11 ms·

Google's browser security plan slammed as dangerous, terrible, DRM for websites

208 points by mikece 3y ago

echelon 3y ago
If Google does this, I'll switch to sharing news stripped of ads via p2p. I'm so sick of this bullshit. AMP, Manifest V2, buying their way into every corner of the web, ... In the meantime, please call your legislators and regulators. Tell them Google's too big to be allowed to have a web browser and that one solution is splitting out their business units.
- kroltan 3y ago
  Google is currently doing this. Origin trials are being implemented already.
- nancyhn 3y ago
  Google employees could resolve this. They've dissented for various reasons before, and changed internal policy, why not with this?
  - ta1243 3y ago
    It Is Difficult to Get a Man to Understand Something When His Salary Depends Upon His Not Understanding It
    - 2OEH8eoCRo0 3y ago
      Show me the incentive and I'll show you the outcome
    - shadowgovt 3y ago
      In this case, it's not even his salary: it's his comfort and ease of labor. It's hard to support a heterogeneous space of user agents running on a heterogeneous set of platforms. Eventually, abstractions break and you end up with a weird bug that only manifests on such-and-such browser in so-and-so configuration. How much easier life is if you only have to support a few browsers on hardware that checksums to have a known-good configuration...
      - dleeftink 3y ago
        In the end, does ease of development outweigh all secondary parties affected in this case?
        echelon 3y ago
        Distribution of power is worth the overhead.
      - somsak2 3y ago
        You think people care more about that than their salary?
        shadowgovt 3y ago
        It'd vary from person to person, but to a first approximation: Googlers are well-compensated and can be well-compensated at a lot of places. The next best compensation the company can offer them is minimizing drudgework. Chasing down render errors in the deep interactions between declarative HTML rendering and an esoteric-but-important hardware / software configuration is drudgework.
        dleeftink 3y ago
        On the other side, drudgework, in all its dullness and frustration, is still work. If there's less of it, some jobs may be disappear--cushy salary or not. Some of my best ideas even, came out of clearing drudge.
  - nness 3y ago
    Dissent was a pre mass-layoff phenomenon.
  - echelon 3y ago
    It isn't 1995-2010 anymore. We've lost the ethos of the open web due to platformization and social media fatigue. Gen Z knows nothing of what the web was once like, and lots of folks now embrace companies being stewards of the commons, eg. Apple App Store. There's also the current down hiring market and macro economic conditions.
    - shadowgovt 3y ago
      The hacker era of the web was "take care of it yourself." It has been supplanted by "we will take care of you." In hindsight, perhaps none of us should have been surprised the latter was a better proposal for most people.
    - tim333 3y ago
      A lot of open web is still out there. I guess if people choose to use platforms it's up to them.
  - numbsafari 3y ago
    Why would they dissent... you think Pichai is writing the code himself? Google employees are the ones writing this code, doing the designs, the QA, the project planning. You can't expect the people who work for these companies to do the right thing. Time and time again, it requires outside forces. Either customers or legislation.
  - mistercheph 3y ago
    Googlers only dissent about issues handcrafted to be distractions, anything Google does that threatens the preservation of open and free societies is fair play.
- LordShredda 3y ago
  That's a good point, what do you use the Internet for anyways? News, banking, governmental rituals, maybe searching for a book or a topic to learn. Sometimes a work meeting or an email or wasting time watching YouTube or listening to music. These all don't need drm or whatever. Some don't even need internet, you can just download files like your grandfather did 10 years ago
  - shadowgovt 3y ago
    > banking A commonly repeated concern is that if WEI is implemented, banks will leap on it and it will become infeasible to do online transactions at most banks without either using a WEI-blessed software / hardware configuration or the bank's app in a commercial app store.
    - deleted 3y ago
      [deleted]
    - pipo234 3y ago
      Banks don't need the "anonymous" part of the WEI, just the "authentic" chain of trust as in am I really identifying a life person rather than a robot impersonation. Banks are lazy, they shouldn't need to rely on infrastructure of commercial app stores, blessed devices since they've already proven they could develop it themselves (chip cards, dongles, time-based one time codes, etc.). WEI is mainly aimed at suppressing the unauthenticated noise, when reading a signal from GET requests (ie tracking) that was never meant to convey any information beyond what is asked for, in the first place.
      - shadowgovt 3y ago
        > WEI is mainly aimed at suppressing the unauthenticated noise I'm not really seeing how we're reaching that conclusion. Suppressing GET request noise isn't any of the use cases described at https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/...
- 2OEH8eoCRo0 3y ago
  This feels like the last straw for me- ditching Chrome today and tomorrow, looking at iPhones.
  - shadowgovt 3y ago
    Apple already implemented a variant of this. https://developer.apple.com/news/?id=huqjyh7k https://developer.apple.com/news/?id=huqjyh7k
  - free652 3y ago
    Safari already has WEI, but nobody cares about that.
    - JohnFen 3y ago
      Probably because Apple doing it isn't as likely to ruin the web for everybody as Google doing it.
      - thayne 3y ago
        Only because Apple doesn't have enough marketshare. If everyone was using safari (probably including any browser on iOS which is just a reskin of safari) it would be just as bad. Maybe even worse, as you might get locked out of sites unless you are using apple hardware.
        mglenn 3y ago
        Really depends on the site. Our marketplace sees 50% Safari usage since 60% of the traffic is mobile and Safari has such high usage on mobile for our customers.
  - _joel 3y ago
    Surely they'll still need to adhere to the API's spec to stay relevant?
dleeftink 3y ago
I am keen to hear from insiders on how upper management is framing this. I would love it even more if some of the devs involved would question the underlying (profit) motives before spearheading the next Chrome release.
- hooverd 3y ago
  Google can not fail, only be failed.
0xADADA 3y ago
This outcome is obvious when an ostensible ad-company (the Fox) builds the web browser (the henhouse).
kryptiskt 3y ago
It's untenable to have a fox as guardian of the chicken coop, this shit will return again and again as long as Google controls Chrome. Come on, lets see some serious anti-trust action.
- mistercheph 3y ago
  Lina Khan? hello?
- hollerith 3y ago
  What action specifically? A breakup? The entity that ends up owning Chrome would have to continue to pay for maintenance, at least to keep on patching security holes and responding to new laws and regulations. How is it going to get the money to do that? The Firefox way?
  - matkoniecz 3y ago
    > The Firefox way? Yes. Though they could fundraise also using other methods.
  - inefficient 3y ago
    Google controls way to much of the interaction on the internet. Between Gmail, search, android, and chrome they can and do abuse their position. And this isn't even looking at the backend and ad stuff. It should probably be broken up in to multiple companies each of which would have different business strategies and areas of focus. Allowing a company to essentially break the current internet so that they can guarantee more ad revenue seems like what anti-trust rules were built for. Honestly, google has much more control on the internet with chrome than MS ever did with IE.
  - pipo234 3y ago
    Since we're talking about breakups, how about asking Android to pay up for Chrome? And how about asking customers to pay $50 license for Android when they buy a smart phone? Or an annual fee, for updates and maintenance. I mean, those payments are already done, except they are currently obfuscated because we only see the purchase price when we buy a phone, not the money passed under the table in exchange for yielding our privacy.
mixedCase 3y ago
Convince everyone you know to switch browsers. Tell them the truth we all know: If people keep using Google Chrome, they'll take away ad blocking, they'll block you from copy-pasting, taking screenshots, anything you know the usual bastards have tried or you can imagine will try to restrict a device from doing to try to "extract value out of the user". Firefox is the most obvious alternative, and for those who prefer a Chromium base: Brave, Iridium and ungoogled-chromium, in order of how much functionality has been stripped away from least to most, are open source, privacy-focused solutions.
ChrisArchitect 3y ago
[dupe] Conversation over here about the actual slamming: https://news.ycombinator.com/item?id=36881506 https://news.ycombinator.com/item?id=36881506
RecycledEle 3y ago
I still refuse to host HTTPS. I use HTTP. Screw the post-1999 Internet.
- woodruffw 3y ago
  Is there some context to this, besides wanting to express your personal bugbear? These things aren't in remotely the same category.
rowls66 3y ago
I would put WEI together with a together with a number of other recent changes that I think signal that the land grab error of the web is over, and that web based businesses need to get real about their economics. 1) Netflix restricting password sharing 2) RedHat pushing the limits of the GPL to restrict RHEL re-distribution In some ways, I think this could be a good thing, in that it clearly separates the advertising funded web (the commerical web) from the altruistically funded web (the free web). Maybe with a little luck, the free web becomes something more akin to the web circa 2000 even it has alot less information. That might be better than the open sewer of a web that we have today.
- mistrial9 3y ago
  drug-or-money addicted jerks with computer science training the world over appear to be opportunistically and unrelentingly filling open space with harmful garbage; spiritually similar to open piles of garbage around the street homes of deeply suffering people to my eye. There have to be fences and sanitation of some kind. Handing the entire process over to profit-motivated corps is not the answer, either. It is looking pretty bad today, from here
  - mistercheph 3y ago
    I agree, greed or drug addiction are the only motives I could see for why jerks with computer science training continue to work on products like chrome
    - mistrial9 3y ago
      at a deeper level, something like a Faustian Bargain is probably more apt to model the skilled, less addicted participants...
thesuperbigfrog 3y ago
"The worry is that WEI could potentially be used to disallow ad blocking, to block certain browsers, to limit web scraping (still largely legal, though often disallowed under websites' terms-of-service), to exclude software for downloading YouTube videos or other content, and impose other limitations on otherwise lawful web activities." WEI gives too much control to browser-making big tech companies. Should browser-making big tech companies get to control your computer more than they already do? https://youtu.be/Ag1AKIl_2GM?t=57 https://youtu.be/Ag1AKIl_2GM?t=57
- ulfw 3y ago
  Maybe people should stop using a browser from an ad company. Just a thought.
  - JohnFen 3y ago
    If WEI becomes a real thing, then using an unapproved browser won't be a realistic option.
    - lamontcg 3y ago
      Won't be a realistic option for sites with ads. You could just not visit any of those sites.
      - JohnFen 3y ago
        Obviously, I won't. That does cut out most of the web, though. Also, I doubt that only ad-driven sites will be doing this.
  - istillwritecode 3y ago
    Essentially all browsers are ad-supported, including Firefox.
    - tim333 3y ago
      Safari?
ranting-moth 3y ago
People think that ad blocking is the worst we'll lose. It's not. Attestation parameters are defined by an unknown 3rd party. Want to visit this website? Is your webcam on? Has it been switched on for at least 4 hours/day on average. Do you have Meta written on your forehead as you smile? If not, forget it buddy, are not getting in. Have you installed this .exe file? No? Hit the road.
- dogleash 3y ago
  > People think that ad blocking is the worst we'll lose. Either people will complain that the tangible example is narrowly scoped, or people will complain that the topic is abstract nerd bullshit will no real-world meaning, it won't actually change anything, and insinuate having an opinion about it is cringe. This happens in every fucking conversation on this website about the technical details of a technical coordination (protocols, formats, platforms, interfaces, etc...). Google is the tail wagging the dog. Everyone knows it. Maybe it's time we all give up on the fantasy of technology as an enabler. Just accept that everything will be maximally locked-down and we should only see it as something to interact with when absolutely necessary. Accept that bland cable tv-esqe milquetoast culture with some playskool business collab tools bolted on is the fate of the internet. A blogger - I think The Last Psych - said that technology will be the biggest disappointment since the death of god. I think I understood his point 5 years ago. Recently though, I agree.
- jareklupinski 3y ago
  yea, the whole thing has strong "please drink verification can to continue" vibes
mrguyorama 3y ago
A reminder that HN is full of active google employees. They are here among us, and they are okay with implementing this.
yavgcnk 3y ago
Can someone help me understand what functionality this gives to the website makers over, say, checking your user agent and denying access for FF/safari users?
- aendruk 3y ago
  You can’t spoof your way out of this one.

208 points by mikece 3y ago

If Google does this, I'll switch to sharing news stripped of ads via p2p. I'm so sick of this bullshit. AMP, Manifest V2, buying their way into every corner of the web, ... In the meantime, please call your legislators and regulators. Tell them Google's too big to be allowed to have a web browser and that one solution is splitting out their business units.

kroltan 3y ago
Google is currently doing this. Origin trials are being implemented already.
nancyhn 3y ago
Google employees could resolve this. They've dissented for various reasons before, and changed internal policy, why not with this?
- ta1243 3y ago
  It Is Difficult to Get a Man to Understand Something When His Salary Depends Upon His Not Understanding It
  - 2OEH8eoCRo0 3y ago
    Show me the incentive and I'll show you the outcome
  - shadowgovt 3y ago
    In this case, it's not even his salary: it's his comfort and ease of labor. It's hard to support a heterogeneous space of user agents running on a heterogeneous set of platforms. Eventually, abstractions break and you end up with a weird bug that only manifests on such-and-such browser in so-and-so configuration. How much easier life is if you only have to support a few browsers on hardware that checksums to have a known-good configuration...
    - dleeftink 3y ago
      In the end, does ease of development outweigh all secondary parties affected in this case?
      - echelon 3y ago
        Distribution of power is worth the overhead.
    - somsak2 3y ago
      You think people care more about that than their salary?
      - shadowgovt 3y ago
        It'd vary from person to person, but to a first approximation: Googlers are well-compensated and can be well-compensated at a lot of places. The next best compensation the company can offer them is minimizing drudgework. Chasing down render errors in the deep interactions between declarative HTML rendering and an esoteric-but-important hardware / software configuration is drudgework.
        dleeftink 3y ago
        On the other side, drudgework, in all its dullness and frustration, is still work. If there's less of it, some jobs may be disappear--cushy salary or not. Some of my best ideas even, came out of clearing drudge.
- nness 3y ago
  Dissent was a pre mass-layoff phenomenon.
- echelon 3y ago
  It isn't 1995-2010 anymore. We've lost the ethos of the open web due to platformization and social media fatigue. Gen Z knows nothing of what the web was once like, and lots of folks now embrace companies being stewards of the commons, eg. Apple App Store. There's also the current down hiring market and macro economic conditions.
  - shadowgovt 3y ago
    The hacker era of the web was "take care of it yourself." It has been supplanted by "we will take care of you." In hindsight, perhaps none of us should have been surprised the latter was a better proposal for most people.
  - tim333 3y ago
    A lot of open web is still out there. I guess if people choose to use platforms it's up to them.
- numbsafari 3y ago
  Why would they dissent... you think Pichai is writing the code himself? Google employees are the ones writing this code, doing the designs, the QA, the project planning. You can't expect the people who work for these companies to do the right thing. Time and time again, it requires outside forces. Either customers or legislation.
- mistercheph 3y ago
  Googlers only dissent about issues handcrafted to be distractions, anything Google does that threatens the preservation of open and free societies is fair play.
LordShredda 3y ago
That's a good point, what do you use the Internet for anyways? News, banking, governmental rituals, maybe searching for a book or a topic to learn. Sometimes a work meeting or an email or wasting time watching YouTube or listening to music. These all don't need drm or whatever. Some don't even need internet, you can just download files like your grandfather did 10 years ago
- shadowgovt 3y ago
  > banking A commonly repeated concern is that if WEI is implemented, banks will leap on it and it will become infeasible to do online transactions at most banks without either using a WEI-blessed software / hardware configuration or the bank's app in a commercial app store.
  - deleted 3y ago
    [deleted]
  - pipo234 3y ago
    Banks don't need the "anonymous" part of the WEI, just the "authentic" chain of trust as in am I really identifying a life person rather than a robot impersonation. Banks are lazy, they shouldn't need to rely on infrastructure of commercial app stores, blessed devices since they've already proven they could develop it themselves (chip cards, dongles, time-based one time codes, etc.). WEI is mainly aimed at suppressing the unauthenticated noise, when reading a signal from GET requests (ie tracking) that was never meant to convey any information beyond what is asked for, in the first place.
    - shadowgovt 3y ago
      > WEI is mainly aimed at suppressing the unauthenticated noise I'm not really seeing how we're reaching that conclusion. Suppressing GET request noise isn't any of the use cases described at https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/...
2OEH8eoCRo0 3y ago
This feels like the last straw for me- ditching Chrome today and tomorrow, looking at iPhones.
- shadowgovt 3y ago
  Apple already implemented a variant of this. https://developer.apple.com/news/?id=huqjyh7k https://developer.apple.com/news/?id=huqjyh7k
- free652 3y ago
  Safari already has WEI, but nobody cares about that.
  - JohnFen 3y ago
    Probably because Apple doing it isn't as likely to ruin the web for everybody as Google doing it.
    - thayne 3y ago
      Only because Apple doesn't have enough marketshare. If everyone was using safari (probably including any browser on iOS which is just a reskin of safari) it would be just as bad. Maybe even worse, as you might get locked out of sites unless you are using apple hardware.
      - mglenn 3y ago
        Really depends on the site. Our marketplace sees 50% Safari usage since 60% of the traffic is mobile and Safari has such high usage on mobile for our customers.
- _joel 3y ago
  Surely they'll still need to adhere to the API's spec to stay relevant?

dleeftink 3y ago

I am keen to hear from insiders on how upper management is framing this. I would love it even more if some of the devs involved would question the underlying (profit) motives before spearheading the next Chrome release.

hooverd 3y ago
Google can not fail, only be failed.

0xADADA 3y ago

This outcome is obvious when an ostensible ad-company (the Fox) builds the web browser (the henhouse).

kryptiskt 3y ago

It's untenable to have a fox as guardian of the chicken coop, this shit will return again and again as long as Google controls Chrome. Come on, lets see some serious anti-trust action.

mistercheph 3y ago
Lina Khan? hello?
hollerith 3y ago
What action specifically? A breakup? The entity that ends up owning Chrome would have to continue to pay for maintenance, at least to keep on patching security holes and responding to new laws and regulations. How is it going to get the money to do that? The Firefox way?
- matkoniecz 3y ago
  > The Firefox way? Yes. Though they could fundraise also using other methods.
- inefficient 3y ago
  Google controls way to much of the interaction on the internet. Between Gmail, search, android, and chrome they can and do abuse their position. And this isn't even looking at the backend and ad stuff. It should probably be broken up in to multiple companies each of which would have different business strategies and areas of focus. Allowing a company to essentially break the current internet so that they can guarantee more ad revenue seems like what anti-trust rules were built for. Honestly, google has much more control on the internet with chrome than MS ever did with IE.
- pipo234 3y ago
  Since we're talking about breakups, how about asking Android to pay up for Chrome? And how about asking customers to pay $50 license for Android when they buy a smart phone? Or an annual fee, for updates and maintenance. I mean, those payments are already done, except they are currently obfuscated because we only see the purchase price when we buy a phone, not the money passed under the table in exchange for yielding our privacy.

mixedCase 3y ago

Convince everyone you know to switch browsers. Tell them the truth we all know: If people keep using Google Chrome, they'll take away ad blocking, they'll block you from copy-pasting, taking screenshots, anything you know the usual bastards have tried or you can imagine will try to restrict a device from doing to try to "extract value out of the user". Firefox is the most obvious alternative, and for those who prefer a Chromium base: Brave, Iridium and ungoogled-chromium, in order of how much functionality has been stripped away from least to most, are open source, privacy-focused solutions.

ChrisArchitect 3y ago

[dupe] Conversation over here about the actual slamming: https://news.ycombinator.com/item?id=36881506 https://news.ycombinator.com/item?id=36881506

RecycledEle 3y ago

I still refuse to host HTTPS. I use HTTP. Screw the post-1999 Internet.

woodruffw 3y ago
Is there some context to this, besides wanting to express your personal bugbear? These things aren't in remotely the same category.

rowls66 3y ago

I would put WEI together with a together with a number of other recent changes that I think signal that the land grab error of the web is over, and that web based businesses need to get real about their economics. 1) Netflix restricting password sharing 2) RedHat pushing the limits of the GPL to restrict RHEL re-distribution In some ways, I think this could be a good thing, in that it clearly separates the advertising funded web (the commerical web) from the altruistically funded web (the free web). Maybe with a little luck, the free web becomes something more akin to the web circa 2000 even it has alot less information. That might be better than the open sewer of a web that we have today.

mistrial9 3y ago
drug-or-money addicted jerks with computer science training the world over appear to be opportunistically and unrelentingly filling open space with harmful garbage; spiritually similar to open piles of garbage around the street homes of deeply suffering people to my eye. There have to be fences and sanitation of some kind. Handing the entire process over to profit-motivated corps is not the answer, either. It is looking pretty bad today, from here
- mistercheph 3y ago
  I agree, greed or drug addiction are the only motives I could see for why jerks with computer science training continue to work on products like chrome
  - mistrial9 3y ago
    at a deeper level, something like a Faustian Bargain is probably more apt to model the skilled, less addicted participants...

thesuperbigfrog 3y ago

"The worry is that WEI could potentially be used to disallow ad blocking, to block certain browsers, to limit web scraping (still largely legal, though often disallowed under websites' terms-of-service), to exclude software for downloading YouTube videos or other content, and impose other limitations on otherwise lawful web activities." WEI gives too much control to browser-making big tech companies. Should browser-making big tech companies get to control your computer more than they already do? https://youtu.be/Ag1AKIl_2GM?t=57 https://youtu.be/Ag1AKIl_2GM?t=57

ulfw 3y ago
Maybe people should stop using a browser from an ad company. Just a thought.
- JohnFen 3y ago
  If WEI becomes a real thing, then using an unapproved browser won't be a realistic option.
  - lamontcg 3y ago
    Won't be a realistic option for sites with ads. You could just not visit any of those sites.
    - JohnFen 3y ago
      Obviously, I won't. That does cut out most of the web, though. Also, I doubt that only ad-driven sites will be doing this.
- istillwritecode 3y ago
  Essentially all browsers are ad-supported, including Firefox.
  - tim333 3y ago
    Safari?

ranting-moth 3y ago

People think that ad blocking is the worst we'll lose. It's not. Attestation parameters are defined by an unknown 3rd party. Want to visit this website? Is your webcam on? Has it been switched on for at least 4 hours/day on average. Do you have Meta written on your forehead as you smile? If not, forget it buddy, are not getting in. Have you installed this .exe file? No? Hit the road.

dogleash 3y ago
> People think that ad blocking is the worst we'll lose. Either people will complain that the tangible example is narrowly scoped, or people will complain that the topic is abstract nerd bullshit will no real-world meaning, it won't actually change anything, and insinuate having an opinion about it is cringe. This happens in every fucking conversation on this website about the technical details of a technical coordination (protocols, formats, platforms, interfaces, etc...). Google is the tail wagging the dog. Everyone knows it. Maybe it's time we all give up on the fantasy of technology as an enabler. Just accept that everything will be maximally locked-down and we should only see it as something to interact with when absolutely necessary. Accept that bland cable tv-esqe milquetoast culture with some playskool business collab tools bolted on is the fate of the internet. A blogger - I think The Last Psych - said that technology will be the biggest disappointment since the death of god. I think I understood his point 5 years ago. Recently though, I agree.
jareklupinski 3y ago
yea, the whole thing has strong "please drink verification can to continue" vibes

mrguyorama 3y ago

A reminder that HN is full of active google employees. They are here among us, and they are okay with implementing this.

yavgcnk 3y ago

Can someone help me understand what functionality this gives to the website makers over, say, checking your user agent and denying access for FF/safari users?

aendruk 3y ago
You can’t spoof your way out of this one.