6 ms·

How exactly is WEI any worse than say a peep-hole on a door? At the end of the day bots are a huge problem and it's only getting worse. What's the alternative s

How exactly is WEI any worse than say a peep-hole on a door? At the end of the day bots are a huge problem and it's only getting worse. What's the alternative solution? You need to know who you're dealing with, both in life and clearly on the web. I'm probably alone in this, but WEI is a good thing. Anyone who's run a site knows the headache around bots. Sites that don't care about bots can simply not use WEI. Of course, we know they will use it, because bots are a headache. Millions of engineer hours are wasted yearly on bot nonsense. With the improvements in AI this was inevitable anyway. Anyone who thinks otherwise is delusional. Reap what you sow and what not. edit: removing ssl comparison since it's not really my point to begin with

JohnFen 3y ago
SSL doesn't demand that some third party approve your software and hardware in order for it to work for you.
- endisneigh 3y ago
  TPMs with attestation do exactly that. Are you opposed to that as well?
  - lxgr 3y ago
    Seems like a strange way to make a point to start out with SSL and then shift the argument to TPM/attestation...
  - JohnFen 3y ago
    Yes, I have been opposed to TPM since the start.
    - endisneigh 3y ago
      What's your solution then to the problem TPMs solve?
      - JohnFen 3y ago
        That depends on which problem you're talking about. But this is not the issue at hand.
      - mindslight 3y ago
        What do you get from blasting this thread with a bunch of naive one liners that you could answer yourself if you studied the topic on your own for a little bit? The answer to this one is that the fundamental problem that current TPMs aim to "solve" is that of allowing corporate control and inspection of end users' computers. To continue having a free society where individuals have some autonomy over the devices they purportedly own, this needs to be soundly rejected.
        pptr 3y ago
        Good idea, we just throw out all the security mechanisms to avoid "corporate control" and even worse anti virus software "inspecting end users' computers". I'm sure people will be very happy about all the mal- and ransomware they receive. Imagine the utopia we would live in.
        mindslight 3y ago
        You're using scare quotes, but I do specifically mean corporate control. Current TPMs were designed around giving centralized parties (eg corporations) privileged keys. TPMs could certainly be designed to not have any baked in privileged keys, instead putting the owner at the trust root. The current crop just wasn't. Also that you're talking about anti virus shows that you're not really in touch with the gamut of computing. From my perspective, anti virus was something that was relevant two decades ago.
      - rcxdude 3y ago
        which problem? Some 'problems' TPMs solve should not be solved. Others are perfectly reasonable but a generally a lot less common.
  - rezonant 3y ago
    That's exactly what WEI is supposed to do... And yes, websites should not be able to use the TPM for attesting the user's environment.
    - endisneigh 3y ago
      why not? how do you want to solve the problem of provenance? if you feel it's not a problem to begin with, then the sites in question can simply choose not to enable it. if they enable and believe it is a problem, then clearly there's a dissonance between the places you choose to visit and their goals, no?
      - deleted 3y ago
        [deleted]
      - lxgr 3y ago
        WEI does not solve any "problem of provenance"; it's DRM for the web. It asserts things about the browser environment to the website operator, not the other way around. Are you sure you actually understand these two technologies (WEI and TLS) sufficiently to make these claims?
        deleted 3y ago
        [deleted]
      - rezonant 3y ago
        > sites in question can simply choose not to enable it. My problem isn't that I as a developer don't have an option to not implement attestation checks on my own web properties. I already know that (and definitely won't be implementing them). My problem is that a huge number of websites will, ostensibly as an easier way to prevent malicious automation, spam etc, but in doing so will throw the baby out with the bathwater: That users will no longer have OS and browser choice because the web shackles them to approved, signed, and sealed hardware/software combinations primarily controlled by big tech.
      - rvba 3y ago
  - howinteresting 3y ago
    Yes, TPMs have no business being part of the open web. They enable CIOs to make bad decisions like preventing a bank's website from being loaded in non-TPM browsers.
  - guilhas 3y ago
    I support myself using a TPM to attest if my system has not been tampered But I oppose others, Google/Microsoft/Facebook/..., attesting if my system is according their specifications
  - mardifoufs 3y ago
    Why are you proposing some sort of reverse slippery slope? So because "we" don't oppose a TPM, we shouldn't oppose any form of attestation? If anything you are just proving the point of the most paranoid. I don't even have a strong opinion on this but it's so weird to see this argument over and over. It's just calling for even an even more extreme reaction to any effort that goes in this direction, just in case it's used to justify a push for even worse stuff down the line.
  - Zak 3y ago
    I am. I've had apps try to use Google Safetynet to prevent me from running them on my phone (which is not running the manufacturer-provided Android build), and I am certainly opposed to that. I wouldn't mind being able to use the TPM to tell me whether the hardware and software are what I expected them to be, but that's different.
lxgr 3y ago
WEI and SSL/TLS are completely different. TLS does not facilitate preventing you as a web site visitor from inspecting or modifying the web content served over it, e.g. by blocking ads or auto-playing videos. WEI does.
rezonant 3y ago
TLS* does not allow websites to restrict users from using the tech stack (hardware, OS, browser) that they want to use. This does.
- endisneigh 3y ago
  Fundamentally both give a 3rd party the authority to verify the legitimacy of something, and similarly both can be avoided if you're willing to not participate.
  - lxgr 3y ago
    I think you're mistaken about what TLS does. It doesn't give a third party any authority to verify anything. It provides integrity and confidentiality to both parties to an HTTP exchange, nothing more. A TLS client does not contain any trusted private key. You can write one yourself by reading the RFCs. The same is not true for WEI.
    - roblabla 3y ago
      TLS used to also guarantee that you were talking to the correct entity, that's what EV certificates are for. So there was a verification step that ensured that you were indeed the business/organization you were claiming to be. The EV certs still exists, but the browsers don't really differenciate between DV and EV certs anymore.
      - lxgr 3y ago
        Ah, yes, in that sense I can see the parallel (in that being reachable in modern browsers is contingent on being able to obtain a TLS certificate). I remember similar concerns being raised about browsers discouraging HTTP. But TLS certificates solve a much narrower problem than WEI ("are you communicating with the site you think you are") and are widely and cheaply available from multiple organizationally independent certificate authorities. In particular, TLS certificates don't try to make an assertion about the website visited, i.e. "this site is operated by honest people, not scammers". WEI does, with the assertion being something like "this browser will not allow injecting scripts or blocking elements".
amarshall 3y ago
SSL is the client verifying the server, and the client can thusly opt to skip or alter that in any way it sees fit. WEI is the reverse: the server validating the client, so the client has no choice to opt-out.
NoMoreNicksLeft 3y ago
Anyone using a browser without this feature will end up becoming second class citizens who must jump through (extreme) hoops to use the web... Or they're just walled off from most of the web entirely. I use a variety of personally developed web scraper scripts. For instance, I have digital copies of every paystub. These will almost all become worthless. My retirement plan at a previous employer would not let me download monthly statements unless I did it manually... it was able to detect the Mechanize library, and responded with some creepy-assed warning against robots. No one would go to the trouble to do that manually every month, and no one was allowed robots apparently. But at least they needed to install some specialty software somewhere to disallow it. This shit will just make it even easier for the assholes. I also worry about tools I sometimes use for things like Selenium. This isn't SSL.
- endisneigh 3y ago
  This is not true. Sites will not be obligated to implement WEI. At the end of the day bots are a real issue, with no real solution other than attestation. AI is accelerating this issue. This (WEI or something else) is inevitable.
  - NoMoreNicksLeft 3y ago
    > This is not true. Sites will not be obligated to implement WEI. There are a number of sites I frequent but don't log in to or register for an account. Every single one of them has an absurd number of captchas, or I see the cloudflare protection thing come up for first for 3 seconds. So while hypothetically it may be true that they don't have to do it, they will. It's not even clear to me that Firefox could implement it too... so do I have to switch back to Chrome (or [barf] Safari?)? Dunno. I can't predict the future, but you'd have to be in some sort of denial to not see where this is going. > At the end of the day bots are a real issue Bots are fucking awesome. We should all have bots, out there doing the boring stuff, bringing back the goodies to us. If someone tells you that bots are bad, they're lying to you because they're afraid that you might find out how much you'd want one.
  - lxgr 3y ago
    Maybe so, but if so, let's please make it something else. I'm fine with attestation when it comes to high-risk tasks such as confirming financial transactions or signing legal documents, or anonymous "proof-of-humanity" solutions such as Apple's Private Access Tokens (as long as there's a CAPTCHA-based or similar alternative!) for free trials or account creations (beats using SMS/phone number authentication, at least), but applying Trusted Computing to the entire browser just goes much too far.
klabb3 3y ago
SSL is in practice only used for server certificates. It was kinda shit and a lot of people complained because of CAs but then we got let’s encrypt etc which alleviated the situation. And the identity is only tied to domain control, unlike eg code signing certs which are orders of magnitude more invasive and frankly a racket. In either case, WEI has the potential to be proper DRM, like in the “approved devices” fashion. It’s deeply invasive, and can be used to exclude any type of usage at the whim of mega corps, like screen readers, ad blocking, anti-tracking/fingerprinting, downloading copyrighted content, and anything new they can think of in the future. It’s quite literally the gateway to making the web an App Store (or at best, multiple app stores). > What's the alternative solution? To what problem? Bots specifically or humans who want to use the web in any way they want? If bots, then elaborate. Many bots are good, and ironically the vast majority of bot traffic comes from the very corporations that are behind this stuff. As for the really bad bots, we have IP blocklisting. For the gray/manipulative bots, sure, that’s a problem. What makes you think that problem needs to be addressed with mandatory handcuffs for everyone else?
- endisneigh 3y ago
  Why should sites be obligated to let anyone in? Do you let anyone into your house? I'm surprised WEI wasn't implemented long ago. This notion of destroying the open web is so nonsensical. WEI is not obligatory. If it's being implemented it's because it solves a real problem. Think about it. There will still be sites that don't use it. People's real issue is that the big sites will use WEI because the problem it solves is legitimate but they don't want to identify themselves, which makes sense, but they were never obligated to let you visit their site to begin with.
  - deleted 3y ago
    [deleted]
  - thatguy0900 3y ago
    And if Google decides later that adsense from untrusted browsers doesn't count? Youtube and gmaol refuses to run at all on untrusted browsers? Is it still optional, realisticly?
hnav 3y ago
Maybe mTLS/logging in.
j1elo 3y ago
Bots will get sophisticated. This all seems to me that in a decade we'll be having the same discussion, with the same excuse, but eventually the proposal from big corporations will be to require plugging-in a government-issued ID card into a smartcard reader in order to access pre-approved websites with pre-approved client portals running in pre-approved machines.
fooyc 3y ago
WEI won’t even stop the bad bots. They will simply use "legitimate" devices.
burkaman 3y ago
How would this prevent bots? It's very easy to set up a bot that's running Chrome on Android, or whatever environment is required. Bots can do whatever you tell them without complaining. This only prevents actual humans who want to use a non-mainstream browser, or use add-ons to help them browse, or use a non-mainstream operating system or device.
seanalltogether 3y ago
I think your comparison to SSL is actually important, because encryption is a discrete problem with a discrete solution. But this WEI proposal is designed to detect botting, which is a cat and mouse problem without a clear end game.
- yonatan8070 3y ago
  Exactly, if people want to create bots, at the end of the days we'll end up with VMs running AutoHotkey and Chrome, or physical machines with fake mice and keyboards, or actual computer setups with robot arms moving the mouse around, there's no stopping bots
  - lxgr 3y ago
    Well, not if you ultimately tie something like WEI to hardware attestation. Then fraudsters would have to buy additional devices, which is not a complete deterrent [1], but would change the economics significantly. But many here are (in my view rightly) arguing that this would be too high a price to pay for bot/spam protection, since it would almost inevitably cement the browser, OS, and device monoculture even further. [1] https://www.cultofmac.com/311171/crazy-iphone-rig-shows-chinese-workers-manipulate-app-store-rankings/ https://www.cultofmac.com/311171/crazy-iphone-rig-shows-chin...
    - Urd- 3y ago
      >Then fraudsters would have to buy additional devices Which a lot of them already do: https://www.youtube.com/watch?v=hsCJU9djdIc https://www.youtube.com/watch?v=hsCJU9djdIc Or just use a botnet to steal use of someone else's hardware, which is also very common for malicious bots.
guy98238710 3y ago
Yeah, sure, let's implement this dystopian nightmare technology to solve our little engineering problem.
guy98238710 3y ago
> Anyone who's run a site knows the headache around bots. Sites that don't care about bots can simply not use WEI. So is it a headache for all/most sites or is it not?
Buttons840 3y ago
WEI is really about denying the user full control of their own device. If you give people full control of their devices, you will have bots. Do you believe eliminating bots is more important than general purpose computing? A bot is just some computer doing what its owner wants. OP is happy because WEI will eliminate bots. OP is inconvenienced by other people using computers in ways they don't like, and wants to take control of the computer away. As strong AI is knocking on the door, we see people wanting to take general purpose computing away. All the worst outcomes involve people losing the ability to control their own computers.
- ori_b 3y ago
  > WEI is really about denying the user full control of their own device. If you give people full control of their devices, you will have bots. Do you believe eliminating bots is more important than general purpose computing? Worse than that -- unless you disallow any sort of scripting and accessibility hooks, WEI doesn't prevent malicious requests. It just forces you to script your system via autohotkey or its equivalent.
  - Buttons840 3y ago
    Yep. And what will the solution to that be? People used browser APIs and some other people thought to take that away. When some people use autohotkey, what will the other people think about doing?
  - tjpnz 3y ago
    That's by design given how many ads for scams and malware Google serves.
ori_b 3y ago
WEI doesn't prevent bots. Bots would just need to script an attested browser via tools like AutoHotKey -- the only way WEI would prevent bots would be by preventing you from running the browser on an operating system without 3rd party software installed. WEI is a 2 or 3 month roadbump for bot builders. WEI does prevent any customization.
- alex7734 3y ago
  > the only way WEI would prevent bots would be by preventing you from running the browser on an operating system without 3rd party software installed Or by isolating the browser from third party software. Android does not let applications mess with each other. Windows already prevents non-elevated applications from touching elevated applications (i.e. running as administrator). What makes you think that Windows won't add an "untouchable" mode to executables belonging to "approved" browsers? The kernel is already locked down so you won't be able to bypass it that easily.
  - deleted 3y ago
    [deleted]
  - drchaos 3y ago
    It's absolutely possible to automate an "attested" phone with a physical robot finger, which is neither extremely complicated or expensive tech. It might be too expensive for mass-scale DDOS, but it would still be cost-effective for more interesting things like click fraud.
  - ori_b 3y ago
    > Or by isolating the browser from third party software. Android does not let applications mess with each other. Android lets applications mess with each other. That's how the accessibility features work.
iczero 3y ago
WEI is like requiring people to get their brain scanned before you let them visit your house. "Sorry, I require a valid attestation from Google that you are a real human," you say. Your friend now needs to drive down to the local Google® Privacy Invasion Center™ and have all of their personal secrets exposed so Google can prove they are, in fact, not a robot. Except, oh no, Google found Linux in their brain scan! The horror! How dare they value their own freedom! Anyone who opposes spying from Chrome and/or Google Play Services is obviously a bot. Nothing to hide, nothing to fear, right? Your visitor, who is clearly not a bot, fails to obtain a valid attestation from Google. You deny them entry to your house. You have lost an acquaintance.

JohnFen 3y ago

SSL doesn't demand that some third party approve your software and hardware in order for it to work for you.

endisneigh 3y ago
TPMs with attestation do exactly that. Are you opposed to that as well?
- lxgr 3y ago
  Seems like a strange way to make a point to start out with SSL and then shift the argument to TPM/attestation...
- JohnFen 3y ago
  Yes, I have been opposed to TPM since the start.
  - endisneigh 3y ago
    What's your solution then to the problem TPMs solve?
    - JohnFen 3y ago
      That depends on which problem you're talking about. But this is not the issue at hand.
    - mindslight 3y ago
      What do you get from blasting this thread with a bunch of naive one liners that you could answer yourself if you studied the topic on your own for a little bit? The answer to this one is that the fundamental problem that current TPMs aim to "solve" is that of allowing corporate control and inspection of end users' computers. To continue having a free society where individuals have some autonomy over the devices they purportedly own, this needs to be soundly rejected.
      - pptr 3y ago
        Good idea, we just throw out all the security mechanisms to avoid "corporate control" and even worse anti virus software "inspecting end users' computers". I'm sure people will be very happy about all the mal- and ransomware they receive. Imagine the utopia we would live in.
        mindslight 3y ago
        You're using scare quotes, but I do specifically mean corporate control. Current TPMs were designed around giving centralized parties (eg corporations) privileged keys. TPMs could certainly be designed to not have any baked in privileged keys, instead putting the owner at the trust root. The current crop just wasn't. Also that you're talking about anti virus shows that you're not really in touch with the gamut of computing. From my perspective, anti virus was something that was relevant two decades ago.
    - rcxdude 3y ago
      which problem? Some 'problems' TPMs solve should not be solved. Others are perfectly reasonable but a generally a lot less common.
- rezonant 3y ago
  That's exactly what WEI is supposed to do... And yes, websites should not be able to use the TPM for attesting the user's environment.
  - endisneigh 3y ago
    why not? how do you want to solve the problem of provenance? if you feel it's not a problem to begin with, then the sites in question can simply choose not to enable it. if they enable and believe it is a problem, then clearly there's a dissonance between the places you choose to visit and their goals, no?
    - deleted 3y ago
      [deleted]
    - lxgr 3y ago
      WEI does not solve any "problem of provenance"; it's DRM for the web. It asserts things about the browser environment to the website operator, not the other way around. Are you sure you actually understand these two technologies (WEI and TLS) sufficiently to make these claims?
      - deleted 3y ago
        [deleted]
    - rezonant 3y ago
      > sites in question can simply choose not to enable it. My problem isn't that I as a developer don't have an option to not implement attestation checks on my own web properties. I already know that (and definitely won't be implementing them). My problem is that a huge number of websites will, ostensibly as an easier way to prevent malicious automation, spam etc, but in doing so will throw the baby out with the bathwater: That users will no longer have OS and browser choice because the web shackles them to approved, signed, and sealed hardware/software combinations primarily controlled by big tech.
    - rvba 3y ago
- howinteresting 3y ago
  Yes, TPMs have no business being part of the open web. They enable CIOs to make bad decisions like preventing a bank's website from being loaded in non-TPM browsers.
- guilhas 3y ago
  I support myself using a TPM to attest if my system has not been tampered But I oppose others, Google/Microsoft/Facebook/..., attesting if my system is according their specifications
- mardifoufs 3y ago
  Why are you proposing some sort of reverse slippery slope? So because "we" don't oppose a TPM, we shouldn't oppose any form of attestation? If anything you are just proving the point of the most paranoid. I don't even have a strong opinion on this but it's so weird to see this argument over and over. It's just calling for even an even more extreme reaction to any effort that goes in this direction, just in case it's used to justify a push for even worse stuff down the line.
- Zak 3y ago
  I am. I've had apps try to use Google Safetynet to prevent me from running them on my phone (which is not running the manufacturer-provided Android build), and I am certainly opposed to that. I wouldn't mind being able to use the TPM to tell me whether the hardware and software are what I expected them to be, but that's different.

lxgr 3y ago

WEI and SSL/TLS are completely different. TLS does not facilitate preventing you as a web site visitor from inspecting or modifying the web content served over it, e.g. by blocking ads or auto-playing videos. WEI does.

rezonant 3y ago

TLS* does not allow websites to restrict users from using the tech stack (hardware, OS, browser) that they want to use. This does.

endisneigh 3y ago
Fundamentally both give a 3rd party the authority to verify the legitimacy of something, and similarly both can be avoided if you're willing to not participate.
- lxgr 3y ago
  I think you're mistaken about what TLS does. It doesn't give a third party any authority to verify anything. It provides integrity and confidentiality to both parties to an HTTP exchange, nothing more. A TLS client does not contain any trusted private key. You can write one yourself by reading the RFCs. The same is not true for WEI.
  - roblabla 3y ago
    TLS used to also guarantee that you were talking to the correct entity, that's what EV certificates are for. So there was a verification step that ensured that you were indeed the business/organization you were claiming to be. The EV certs still exists, but the browsers don't really differenciate between DV and EV certs anymore.
    - lxgr 3y ago
      Ah, yes, in that sense I can see the parallel (in that being reachable in modern browsers is contingent on being able to obtain a TLS certificate). I remember similar concerns being raised about browsers discouraging HTTP. But TLS certificates solve a much narrower problem than WEI ("are you communicating with the site you think you are") and are widely and cheaply available from multiple organizationally independent certificate authorities. In particular, TLS certificates don't try to make an assertion about the website visited, i.e. "this site is operated by honest people, not scammers". WEI does, with the assertion being something like "this browser will not allow injecting scripts or blocking elements".

amarshall 3y ago

SSL is the client verifying the server, and the client can thusly opt to skip or alter that in any way it sees fit. WEI is the reverse: the server validating the client, so the client has no choice to opt-out.

NoMoreNicksLeft 3y ago

Anyone using a browser without this feature will end up becoming second class citizens who must jump through (extreme) hoops to use the web... Or they're just walled off from most of the web entirely. I use a variety of personally developed web scraper scripts. For instance, I have digital copies of every paystub. These will almost all become worthless. My retirement plan at a previous employer would not let me download monthly statements unless I did it manually... it was able to detect the Mechanize library, and responded with some creepy-assed warning against robots. No one would go to the trouble to do that manually every month, and no one was allowed robots apparently. But at least they needed to install some specialty software somewhere to disallow it. This shit will just make it even easier for the assholes. I also worry about tools I sometimes use for things like Selenium. This isn't SSL.

endisneigh 3y ago
This is not true. Sites will not be obligated to implement WEI. At the end of the day bots are a real issue, with no real solution other than attestation. AI is accelerating this issue. This (WEI or something else) is inevitable.
- NoMoreNicksLeft 3y ago
  > This is not true. Sites will not be obligated to implement WEI. There are a number of sites I frequent but don't log in to or register for an account. Every single one of them has an absurd number of captchas, or I see the cloudflare protection thing come up for first for 3 seconds. So while hypothetically it may be true that they don't have to do it, they will. It's not even clear to me that Firefox could implement it too... so do I have to switch back to Chrome (or [barf] Safari?)? Dunno. I can't predict the future, but you'd have to be in some sort of denial to not see where this is going. > At the end of the day bots are a real issue Bots are fucking awesome. We should all have bots, out there doing the boring stuff, bringing back the goodies to us. If someone tells you that bots are bad, they're lying to you because they're afraid that you might find out how much you'd want one.
- lxgr 3y ago
  Maybe so, but if so, let's please make it something else. I'm fine with attestation when it comes to high-risk tasks such as confirming financial transactions or signing legal documents, or anonymous "proof-of-humanity" solutions such as Apple's Private Access Tokens (as long as there's a CAPTCHA-based or similar alternative!) for free trials or account creations (beats using SMS/phone number authentication, at least), but applying Trusted Computing to the entire browser just goes much too far.

klabb3 3y ago

SSL is in practice only used for server certificates. It was kinda shit and a lot of people complained because of CAs but then we got let’s encrypt etc which alleviated the situation. And the identity is only tied to domain control, unlike eg code signing certs which are orders of magnitude more invasive and frankly a racket. In either case, WEI has the potential to be proper DRM, like in the “approved devices” fashion. It’s deeply invasive, and can be used to exclude any type of usage at the whim of mega corps, like screen readers, ad blocking, anti-tracking/fingerprinting, downloading copyrighted content, and anything new they can think of in the future. It’s quite literally the gateway to making the web an App Store (or at best, multiple app stores). > What's the alternative solution? To what problem? Bots specifically or humans who want to use the web in any way they want? If bots, then elaborate. Many bots are good, and ironically the vast majority of bot traffic comes from the very corporations that are behind this stuff. As for the really bad bots, we have IP blocklisting. For the gray/manipulative bots, sure, that’s a problem. What makes you think that problem needs to be addressed with mandatory handcuffs for everyone else?

endisneigh 3y ago
Why should sites be obligated to let anyone in? Do you let anyone into your house? I'm surprised WEI wasn't implemented long ago. This notion of destroying the open web is so nonsensical. WEI is not obligatory. If it's being implemented it's because it solves a real problem. Think about it. There will still be sites that don't use it. People's real issue is that the big sites will use WEI because the problem it solves is legitimate but they don't want to identify themselves, which makes sense, but they were never obligated to let you visit their site to begin with.
- deleted 3y ago
  [deleted]
- thatguy0900 3y ago
  And if Google decides later that adsense from untrusted browsers doesn't count? Youtube and gmaol refuses to run at all on untrusted browsers? Is it still optional, realisticly?

hnav 3y ago

Maybe mTLS/logging in.

j1elo 3y ago

Bots will get sophisticated. This all seems to me that in a decade we'll be having the same discussion, with the same excuse, but eventually the proposal from big corporations will be to require plugging-in a government-issued ID card into a smartcard reader in order to access pre-approved websites with pre-approved client portals running in pre-approved machines.

fooyc 3y ago

WEI won’t even stop the bad bots. They will simply use "legitimate" devices.

burkaman 3y ago

How would this prevent bots? It's very easy to set up a bot that's running Chrome on Android, or whatever environment is required. Bots can do whatever you tell them without complaining. This only prevents actual humans who want to use a non-mainstream browser, or use add-ons to help them browse, or use a non-mainstream operating system or device.

seanalltogether 3y ago

I think your comparison to SSL is actually important, because encryption is a discrete problem with a discrete solution. But this WEI proposal is designed to detect botting, which is a cat and mouse problem without a clear end game.

yonatan8070 3y ago
Exactly, if people want to create bots, at the end of the days we'll end up with VMs running AutoHotkey and Chrome, or physical machines with fake mice and keyboards, or actual computer setups with robot arms moving the mouse around, there's no stopping bots
- lxgr 3y ago
  Well, not if you ultimately tie something like WEI to hardware attestation. Then fraudsters would have to buy additional devices, which is not a complete deterrent [1], but would change the economics significantly. But many here are (in my view rightly) arguing that this would be too high a price to pay for bot/spam protection, since it would almost inevitably cement the browser, OS, and device monoculture even further. [1] https://www.cultofmac.com/311171/crazy-iphone-rig-shows-chinese-workers-manipulate-app-store-rankings/ https://www.cultofmac.com/311171/crazy-iphone-rig-shows-chin...
  - Urd- 3y ago
    >Then fraudsters would have to buy additional devices Which a lot of them already do: https://www.youtube.com/watch?v=hsCJU9djdIc https://www.youtube.com/watch?v=hsCJU9djdIc Or just use a botnet to steal use of someone else's hardware, which is also very common for malicious bots.

guy98238710 3y ago

Yeah, sure, let's implement this dystopian nightmare technology to solve our little engineering problem.

guy98238710 3y ago

> Anyone who's run a site knows the headache around bots. Sites that don't care about bots can simply not use WEI. So is it a headache for all/most sites or is it not?

Buttons840 3y ago

WEI is really about denying the user full control of their own device. If you give people full control of their devices, you will have bots. Do you believe eliminating bots is more important than general purpose computing? A bot is just some computer doing what its owner wants. OP is happy because WEI will eliminate bots. OP is inconvenienced by other people using computers in ways they don't like, and wants to take control of the computer away. As strong AI is knocking on the door, we see people wanting to take general purpose computing away. All the worst outcomes involve people losing the ability to control their own computers.

ori_b 3y ago
> WEI is really about denying the user full control of their own device. If you give people full control of their devices, you will have bots. Do you believe eliminating bots is more important than general purpose computing? Worse than that -- unless you disallow any sort of scripting and accessibility hooks, WEI doesn't prevent malicious requests. It just forces you to script your system via autohotkey or its equivalent.
- Buttons840 3y ago
  Yep. And what will the solution to that be? People used browser APIs and some other people thought to take that away. When some people use autohotkey, what will the other people think about doing?
- tjpnz 3y ago
  That's by design given how many ads for scams and malware Google serves.

ori_b 3y ago

WEI doesn't prevent bots. Bots would just need to script an attested browser via tools like AutoHotKey -- the only way WEI would prevent bots would be by preventing you from running the browser on an operating system without 3rd party software installed. WEI is a 2 or 3 month roadbump for bot builders. WEI does prevent any customization.

alex7734 3y ago
> the only way WEI would prevent bots would be by preventing you from running the browser on an operating system without 3rd party software installed Or by isolating the browser from third party software. Android does not let applications mess with each other. Windows already prevents non-elevated applications from touching elevated applications (i.e. running as administrator). What makes you think that Windows won't add an "untouchable" mode to executables belonging to "approved" browsers? The kernel is already locked down so you won't be able to bypass it that easily.
- deleted 3y ago
  [deleted]
- drchaos 3y ago
  It's absolutely possible to automate an "attested" phone with a physical robot finger, which is neither extremely complicated or expensive tech. It might be too expensive for mass-scale DDOS, but it would still be cost-effective for more interesting things like click fraud.
- ori_b 3y ago
  > Or by isolating the browser from third party software. Android does not let applications mess with each other. Android lets applications mess with each other. That's how the accessibility features work.

iczero 3y ago

WEI is like requiring people to get their brain scanned before you let them visit your house. "Sorry, I require a valid attestation from Google that you are a real human," you say. Your friend now needs to drive down to the local Google® Privacy Invasion Center™ and have all of their personal secrets exposed so Google can prove they are, in fact, not a robot. Except, oh no, Google found Linux in their brain scan! The horror! How dare they value their own freedom! Anyone who opposes spying from Chrome and/or Google Play Services is obviously a bot. Nothing to hide, nothing to fear, right? Your visitor, who is clearly not a bot, fails to obtain a valid attestation from Google. You deny them entry to your house. You have lost an acquaintance.