5 ms·

Very controversial take but I think this benefits the vast majority of users by allowing them to bypass captchas. I’m assuming that people would use this API to

Very controversial take but I think this benefits the vast majority of users by allowing them to bypass captchas. I’m assuming that people would use this API to avoid showing real users captchas, not completely prevent them from browsing the web. Unfortunately people who have rooted phones, who use nonstandard browsers are not more than 1% of users. It’s important that they exist, but the web is a massive platform. We can not let a tyranny of 1% of users steer the ship. The vast majority of users would benefit from this, if it really works. However i could see that this tool would be abused by certain websites and prevent users from logging in if on a non standard browser, especially banks. Unfortunate but overall beneficial to the masses. Edit: Apparently 5% of the time it intentionally omits the result so it can’t be used to block clients. Very reasonable solution.

JohnFen 3y ago
> I think this benefits the vast majority of users by allowing them to bypass captchas. I don't think it does that. Nothing about this reduces the problem that captchas are attempting to solve. > i could see that this tool would be abused by certain websites and prevent users from logging in if on a non standard browser, especially banks. That's not abusing this tool. That's the very thing that this is intended to allow.
- deleted 3y ago
  [deleted]
- ec109685 3y ago
  The explicit goals are thus: * Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device. * Offer an adversarially robust and long-term sustainable anti-abuse solution. * Don't enable new cross-site user tracking capabilities through attestation. Continue to allow web browsers to browse the Web without attestation. From: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#goals https://github.com/RupertBenWiser/Web-Environment-Integrity/... If it actually won't do any of those things, then that should be debated first.
  - JohnFen 3y ago
    Captchas are intended to stop bots. WEI is intended to vet that the hardware and browser has been validated. That doesn't impact bots, because you can implement bots on top of a valid hardware and browser so it will pass the WEI check.
    - jrockway 3y ago
      I remember the discussions on Slashdot many years ago about the "analog hole"; you can have all the DRM you want, but people can still point a camera at the screen and record a non-encumbered copy that way. This is definitely the case with automating web activities; you take a trusted computer, point a camera at it, and have your bot synthesize keypresses and mouse movements. There is absolutely no way for a website at the other end of the Internet to know that a human is using the computer. (I see this as the "end game" for FPS cheating. I don't think anyone is doing it yet, but it's bound to happen.) I'm guessing the reason we want attestation is so that Chrome can drop ad blockers and websites can drop non-Chrome browsers. But there is no reason why you can't do the thing where you point a video camera at a monitor, have AI black out the ads, and then view the edited video feed instead of the real one. The only use for attestation I see is for work-from-home corporate Intranets. Sure, make sure that OS is up to date before you're willing to send High-Value Intellectual Property to the laptop. That... already works and doesn't involve web standards. (At my current job, I'm in the hilarious position where all of our source code is open-source and anyone on Earth can edit it, but I have to use a trusted computer to do things like anti-discrimination training. It's like opsec backwards. But, the attestation works fine, no new tech needed.)
      - pests 3y ago
        > and have your bot synthesize keypresses and mouse movements Is this truely going to work though? Captcha provider already monitor mouse and keyboard movement while on the page. Can you really "synthesize" human-like mouse movements around the page? I'm not so sure.
        3y ago
adamrezich 3y ago
how often do normal users see CAPTCHAs these days? I seldom see one anymore.
- dotancohen 3y ago
  I see them all the time. Firefox on Ubuntu.
  - adamrezich 3y ago
    but where? which websites? I haven't seen a CAPTCHA on the reg since I stopped posting to 4chan some years back.
    - hnav 3y ago
      Most websites have them, just browse in incognito and either override your user-agent to something funky or connect through a known VPN.
      - pests 3y ago
        Ah, just do something completely nonstandard (sans incognito) and the website will stop working.
    - i_love_cookies 3y ago
      almost anything using cloudflare
- hellojesus 3y ago
  I get them often, especially with more privacy features turned on. But usually a VPN is enough to trigger it when visiting Google domains.
  - Given_47 3y ago
    There’s a select few mullvad addresses that don’t trigger it but the majority I use I’ll get hit with them. I honestly find it more concerning when I’m expecting one and I don’t get served a ridiculous puzzle to solve.
version_five 3y ago
Most captchas these days are already only there to enforce Google's monopoly. If you use and "approved" browser and let them track you, you don't get one, browse anonymously and you can't get past. That ship has already sailed and it's already evil, anticompetitive behavior.
wbobeirne 3y ago
> Unfortunately people who have rooted phones, who use nonstandard browsers are not more than 1% of users Depends on what you count as "nonstandard", but various estimates put non-top 6 browser usage at between 3-12% (https://en.wikipedia.org/wiki/Usage_share_of_web_browsers#Summary_tables https://en.wikipedia.org/wiki/Usage_share_of_web_browsers#Su...) and non-Windows/macOS/iOS/Android usage at ~4% (https://en.wikipedia.org/wiki/Usage_share_of_operating_systems#Web_clients https://en.wikipedia.org/wiki/Usage_share_of_operating_syste....) These also don't take into account traffic on older operating systems or hardware that would be incompatible with these attestations, or clients that spoof their user agent for anonymity. In an ideal world, we would see this number grow, not shrink. It's not good for consumers if our choices dwindle to just one or two options.
dotancohen 3y ago
> We can not let a tyranny of 1% of users steer the ship. Far less than 1% of my users use the accessibility features. In fact, it is closer to 1% of 1%. Does that justify the far, far easier development and bug testing that I would enjoy if I were to stop providing accessibility features?
jdrek1 3y ago
> We can not let a tyranny of 1% of users steer the ship. Normally I'd agree with you on that the tyranny of the minority is a bad thing, but sometimes the minority actually has a point and this is one of the cases where the minority is _objectively_ correct and letting the majority decide would end up in a complete dystopia. Democracy only works if everyone is informed (and able to think logically/critically, not influenced (either by force or by salary), etc.) and in this case the 99% simply do not have any clue on the effects of this being implemented (nor do they care). This entire proposal is pure orwellian shit.
idreyn 3y ago
WEI acts as proof that "this is a browser", not "this is a human". But browsers can be automated with tools like Selenium. I'd guess that with the advent of complicated, JS-based captchas, browsers under automation are already the major battleground between serious scrapers and anti-bot tools. I also don't understand how WEI does much to prevent a motivated user from faking requests. If you have Chrome running on your machine it's not gonna be too hard to extract a signed WEI token from its execution, one way or another, and pass that along with your Python script. It looks like it basically gives Google another tool to constrain users' choices.
- Spivak 3y ago
  > But browsers can be automated with tools like Selenium And I will bet anything that if the browser is being instrumented via webdriver it will attest as such. You would have to automate the browser externally.
  - danShumway 3y ago
    Will it attest that it's running an extension? I can intercept and modify web requests, redirect web requests, and send web requests to other domains through a web extension. I can also scrape the HTML and I can use native messaging or normal HTTP requests to send that information out of the browser. And I can also modify CORS headers to get rid of restrictions around sending requests from another domain. I can't literally emulate mouse movements but the only place that matters is... captchas. If you're not watching for those kinds of behaviors, then a browser even without webdriver can be automated just fine. And if you are watching for those behaviors, then you're running a captcha, so what is WEI helping with? Google claims this is not going to impact browser extensions, debugging, etc... but if it's not going to impact that stuff, then it's not really helpful for guaranteeing that the user isn't automating requests. What it is helpful for is reducing user freedom around their OS/hardware and setting the stage for attacking extensions like adblockers more directly in the future.
mindslight 3y ago
That is not controversial at all, but rather a plain fact about the short term incentives! If adoption of this technology weren't an attractor, then we'd have nothing to worry about. But the problem is the functionality of this spec, supported by the fundamental backdoor of corporate TPMs, is set up to facilitate power dynamics that inevitably result in full corporate control over everyone's computing environment.
insanitybit 3y ago
There are obvious benefits here. The ability to remove captchas is one, the ability to ensure that clients are running the latest updates before accessing sensitive content, etc. But the power is too significant. If it were some small subset of positive assertions I'd be ok with this, but the ability to perform arbitrary attestation is beyond what is required and is far too abusable.

JohnFen 3y ago

> I think this benefits the vast majority of users by allowing them to bypass captchas. I don't think it does that. Nothing about this reduces the problem that captchas are attempting to solve. > i could see that this tool would be abused by certain websites and prevent users from logging in if on a non standard browser, especially banks. That's not abusing this tool. That's the very thing that this is intended to allow.

deleted 3y ago
[deleted]
ec109685 3y ago
The explicit goals are thus: * Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device. * Offer an adversarially robust and long-term sustainable anti-abuse solution. * Don't enable new cross-site user tracking capabilities through attestation. Continue to allow web browsers to browse the Web without attestation. From: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#goals https://github.com/RupertBenWiser/Web-Environment-Integrity/... If it actually won't do any of those things, then that should be debated first.
- JohnFen 3y ago
  Captchas are intended to stop bots. WEI is intended to vet that the hardware and browser has been validated. That doesn't impact bots, because you can implement bots on top of a valid hardware and browser so it will pass the WEI check.
  - jrockway 3y ago
    I remember the discussions on Slashdot many years ago about the "analog hole"; you can have all the DRM you want, but people can still point a camera at the screen and record a non-encumbered copy that way. This is definitely the case with automating web activities; you take a trusted computer, point a camera at it, and have your bot synthesize keypresses and mouse movements. There is absolutely no way for a website at the other end of the Internet to know that a human is using the computer. (I see this as the "end game" for FPS cheating. I don't think anyone is doing it yet, but it's bound to happen.) I'm guessing the reason we want attestation is so that Chrome can drop ad blockers and websites can drop non-Chrome browsers. But there is no reason why you can't do the thing where you point a video camera at a monitor, have AI black out the ads, and then view the edited video feed instead of the real one. The only use for attestation I see is for work-from-home corporate Intranets. Sure, make sure that OS is up to date before you're willing to send High-Value Intellectual Property to the laptop. That... already works and doesn't involve web standards. (At my current job, I'm in the hilarious position where all of our source code is open-source and anyone on Earth can edit it, but I have to use a trusted computer to do things like anti-discrimination training. It's like opsec backwards. But, the attestation works fine, no new tech needed.)
    - pests 3y ago
      > and have your bot synthesize keypresses and mouse movements Is this truely going to work though? Captcha provider already monitor mouse and keyboard movement while on the page. Can you really "synthesize" human-like mouse movements around the page? I'm not so sure.
      - 3y ago

adamrezich 3y ago

how often do normal users see CAPTCHAs these days? I seldom see one anymore.

dotancohen 3y ago
I see them all the time. Firefox on Ubuntu.
- adamrezich 3y ago
  but where? which websites? I haven't seen a CAPTCHA on the reg since I stopped posting to 4chan some years back.
  - hnav 3y ago
    Most websites have them, just browse in incognito and either override your user-agent to something funky or connect through a known VPN.
    - pests 3y ago
      Ah, just do something completely nonstandard (sans incognito) and the website will stop working.
  - i_love_cookies 3y ago
    almost anything using cloudflare
hellojesus 3y ago
I get them often, especially with more privacy features turned on. But usually a VPN is enough to trigger it when visiting Google domains.
- Given_47 3y ago
  There’s a select few mullvad addresses that don’t trigger it but the majority I use I’ll get hit with them. I honestly find it more concerning when I’m expecting one and I don’t get served a ridiculous puzzle to solve.

version_five 3y ago

Most captchas these days are already only there to enforce Google's monopoly. If you use and "approved" browser and let them track you, you don't get one, browse anonymously and you can't get past. That ship has already sailed and it's already evil, anticompetitive behavior.

wbobeirne 3y ago

> Unfortunately people who have rooted phones, who use nonstandard browsers are not more than 1% of users Depends on what you count as "nonstandard", but various estimates put non-top 6 browser usage at between 3-12% (https://en.wikipedia.org/wiki/Usage_share_of_web_browsers#Summary_tables https://en.wikipedia.org/wiki/Usage_share_of_web_browsers#Su...) and non-Windows/macOS/iOS/Android usage at ~4% (https://en.wikipedia.org/wiki/Usage_share_of_operating_systems#Web_clients https://en.wikipedia.org/wiki/Usage_share_of_operating_syste....) These also don't take into account traffic on older operating systems or hardware that would be incompatible with these attestations, or clients that spoof their user agent for anonymity. In an ideal world, we would see this number grow, not shrink. It's not good for consumers if our choices dwindle to just one or two options.

dotancohen 3y ago

> We can not let a tyranny of 1% of users steer the ship. Far less than 1% of my users use the accessibility features. In fact, it is closer to 1% of 1%. Does that justify the far, far easier development and bug testing that I would enjoy if I were to stop providing accessibility features?

jdrek1 3y ago

> We can not let a tyranny of 1% of users steer the ship. Normally I'd agree with you on that the tyranny of the minority is a bad thing, but sometimes the minority actually has a point and this is one of the cases where the minority is _objectively_ correct and letting the majority decide would end up in a complete dystopia. Democracy only works if everyone is informed (and able to think logically/critically, not influenced (either by force or by salary), etc.) and in this case the 99% simply do not have any clue on the effects of this being implemented (nor do they care). This entire proposal is pure orwellian shit.

idreyn 3y ago

WEI acts as proof that "this is a browser", not "this is a human". But browsers can be automated with tools like Selenium. I'd guess that with the advent of complicated, JS-based captchas, browsers under automation are already the major battleground between serious scrapers and anti-bot tools. I also don't understand how WEI does much to prevent a motivated user from faking requests. If you have Chrome running on your machine it's not gonna be too hard to extract a signed WEI token from its execution, one way or another, and pass that along with your Python script. It looks like it basically gives Google another tool to constrain users' choices.

Spivak 3y ago
> But browsers can be automated with tools like Selenium And I will bet anything that if the browser is being instrumented via webdriver it will attest as such. You would have to automate the browser externally.
- danShumway 3y ago
  Will it attest that it's running an extension? I can intercept and modify web requests, redirect web requests, and send web requests to other domains through a web extension. I can also scrape the HTML and I can use native messaging or normal HTTP requests to send that information out of the browser. And I can also modify CORS headers to get rid of restrictions around sending requests from another domain. I can't literally emulate mouse movements but the only place that matters is... captchas. If you're not watching for those kinds of behaviors, then a browser even without webdriver can be automated just fine. And if you are watching for those behaviors, then you're running a captcha, so what is WEI helping with? Google claims this is not going to impact browser extensions, debugging, etc... but if it's not going to impact that stuff, then it's not really helpful for guaranteeing that the user isn't automating requests. What it is helpful for is reducing user freedom around their OS/hardware and setting the stage for attacking extensions like adblockers more directly in the future.

mindslight 3y ago

That is not controversial at all, but rather a plain fact about the short term incentives! If adoption of this technology weren't an attractor, then we'd have nothing to worry about. But the problem is the functionality of this spec, supported by the fundamental backdoor of corporate TPMs, is set up to facilitate power dynamics that inevitably result in full corporate control over everyone's computing environment.

insanitybit 3y ago

There are obvious benefits here. The ability to remove captchas is one, the ability to ensure that clients are running the latest updates before accessing sensitive content, etc. But the power is too significant. If it were some small subset of positive assertions I'd be ok with this, but the ability to perform arbitrary attestation is beyond what is required and is far too abusable.