5 ms·

The explicit goals are thus: * Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic fro

The explicit goals are thus: * Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device. * Offer an adversarially robust and long-term sustainable anti-abuse solution. * Don't enable new cross-site user tracking capabilities through attestation. Continue to allow web browsers to browse the Web without attestation. From: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#goals https://github.com/RupertBenWiser/Web-Environment-Integrity/... If it actually won't do any of those things, then that should be debated first.

JohnFen 3y ago
Captchas are intended to stop bots. WEI is intended to vet that the hardware and browser has been validated. That doesn't impact bots, because you can implement bots on top of a valid hardware and browser so it will pass the WEI check.
- jrockway 3y ago
  I remember the discussions on Slashdot many years ago about the "analog hole"; you can have all the DRM you want, but people can still point a camera at the screen and record a non-encumbered copy that way. This is definitely the case with automating web activities; you take a trusted computer, point a camera at it, and have your bot synthesize keypresses and mouse movements. There is absolutely no way for a website at the other end of the Internet to know that a human is using the computer. (I see this as the "end game" for FPS cheating. I don't think anyone is doing it yet, but it's bound to happen.) I'm guessing the reason we want attestation is so that Chrome can drop ad blockers and websites can drop non-Chrome browsers. But there is no reason why you can't do the thing where you point a video camera at a monitor, have AI black out the ads, and then view the edited video feed instead of the real one. The only use for attestation I see is for work-from-home corporate Intranets. Sure, make sure that OS is up to date before you're willing to send High-Value Intellectual Property to the laptop. That... already works and doesn't involve web standards. (At my current job, I'm in the hilarious position where all of our source code is open-source and anyone on Earth can edit it, but I have to use a trusted computer to do things like anti-discrimination training. It's like opsec backwards. But, the attestation works fine, no new tech needed.)
  - pests 3y ago
    > and have your bot synthesize keypresses and mouse movements Is this truely going to work though? Captcha provider already monitor mouse and keyboard movement while on the page. Can you really "synthesize" human-like mouse movements around the page? I'm not so sure.
    - jrockway 3y ago
      I am sure you can. This is exactly what AI excels at!
    - tikhonj 3y ago
      Captcha providers can't rely exclusively on mouse movement because of accessibility considerations, and it seems pretty easy to emulate human-like keyboard interaction. Emulating realistic mouse movement is more difficult but probably doable too.
      - hellojesus 3y ago
        I bet it's pretty easy. Capture your own mouse movements from one place to the next as denoted by clicks. Then train a model on reproducing those movements, using your captured data of movement from points A to B. It would probably generalize well enough to pass the verifications. Humans are very unpredictable, so I assume those are mostly looking for superhuman speed and accuracy.
        costco 3y ago
        https://github.com/vincentbavitz/bezmouse https://github.com/vincentbavitz/bezmouse > BezMouse is a lightweight tool written in Python to simulate human-like mouse movements with Bézier curves. Some applications might include: > BezMouse was originally written for a RuneScape color bot and has never triggered macro detection in over 400 hours of continuous use. :)
    - JohnFen 3y ago
      > Can you really "synthesize" human-like mouse movements around the page? Yes. It's not even very hard.
- danShumway 3y ago
  This is also how you know the "this won't impact extensions" talk is likely nonsense. If you can still run extensions you still need captchas. So one possible road this takes is Google launches it, everybody still uses captchas because extensions in desktop browsers still make automating requests trivial -- and then we lock down extensions because "we already locked down the hardware and we really do need to do something about captchas..."
- ec109685 3y ago
  > We're still discussing whether each of the following pieces of information should be included and welcome your feedback: * The device integrity verdict must be low entropy, but what granularity of verdicts should we allow? Including more information in the verdict will cover a wider range of use cases without locking out older devices. * A granular approach proved useful previously in the Play Integrity API. * The platform identity of the application that requested the attestation, like com.chrome.beta, org.mozilla.firefox, or com.apple.mobilesafari. * Some indicator enabling rate limiting against a physical device

JohnFen 3y ago

Captchas are intended to stop bots. WEI is intended to vet that the hardware and browser has been validated. That doesn't impact bots, because you can implement bots on top of a valid hardware and browser so it will pass the WEI check.

jrockway 3y ago
I remember the discussions on Slashdot many years ago about the "analog hole"; you can have all the DRM you want, but people can still point a camera at the screen and record a non-encumbered copy that way. This is definitely the case with automating web activities; you take a trusted computer, point a camera at it, and have your bot synthesize keypresses and mouse movements. There is absolutely no way for a website at the other end of the Internet to know that a human is using the computer. (I see this as the "end game" for FPS cheating. I don't think anyone is doing it yet, but it's bound to happen.) I'm guessing the reason we want attestation is so that Chrome can drop ad blockers and websites can drop non-Chrome browsers. But there is no reason why you can't do the thing where you point a video camera at a monitor, have AI black out the ads, and then view the edited video feed instead of the real one. The only use for attestation I see is for work-from-home corporate Intranets. Sure, make sure that OS is up to date before you're willing to send High-Value Intellectual Property to the laptop. That... already works and doesn't involve web standards. (At my current job, I'm in the hilarious position where all of our source code is open-source and anyone on Earth can edit it, but I have to use a trusted computer to do things like anti-discrimination training. It's like opsec backwards. But, the attestation works fine, no new tech needed.)
- pests 3y ago
  > and have your bot synthesize keypresses and mouse movements Is this truely going to work though? Captcha provider already monitor mouse and keyboard movement while on the page. Can you really "synthesize" human-like mouse movements around the page? I'm not so sure.
  - jrockway 3y ago
    I am sure you can. This is exactly what AI excels at!
  - tikhonj 3y ago
    Captcha providers can't rely exclusively on mouse movement because of accessibility considerations, and it seems pretty easy to emulate human-like keyboard interaction. Emulating realistic mouse movement is more difficult but probably doable too.
    - hellojesus 3y ago
      I bet it's pretty easy. Capture your own mouse movements from one place to the next as denoted by clicks. Then train a model on reproducing those movements, using your captured data of movement from points A to B. It would probably generalize well enough to pass the verifications. Humans are very unpredictable, so I assume those are mostly looking for superhuman speed and accuracy.
      - costco 3y ago
        https://github.com/vincentbavitz/bezmouse https://github.com/vincentbavitz/bezmouse > BezMouse is a lightweight tool written in Python to simulate human-like mouse movements with Bézier curves. Some applications might include: > BezMouse was originally written for a RuneScape color bot and has never triggered macro detection in over 400 hours of continuous use. :)
  - JohnFen 3y ago
    > Can you really "synthesize" human-like mouse movements around the page? Yes. It's not even very hard.
danShumway 3y ago
This is also how you know the "this won't impact extensions" talk is likely nonsense. If you can still run extensions you still need captchas. So one possible road this takes is Google launches it, everybody still uses captchas because extensions in desktop browsers still make automating requests trivial -- and then we lock down extensions because "we already locked down the hardware and we really do need to do something about captchas..."
ec109685 3y ago
> We're still discussing whether each of the following pieces of information should be included and welcome your feedback: * The device integrity verdict must be low entropy, but what granularity of verdicts should we allow? Including more information in the verdict will cover a wider range of use cases without locking out older devices. * A granular approach proved useful previously in the Play Integrity API. * The platform identity of the application that requested the attestation, like com.chrome.beta, org.mozilla.firefox, or com.apple.mobilesafari. * Some indicator enabling rate limiting against a physical device