use their prefered Linux distros to do banking, or can't connect to social networks,email providers, music streaming services and so on this will mean practically they are forced to switch distros. Which would eventually add more control power to some Distros to what goes into development and what not. You can see systemd and it's history about how it hold power.
  - deleted 3y ago
    [deleted]
  - JohnFen 3y ago
    Or run one of the "blessed" or "compromised" (depending on your point of view) distros in a VM purely for those types of things.
    - Avamander 3y ago
      That's the point where you'd need the VM itself to be attested for it to work. Hyper-V kinda does it already with Shielded Windows VMs. With the advent of SEV, you won't even be able to look at the stuff your hypervisor is running.
      - fsniper 3y ago
        Also there is no guarantee that "attestation" won't require your software to run on the physical hardware and not on a vm.
        Avamander 3y ago
        True, but virtualization is big enough (including Microsoft's own Windows365 offerings) that passing "trust" down into VMs will be done. And with SEV there isn't even a way to tamper with things after the attestation process has been completed.
    - Gazoche 3y ago
      Even assuming the VM workaround works, this would be catastrophic from an usability standpoint. Linux has been making giant strides towards increasing accessibility and lowering the friction of adopting it as a daily driver, while preserving the freedom to choose any distro you want. Forcing new users to babysit a second installation in a special VM would be wiping out decades of progress.
- vaxman 3y ago
  > Industry-controlled UNIX is the reason Linux exists Linux only exists because it is free and it runs free apps for every category of keyboard-driven task a typical user would want. The answer to my question of how a predator like IBM is going to take out the other non-RHEL based distros is starting to come into focus. This should help Ubuntu get the Mint monkey off its back too.
- voxic11 3y ago
  All machines sold with Windows have been required to include a TPM since 2016.
uwagar 3y ago
excluded from browsing the web starts where? my isp wont let me browse the web? or youtube wont serve videos to me?
- unethical_ban 3y ago
  Per the topic of the article, the latter.
- ooterness 3y ago
  The latter. Google could easily pressure many sites to adopt this by including ad revenue incentives. If that catches on, it could rapidly be 90% of websites that won't serve content until they get the magic Google "no-adblock-here" handshake.
onion2k 3y ago
I slightly suspect that the only platforms that will actually implement Web Attestation are the ones I'm trying to remove myself from, so I secretly[1] hope this is the catalyst I need to stop going on crappy social networks and video platforms. I apparently don't have the will power to stop going on these sites so maybe stopping me loading content from the other side is exactly what I need. [1] Not so secretly now I've mentioned it here I suppose.
- tomstockmail 3y ago
  Banks.
  - N19PEDL2 3y ago
    There's a lot of competition in the banking sector, so I don't think banks can afford to start telling customers that they need specific devices to access their online services.
    - c0l0 3y ago
      The banking sector is EXACTLY where "cyber 'security'" and "compliance" will mandate for this to be implemented. When I worked a bank at $oldjob, compliance mandated we had a full-blown anti virus engine (from Microsoft or McAfee, "at your option") deployed in quasi-ephemeral container images. It does not have to be reasonable, it doesn't have to be a net positive - it just has to tick some box on some compliance sheet for this to be required, and I will never again be able to perform a banking transaction from my personal computer or degoogled phone again.
      - delfinom 3y ago
        Most banks have barely implemented 2FA, and when they have, they implement SMS. The only financial provider I have that supports anything other than backdoors is Vanguard with U2F support. Shit, AMEX still lowercases your passwords before (hopefully) hashing them. We got plenty of time for those mandates to occur ;)
shuckles 3y ago
So far, Private Access Tokens are not widely adopted so you can get a feel for the potential Linux experience by browsing the web with iCloud Private Relay enabled. This flags almost every website's anti-spam classifiers, and you end up having to do 3-5 captchas to access anything protected by one. Wikipedia also blocks you from editing: https://meta.wikimedia.org/wiki/Talk:Apple_iCloud_Private_Relay https://meta.wikimedia.org/wiki/Talk:Apple_iCloud_Private_Re....
- api 3y ago
  Playing devils advocate: how else do you prevent spam without requiring a login on every single web page? Especially in the world of AI-powered spam that can be indistinguishable from humans and automated at scale and can solve captchas. Spam destroys everything. The open web has been at war with it forever, and soon it will win just like it has won in every other domain that is not completely locked down. I love the fediverse but I fully expect it be destroyed by spam as soon as it gets big and influential enough to be a juicy target. The Internet is a dark forest. The future is private encrypted networks, private forums, etc.
  - shuckles 3y ago
    I think Private Access Token is a reasonable design, and it should be standardized with multiple attestation providers that any client can use. That seems like it would move the web forward, unlike simply not making headway on the problem of spam and fingerprinting/tracking as an anti-spam measure at all.
  - tjoff 3y ago
    > how else do you prevent spam without requiring a login on every single web page? Probably missing something, what can you spam without an account today?
  - r00fus 3y ago
    Spam even exists where logins ARE required. Look at Reddit or Twitter/X and any web-accessible forum where logins are required. Lots of spam everywhere. I don’t think attestation will prevent this, it does however, prevent scraping if attestation is required to even view content.
c0l0 3y ago
Of course, that is the most obvious consequence of this whole mess.
wyldfire 3y ago
Cory Doctorow's keynote from 28C3 is prescient - "The coming war on general computation" [1] [1] https://github.com/jwise/28c3-doctorow/blob/master/transcript.md https://github.com/jwise/28c3-doctorow/blob/master/transcrip...
- PaulDavisThe1st 3y ago
  Do you think that Doctorow was expecting at least 9 years till this putative war got started?
- xorcist 3y ago
  Or, for a more grim take on the same concept, "We lost the war" from 22C3.
  - lioeters 3y ago
    https://media.ccc.de/v/22C3-920-en-we_lost_the_war https://media.ccc.de/v/22C3-920-en-we_lost_the_war
intrasight 3y ago
I assume that IT departments in most orgs will just swap those attestation tokens for a generic "ACME Corp" token at the network layer. And I expect that home routers will give us that option as well.

smoldesu 3y ago

If this happens, I expect the majority of Windows and Android devices to stop working too. They are also a diverse and hackable platform that is apparently insufficient for a future where I have to attest to owning certain hardware. > except a few 'blessed' distros that will then become industry controlled, and not Linux in spirit anymore You know, I hear this a lot but seldom hear the details of how it might happen. Industry-controlled UNIX is the reason Linux exists - if you take the spirit away from Linux, it gets forked into another community project. Unless you're stripping it of it's GPL license, Linux will be "Linux in Spirit" until it stops being used altogether.

Avamander 3y ago
Not the majority, just a *lot* of older ones. New Android phones have hardware-backed SafetyNet, new Windows devices have Trusted Boot (not to be confused with Secure Boot). Both can and will be used to attest the browser environment. Linux devices will get hit (unless I guess we see locked down signed kernels, Chromebook-like things).
- treprinum 3y ago
  It's really slowly boiling frog situation playing out over the past 20 years. Since Aegis bootloader outlined how trusted computing will be created with predictions of allowing Internet access only to attested devices/people, we seem to be at the brink of somebody flipping the switch. Other predictions contained historic data/web changing as politically convenient with nobody being able to access/view the old original anymore due to only attested devices available.
fsniper 3y ago
If people can't use their prefered Linux distros to do banking, or can't connect to social networks,email providers, music streaming services and so on this will mean practically they are forced to switch distros. Which would eventually add more control power to some Distros to what goes into development and what not. You can see systemd and it's history about how it hold power.
- deleted 3y ago
  [deleted]
- JohnFen 3y ago
  Or run one of the "blessed" or "compromised" (depending on your point of view) distros in a VM purely for those types of things.
  - Avamander 3y ago
    That's the point where you'd need the VM itself to be attested for it to work. Hyper-V kinda does it already with Shielded Windows VMs. With the advent of SEV, you won't even be able to look at the stuff your hypervisor is running.
    - fsniper 3y ago
      Also there is no guarantee that "attestation" won't require your software to run on the physical hardware and not on a vm.
      - Avamander 3y ago
        True, but virtualization is big enough (including Microsoft's own Windows365 offerings) that passing "trust" down into VMs will be done. And with SEV there isn't even a way to tamper with things after the attestation process has been completed.
  - Gazoche 3y ago
    Even assuming the VM workaround works, this would be catastrophic from an usability standpoint. Linux has been making giant strides towards increasing accessibility and lowering the friction of adopting it as a daily driver, while preserving the freedom to choose any distro you want. Forcing new users to babysit a second installation in a special VM would be wiping out decades of progress.
vaxman 3y ago
> Industry-controlled UNIX is the reason Linux exists Linux only exists because it is free and it runs free apps for every category of keyboard-driven task a typical user would want. The answer to my question of how a predator like IBM is going to take out the other non-RHEL based distros is starting to come into focus. This should help Ubuntu get the Mint monkey off its back too.
voxic11 3y ago
All machines sold with Windows have been required to include a TPM since 2016.

uwagar 3y ago

excluded from browsing the web starts where? my isp wont let me browse the web? or youtube wont serve videos to me?

unethical_ban 3y ago
Per the topic of the article, the latter.
ooterness 3y ago
The latter. Google could easily pressure many sites to adopt this by including ad revenue incentives. If that catches on, it could rapidly be 90% of websites that won't serve content until they get the magic Google "no-adblock-here" handshake.

onion2k 3y ago

I slightly suspect that the only platforms that will actually implement Web Attestation are the ones I'm trying to remove myself from, so I secretly[1] hope this is the catalyst I need to stop going on crappy social networks and video platforms. I apparently don't have the will power to stop going on these sites so maybe stopping me loading content from the other side is exactly what I need. [1] Not so secretly now I've mentioned it here I suppose.

tomstockmail 3y ago
Banks.
- N19PEDL2 3y ago
  There's a lot of competition in the banking sector, so I don't think banks can afford to start telling customers that they need specific devices to access their online services.
  - c0l0 3y ago
    The banking sector is EXACTLY where "cyber 'security'" and "compliance" will mandate for this to be implemented. When I worked a bank at $oldjob, compliance mandated we had a full-blown anti virus engine (from Microsoft or McAfee, "at your option") deployed in quasi-ephemeral container images. It does not have to be reasonable, it doesn't have to be a net positive - it just has to tick some box on some compliance sheet for this to be required, and I will never again be able to perform a banking transaction from my personal computer or degoogled phone again.
    - delfinom 3y ago
      Most banks have barely implemented 2FA, and when they have, they implement SMS. The only financial provider I have that supports anything other than backdoors is Vanguard with U2F support. Shit, AMEX still lowercases your passwords before (hopefully) hashing them. We got plenty of time for those mandates to occur ;)

shuckles 3y ago

So far, Private Access Tokens are not widely adopted so you can get a feel for the potential Linux experience by browsing the web with iCloud Private Relay enabled. This flags almost every website's anti-spam classifiers, and you end up having to do 3-5 captchas to access anything protected by one. Wikipedia also blocks you from editing: https://meta.wikimedia.org/wiki/Talk:Apple_iCloud_Private_Relay https://meta.wikimedia.org/wiki/Talk:Apple_iCloud_Private_Re....

api 3y ago
Playing devils advocate: how else do you prevent spam without requiring a login on every single web page? Especially in the world of AI-powered spam that can be indistinguishable from humans and automated at scale and can solve captchas. Spam destroys everything. The open web has been at war with it forever, and soon it will win just like it has won in every other domain that is not completely locked down. I love the fediverse but I fully expect it be destroyed by spam as soon as it gets big and influential enough to be a juicy target. The Internet is a dark forest. The future is private encrypted networks, private forums, etc.
- shuckles 3y ago
  I think Private Access Token is a reasonable design, and it should be standardized with multiple attestation providers that any client can use. That seems like it would move the web forward, unlike simply not making headway on the problem of spam and fingerprinting/tracking as an anti-spam measure at all.
- tjoff 3y ago
  > how else do you prevent spam without requiring a login on every single web page? Probably missing something, what can you spam without an account today?
- r00fus 3y ago
  Spam even exists where logins ARE required. Look at Reddit or Twitter/X and any web-accessible forum where logins are required. Lots of spam everywhere. I don’t think attestation will prevent this, it does however, prevent scraping if attestation is required to even view content.

c0l0 3y ago

Of course, that is the most obvious consequence of this whole mess.

wyldfire 3y ago

Cory Doctorow's keynote from 28C3 is prescient - "The coming war on general computation" [1] [1] https://github.com/jwise/28c3-doctorow/blob/master/transcript.md https://github.com/jwise/28c3-doctorow/blob/master/transcrip...

PaulDavisThe1st 3y ago
Do you think that Doctorow was expecting at least 9 years till this putative war got started?
xorcist 3y ago
Or, for a more grim take on the same concept, "We lost the war" from 22C3.
- lioeters 3y ago
  https://media.ccc.de/v/22C3-920-en-we_lost_the_war https://media.ccc.de/v/22C3-920-en-we_lost_the_war

intrasight 3y ago

I assume that IT departments in most orgs will just swap those attestation tokens for a generic "ACME Corp" token at the network layer. And I expect that home routers will give us that option as well.