4 ms·

That's a good point, what do you use the Internet for anyways? News, banking, governmental rituals, maybe searching for a book or a topic to learn. Sometimes a

That's a good point, what do you use the Internet for anyways? News, banking, governmental rituals, maybe searching for a book or a topic to learn. Sometimes a work meeting or an email or wasting time watching YouTube or listening to music. These all don't need drm or whatever. Some don't even need internet, you can just download files like your grandfather did 10 years ago

shadowgovt 3y ago
> banking A commonly repeated concern is that if WEI is implemented, banks will leap on it and it will become infeasible to do online transactions at most banks without either using a WEI-blessed software / hardware configuration or the bank's app in a commercial app store.
- deleted 3y ago
  [deleted]
- pipo234 3y ago
  Banks don't need the "anonymous" part of the WEI, just the "authentic" chain of trust as in am I really identifying a life person rather than a robot impersonation. Banks are lazy, they shouldn't need to rely on infrastructure of commercial app stores, blessed devices since they've already proven they could develop it themselves (chip cards, dongles, time-based one time codes, etc.). WEI is mainly aimed at suppressing the unauthenticated noise, when reading a signal from GET requests (ie tracking) that was never meant to convey any information beyond what is asked for, in the first place.
  - shadowgovt 3y ago
    > WEI is mainly aimed at suppressing the unauthenticated noise I'm not really seeing how we're reaching that conclusion. Suppressing GET request noise isn't any of the use cases described at https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/...
    - pipo234 3y ago
      Some examples of scenarios where users depend on client trust include: * Users like visiting websites that are expensive to create and maintain, but they often want or need to do it without paying directly. These websites fund themselves with ads, but the advertisers can only afford to pay for humans to see the ads, rather than robots. This creates a need for human users to prove to websites that they're human, sometimes through tasks like challenges or logins. Ie.: To make sure that ads are only delivered to actual living humans bothering them with a login, payment or CAPTCHA and heavily invest add-blocker detection arms race, they want the web client to attest that the genuine user actually saw the ad.
- lamontcg 3y ago
  I mean okay? Most banking security these days is comically bad compared to just the kind of 2FA that GH has. I'd like my broker to have better authentication options and if it securely identifies that my hardware really is my hardware that is probably an actual improvement that I'd want. The rest of the time I can use a non-WEI browser and the sites that lock me out would probably be doing me a favor.
- tim333 3y ago
  Already my two main banks, although having website, require me to authenticate via their app. I guess it's kind of understandable with real stealable money involved.

shadowgovt 3y ago

> banking A commonly repeated concern is that if WEI is implemented, banks will leap on it and it will become infeasible to do online transactions at most banks without either using a WEI-blessed software / hardware configuration or the bank's app in a commercial app store.

deleted 3y ago
[deleted]
pipo234 3y ago
Banks don't need the "anonymous" part of the WEI, just the "authentic" chain of trust as in am I really identifying a life person rather than a robot impersonation. Banks are lazy, they shouldn't need to rely on infrastructure of commercial app stores, blessed devices since they've already proven they could develop it themselves (chip cards, dongles, time-based one time codes, etc.). WEI is mainly aimed at suppressing the unauthenticated noise, when reading a signal from GET requests (ie tracking) that was never meant to convey any information beyond what is asked for, in the first place.
- shadowgovt 3y ago
  > WEI is mainly aimed at suppressing the unauthenticated noise I'm not really seeing how we're reaching that conclusion. Suppressing GET request noise isn't any of the use cases described at https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/...
  - pipo234 3y ago
    Some examples of scenarios where users depend on client trust include: * Users like visiting websites that are expensive to create and maintain, but they often want or need to do it without paying directly. These websites fund themselves with ads, but the advertisers can only afford to pay for humans to see the ads, rather than robots. This creates a need for human users to prove to websites that they're human, sometimes through tasks like challenges or logins. Ie.: To make sure that ads are only delivered to actual living humans bothering them with a login, payment or CAPTCHA and heavily invest add-blocker detection arms race, they want the web client to attest that the genuine user actually saw the ad.
lamontcg 3y ago
I mean okay? Most banking security these days is comically bad compared to just the kind of 2FA that GH has. I'd like my broker to have better authentication options and if it securely identifies that my hardware really is my hardware that is probably an actual improvement that I'd want. The rest of the time I can use a non-WEI browser and the sites that lock me out would probably be doing me a favor.
tim333 3y ago
Already my two main banks, although having website, require me to authenticate via their app. I guess it's kind of understandable with real stealable money involved.