7 ms·

Can somebody explain what are the practical implications of this?

by ailef 3y ago

gostsamo 3y ago
If adopted by publishers, the web will be closed to everyone but allowed browsers on allowed OSes on allowed hardware. No ad blockers, no extensions, no customizations beyond what the few chosen browsers allow explicitly.
- criddell 3y ago
  I have a website so I guess that makes me a publisher. Say I wanted to block Chrome on Windows and Firefox on Debian? How would I use this?
  - gostsamo 3y ago
    The browser would provide an api which returns a signed token which will be confirmed by an atestation authority.
jedisct1 3y ago
[flagged]
csomar 3y ago
You'll need an "approved" browser and potentially "approved" hardware to access the web. Since Cloudflare is on this too, most of the web will be locked for anyone who doesn't use mainstream hardware.
- leesalminen 3y ago
  But why do they care so much about this? Is it only for DRM on media playback?
  - Aaargh20318 3y ago
    No, this is for DRM on web pages. End game is probably to force ads down your throat.
  - yetihehe 3y ago
    It's so that you don't modify their precious page content (ads and trackers) with "unwanted" software hacks.
  - jiggawatts 3y ago
    They can finally, finally get rid of those pesky ad blockers. Google is an ad company. They're not a browser company.
    - xp84 3y ago
      Indeed. Nor a search company, nor a phone operating system company, nor a maps company, nor an email provider, nor a business software company. Whatever someone may think of Google or even of ads, it’s smart to keep that important thing in mind and remember their alignment is and must always be toward maximizing and improving advertising.
  - goalieca 3y ago
    It’s far worse. If you go back to to the html and http protocols, they are extremely open and friendly. I would say extremely elegant and helped build the web we know today. But google has been iterating away from open and accessible standards in favour of controlling experiences (see amp, WEI, etc). I’m all in favour of secure boot chains with options for unlocking because of the security benefits. There’s absolutely no good user reason to apply this to web resources though.
    - AshamedCaptain 3y ago
      I know it's not exactly what you mean, but this is why I dislike HTTP2 and 3 (both also heavily pushed by Google but also others). While open, they are the opposite of "welcoming and friendly".
  - 3y ago
- thejosh 3y ago
  Cloudflare want to be the internets backbone. And they've honestly succeeded. Now it's almost impossible to access websites in an automated way -- the CTO posted you can just email him (https://news.ycombinator.com/item?id=34639212 https://news.ycombinator.com/item?id=34639212) and he'll sort it. Because that scales. edit: Mispoke about the CTO, said he would approve you, I was wrong. Apologies. Their DNS is "privacy focused", but they provide "aggregated results" of domains. How is that privacy focused? Cloudflare came from the approach of being a developers friend ("Look! SSL is now free!") but was given the internet on a silver platter.
  - tenpies 3y ago
    Also remember, Cloudflare is de-facto the moderator of the internet. Whatever you may think of Kiwifarms, we all saw how that narrative unfolded from a technical perspective.
    - kmeisthax 3y ago
      Yes. Cloudflare was irresponsible in fighting to keep 8chan, Daily Stormer, and Kiwifarms up as long as they did. Every other ISP with a competent abuse desk dropped them. If you don't think that's bad, then let me remind you that back in 2012, Malwarebytes actually had a policy of blocking all Cloudflare services specifically because they were hosting malware and refused to remove it[0]. The excuse Cloudflare used for not removing malware from their network was the same language used to justify keeping the aforementioned sites operational. If Cloudflare was paid to run the Great Firewall of China they'd bend over backwards to try and claim it was to protect Xi Jinping's freedom of speech. Remember that moderators can be abusive not just in terms of removing content that shouldn't be removed, but also by forcing you to accept things that harm you. Moderation is a trust relationship because I'm delegating my own personal decision to accept or block traffic/content/etc to someone else. Cloudflare is not trustworthy. Cloudflare also used to be a big pain in the ass for Tor/VPN users because competent DDoS protection requires some kind of traceable identity. Their solution was Privacy Pass - an extension that let you pre-solve their CAPTCHAs. However, this wasn't good enough, so their next solution... was to literally partner with Apple to implement Web Environment Integrity, years before Google even proposed it. Nobody noticed this - not even me - because it was sold as a way to make CAPTCHAs less annoying. It was literally the trojan horse Google could only dream of building. [0] https://forums.malwarebytes.com/topic/108447-my-site-using-cloudflare-is-being-blocked/#comment-542408 https://forums.malwarebytes.com/topic/108447-my-site-using-c...
- xyzal 3y ago
  This needs to get to the European Parliament, we need legislation to protect web interoperability ASAP.
  - zaggynl 3y ago
    Have at it: https://european-union.europa.eu/contact-eu/write-us_en https://european-union.europa.eu/contact-eu/write-us_en I'm having trouble grasping how WEI works, providing examples of what would and could happen and what to ask/tell the EU specifically. From my limited understanding it would mean the lockout of people with non-compliant hardware/software, greatly increase the fingerprinting of web browser users and further vendor lock in to Google as a company?
knaik94 3y ago
From a very top level view, this gives Google, and other websites, the ability to block requests from devices/browsers they don't approve. This implements device level verification of the code running your browser. If the device identifies as something Google, or other implementing websites, don't approve, you'll get an error similar to how you see 404 errors for missing/wrong links.
- deleted 3y ago
  [deleted]
smallstepforman 3y ago
The Browser application needs to pass a binary image check, and if the browser hash doesn't match Google database, you cannot proceed to the website (since your browser may be corrupted). A major big deal for non main-stream browser, and for non Google browser developers, extension developers (eg. AdBlock), etc. In summary, some websites (like banks, Netflix, etc) will no longer be available for non mainstream browser users. Also, even if you're using Google Chrome, you may need to run the latest version to satisfy the hash check. Every day, the number of broken websites will continue growing until all non Google Chrome users have a blocked internet.
- nonane 3y ago
  Can you please explain why a third party browser can’t lie about its hash, just like it can lie about it’s user agent?
  - ndriscoll 3y ago
    The idea is that an operating system service provides the attestation. In turn, the OS is signed, with the bootloader verifying the signature. The bootloader is also signed, with a hardware chip verifying the signature. The infrastructure to do signed OS loading is already in place, and on some operating systems (e.g. Android), the OS attestation service is already in place. So everything is mostly in place already to have your browser attest that it is official Google chrome on Google Android on an approved device with a hardware chip that verifies a Google approved boot signature. That hardware chip contains a Google approved private key (a key that's signed by a manufacturer that Google has in turn approved/signed) that can't be extracted, and that's the key that makes the attestation. Replace the hardware boot verify chip with one that will verify software you want, and you lose your attestation key. They could also make the OS service reach out to a web service to get an attestation that the attestation key hasn't been revoked, so even if someone did physically extract the key from hardware and share it, it could be revoked (assuming each device gets its own key). In effect, wide use of this kind of thing means that open source software is no longer free since even if you can look at the code, you must be part of the anointed class (i.e. working within our approved by a major corporation) to edit it and run your edits.
px43 3y ago
Nothing will happen. People have been making the same complaints about every new crypto standard for decades, and yet here we are. TPMs are a thing, EME has been around for over a decade now, DRM on the web is as pervasive as it's ever going to get, and yet no one's user experience is any worse than it was before these technologies existed.
- jiggawatts 3y ago
  Yes, and I am still unable to play 4K Netflix on a PC that has been able to play 4K videos for about 7 years now. It's permanently blocked to prevent piracy, or something, mumble, mumble...
  - px43 3y ago
    There are several ways to play 4k Netflix videos on any platform you want, because nothing they are doing actually prevents piracy.
    - skydhash 3y ago
      It's not about preventing, it's about controlling. Making everything as an appliance is the backbone of consumerism.
  - Silhouette 3y ago
    It really does feel like something is fundamentally wrong when we're trending towards getting our video and audio content via online streaming but the streaming services are trending towards being gatekeepers more than facilitators. The temporary nature of any licensing deals behind these services and the resulting lack of reliable long-term access to content have become more and more obvious. Increasingly the streaming services seem to be so paranoid about piracy that they are blocking "unapproved" players from getting the highest quality versions of the content - as if anyone who wants to pirate any blockbuster movie can't already find a way to get it in 4K somewhere else if they really want to. Meanwhile you can't watch your 4K movie on a service you're literally paying to provide that movie. IIRC Amazon Prime Video still won't even let you have HD content if you're on Linux. It feels like the commercial incentives for tech firms to create walled gardens and a culture of never owning anything permanently are going largely unchecked and by now the governments who are supposed to act in the interests of their people should really be stepping in with regulation to counter those negative trends.
asciimov 3y ago
Unblockable ads, sites can serve you data that you can’t manipulate or copy, micropayments can exist, invasive surveillance. Surveillance is possibly the worst of the bunch. They say it’s just to do a better job of serving ads, but that’s only the tip of the iceberg. Governments could easily use it to know and track everything you do online. Just wait till the next elected nut job wants a list of everybody that has ever looked at or searched for a certain type of information, maybe they don’t like that you looked up info on abortions or lgbt info, now they can know the full extent of what you saw and when. Ads will be worse. You think YouTube ads are bad now, just wait till you can’t visit any page without the mandatory viewing of their ads. They can require a cam installed to make sure your eyes are on the ad, helpfully pausing the video when you look away.
- beckler 3y ago
  Getting some "PLEASE DRINK VERIFICATION CAN" vibes... https://imgur.com/dgGvgKF https://imgur.com/dgGvgKF
DoItToMe81 3y ago
ENORMOUS fingerprinting potential and capability to disrupt the user's ability to block content. Or access it.
amalcon 3y ago
This is essentially a backdoor attempt to TiVoize[0] web browsers. The only difference is that, instead of directly using hardware to prevent you from running a modified browser, the intent is to use network effects to accomplish the same thing. [0]- https://en.wikipedia.org/wiki/Tivoization https://en.wikipedia.org/wiki/Tivoization
gorhill 3y ago
To turn your browser (an agent acting on your behalf) into a proprietary application (an agent acting on behalf of a website) -- i.e. the equivalent of forcing you to install a proprietary application in order to visit a website.
- omoikane 3y ago
  If websites wanted this feature, and the choice is between Chrome implementing it versus me installing proprietary software, I would rather choose Chrome, especially since Chrome is implementing it in the open. There are already various services that require proprietary applications to be installed, most of which are closed-source with dubious security track record. Replacing those propriety apps with a common web browser is not necessarily a bad outcome. Personally I am voting with my money and just avoid services that are user-hostile, independent of which user-agent I use to access those services.

Can somebody explain what are the practical implications of this?

by ailef 3y ago

Can somebody explain what are the practical implications of this?

If adopted by publishers, the web will be closed to everyone but allowed browsers on allowed OSes on allowed hardware. No ad blockers, no extensions, no customizations beyond what the few chosen browsers allow explicitly.

criddell 3y ago
I have a website so I guess that makes me a publisher. Say I wanted to block Chrome on Windows and Firefox on Debian? How would I use this?
- gostsamo 3y ago
  The browser would provide an api which returns a signed token which will be confirmed by an atestation authority.

jedisct1 3y ago

[flagged]

csomar 3y ago

You'll need an "approved" browser and potentially "approved" hardware to access the web. Since Cloudflare is on this too, most of the web will be locked for anyone who doesn't use mainstream hardware.

leesalminen 3y ago
But why do they care so much about this? Is it only for DRM on media playback?
- Aaargh20318 3y ago
  No, this is for DRM on web pages. End game is probably to force ads down your throat.
- yetihehe 3y ago
  It's so that you don't modify their precious page content (ads and trackers) with "unwanted" software hacks.
- jiggawatts 3y ago
  They can finally, finally get rid of those pesky ad blockers. Google is an ad company. They're not a browser company.
  - xp84 3y ago
    Indeed. Nor a search company, nor a phone operating system company, nor a maps company, nor an email provider, nor a business software company. Whatever someone may think of Google or even of ads, it’s smart to keep that important thing in mind and remember their alignment is and must always be toward maximizing and improving advertising.
- goalieca 3y ago
  It’s far worse. If you go back to to the html and http protocols, they are extremely open and friendly. I would say extremely elegant and helped build the web we know today. But google has been iterating away from open and accessible standards in favour of controlling experiences (see amp, WEI, etc). I’m all in favour of secure boot chains with options for unlocking because of the security benefits. There’s absolutely no good user reason to apply this to web resources though.
  - AshamedCaptain 3y ago
    I know it's not exactly what you mean, but this is why I dislike HTTP2 and 3 (both also heavily pushed by Google but also others). While open, they are the opposite of "welcoming and friendly".
- 3y ago
thejosh 3y ago
Cloudflare want to be the internets backbone. And they've honestly succeeded. Now it's almost impossible to access websites in an automated way -- the CTO posted you can just email him (https://news.ycombinator.com/item?id=34639212 https://news.ycombinator.com/item?id=34639212) and he'll sort it. Because that scales. edit: Mispoke about the CTO, said he would approve you, I was wrong. Apologies. Their DNS is "privacy focused", but they provide "aggregated results" of domains. How is that privacy focused? Cloudflare came from the approach of being a developers friend ("Look! SSL is now free!") but was given the internet on a silver platter.
- tenpies 3y ago
  Also remember, Cloudflare is de-facto the moderator of the internet. Whatever you may think of Kiwifarms, we all saw how that narrative unfolded from a technical perspective.
  - kmeisthax 3y ago
    Yes. Cloudflare was irresponsible in fighting to keep 8chan, Daily Stormer, and Kiwifarms up as long as they did. Every other ISP with a competent abuse desk dropped them. If you don't think that's bad, then let me remind you that back in 2012, Malwarebytes actually had a policy of blocking all Cloudflare services specifically because they were hosting malware and refused to remove it[0]. The excuse Cloudflare used for not removing malware from their network was the same language used to justify keeping the aforementioned sites operational. If Cloudflare was paid to run the Great Firewall of China they'd bend over backwards to try and claim it was to protect Xi Jinping's freedom of speech. Remember that moderators can be abusive not just in terms of removing content that shouldn't be removed, but also by forcing you to accept things that harm you. Moderation is a trust relationship because I'm delegating my own personal decision to accept or block traffic/content/etc to someone else. Cloudflare is not trustworthy. Cloudflare also used to be a big pain in the ass for Tor/VPN users because competent DDoS protection requires some kind of traceable identity. Their solution was Privacy Pass - an extension that let you pre-solve their CAPTCHAs. However, this wasn't good enough, so their next solution... was to literally partner with Apple to implement Web Environment Integrity, years before Google even proposed it. Nobody noticed this - not even me - because it was sold as a way to make CAPTCHAs less annoying. It was literally the trojan horse Google could only dream of building. [0] https://forums.malwarebytes.com/topic/108447-my-site-using-cloudflare-is-being-blocked/#comment-542408 https://forums.malwarebytes.com/topic/108447-my-site-using-c...
xyzal 3y ago
This needs to get to the European Parliament, we need legislation to protect web interoperability ASAP.
- zaggynl 3y ago
  Have at it: https://european-union.europa.eu/contact-eu/write-us_en https://european-union.europa.eu/contact-eu/write-us_en I'm having trouble grasping how WEI works, providing examples of what would and could happen and what to ask/tell the EU specifically. From my limited understanding it would mean the lockout of people with non-compliant hardware/software, greatly increase the fingerprinting of web browser users and further vendor lock in to Google as a company?

knaik94 3y ago

From a very top level view, this gives Google, and other websites, the ability to block requests from devices/browsers they don't approve. This implements device level verification of the code running your browser. If the device identifies as something Google, or other implementing websites, don't approve, you'll get an error similar to how you see 404 errors for missing/wrong links.

deleted 3y ago
[deleted]

smallstepforman 3y ago

The Browser application needs to pass a binary image check, and if the browser hash doesn't match Google database, you cannot proceed to the website (since your browser may be corrupted). A major big deal for non main-stream browser, and for non Google browser developers, extension developers (eg. AdBlock), etc. In summary, some websites (like banks, Netflix, etc) will no longer be available for non mainstream browser users. Also, even if you're using Google Chrome, you may need to run the latest version to satisfy the hash check. Every day, the number of broken websites will continue growing until all non Google Chrome users have a blocked internet.

nonane 3y ago
Can you please explain why a third party browser can’t lie about its hash, just like it can lie about it’s user agent?
- ndriscoll 3y ago
  The idea is that an operating system service provides the attestation. In turn, the OS is signed, with the bootloader verifying the signature. The bootloader is also signed, with a hardware chip verifying the signature. The infrastructure to do signed OS loading is already in place, and on some operating systems (e.g. Android), the OS attestation service is already in place. So everything is mostly in place already to have your browser attest that it is official Google chrome on Google Android on an approved device with a hardware chip that verifies a Google approved boot signature. That hardware chip contains a Google approved private key (a key that's signed by a manufacturer that Google has in turn approved/signed) that can't be extracted, and that's the key that makes the attestation. Replace the hardware boot verify chip with one that will verify software you want, and you lose your attestation key. They could also make the OS service reach out to a web service to get an attestation that the attestation key hasn't been revoked, so even if someone did physically extract the key from hardware and share it, it could be revoked (assuming each device gets its own key). In effect, wide use of this kind of thing means that open source software is no longer free since even if you can look at the code, you must be part of the anointed class (i.e. working within our approved by a major corporation) to edit it and run your edits.

px43 3y ago

Nothing will happen. People have been making the same complaints about every new crypto standard for decades, and yet here we are. TPMs are a thing, EME has been around for over a decade now, DRM on the web is as pervasive as it's ever going to get, and yet no one's user experience is any worse than it was before these technologies existed.

jiggawatts 3y ago
Yes, and I am still unable to play 4K Netflix on a PC that has been able to play 4K videos for about 7 years now. It's permanently blocked to prevent piracy, or something, mumble, mumble...
- px43 3y ago
  There are several ways to play 4k Netflix videos on any platform you want, because nothing they are doing actually prevents piracy.
  - skydhash 3y ago
    It's not about preventing, it's about controlling. Making everything as an appliance is the backbone of consumerism.
- Silhouette 3y ago
  It really does feel like something is fundamentally wrong when we're trending towards getting our video and audio content via online streaming but the streaming services are trending towards being gatekeepers more than facilitators. The temporary nature of any licensing deals behind these services and the resulting lack of reliable long-term access to content have become more and more obvious. Increasingly the streaming services seem to be so paranoid about piracy that they are blocking "unapproved" players from getting the highest quality versions of the content - as if anyone who wants to pirate any blockbuster movie can't already find a way to get it in 4K somewhere else if they really want to. Meanwhile you can't watch your 4K movie on a service you're literally paying to provide that movie. IIRC Amazon Prime Video still won't even let you have HD content if you're on Linux. It feels like the commercial incentives for tech firms to create walled gardens and a culture of never owning anything permanently are going largely unchecked and by now the governments who are supposed to act in the interests of their people should really be stepping in with regulation to counter those negative trends.

asciimov 3y ago

Unblockable ads, sites can serve you data that you can’t manipulate or copy, micropayments can exist, invasive surveillance. Surveillance is possibly the worst of the bunch. They say it’s just to do a better job of serving ads, but that’s only the tip of the iceberg. Governments could easily use it to know and track everything you do online. Just wait till the next elected nut job wants a list of everybody that has ever looked at or searched for a certain type of information, maybe they don’t like that you looked up info on abortions or lgbt info, now they can know the full extent of what you saw and when. Ads will be worse. You think YouTube ads are bad now, just wait till you can’t visit any page without the mandatory viewing of their ads. They can require a cam installed to make sure your eyes are on the ad, helpfully pausing the video when you look away.

beckler 3y ago
Getting some "PLEASE DRINK VERIFICATION CAN" vibes... https://imgur.com/dgGvgKF https://imgur.com/dgGvgKF

DoItToMe81 3y ago

ENORMOUS fingerprinting potential and capability to disrupt the user's ability to block content. Or access it.

amalcon 3y ago

This is essentially a backdoor attempt to TiVoize[0] web browsers. The only difference is that, instead of directly using hardware to prevent you from running a modified browser, the intent is to use network effects to accomplish the same thing. [0]- https://en.wikipedia.org/wiki/Tivoization https://en.wikipedia.org/wiki/Tivoization

gorhill 3y ago

To turn your browser (an agent acting on your behalf) into a proprietary application (an agent acting on behalf of a website) -- i.e. the equivalent of forcing you to install a proprietary application in order to visit a website.

omoikane 3y ago
If websites wanted this feature, and the choice is between Chrome implementing it versus me installing proprietary software, I would rather choose Chrome, especially since Chrome is implementing it in the open. There are already various services that require proprietary applications to be installed, most of which are closed-source with dubious security track record. Replacing those propriety apps with a common web browser is not necessarily a bad outcome. Personally I am voting with my money and just avoid services that are user-hostile, independent of which user-agent I use to access those services.