4 ms·
By the way, a very similar API has apparently been implemented in Safari since 2022. Seems like better marketing does wonders, as I haven't seen any discussion
by shiomiru 3y ago
By the way, a very similar API has apparently been implemented in Safari
since 2022. Seems like better marketing does wonders, as I haven't seen
any discussion of this.
https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/ https://blog.cloudflare.com/eliminating-captchas-on-iphones-...
Some interesting bits:
> [...] We don’t actually need or want the underlying data that’s being
collected for this process, we just want to verify if a visitor is faking
their device or user agent. [...]
> [...] In the example above, a visitor opens the Safari browser on their
iPhone and tries to visit example.com.
> * Since Example uses Cloudflare to host their Origin, Cloudflare will ask
the browser for a token.
> * Safari supports PATs, so it will make an API call to Apple’s Attester,
asking them to attest.
> * The Apple attester will check various device components, confirm they
are valid, and then make an API call to the Cloudflare Issuer (since Cloudflare
acting as an Origin chooses to use the Cloudflare Issuer).
> * The Cloudflare Issuer generates a token, sends it to the browser, which
in turn sends it to the origin.
> * Cloudflare then receives the token, and uses it to determine that we
don’t need to show this user a CAPTCHA. [...]
Sounds an awful lot like WAI to me, but at least it's called a "Privacy Access
Tokens" so it surely must be good...?
EDIT: turns out there was an HN thread about this a few days ago, I just missed it: https://news.ycombinator.com/item?id=36862494 https://news.ycombinator.com/item?id=36862494
- wmf 3y agoI think the difference is that PAT allows ad blockers but WEI won't.
- schoen 3y agoDoes the PAT implementation still require that the page content is being rendered live to a human user, or not exported or something? (I know web APIs can't directly prevent those things, but they might be able to let a site determine whether a user is doing something to prevent CSS or Javascript tricks from preventing them.)
- gigel82 3y agoPAT and WEI can allow and disallow whatever the hell they want, there's nothing preventing WEI from allowing ad blockers just like there's nothing preventing PATs from disallowing them. They are exactly the same technology (remote attestation, entirely outside of the user's control).
- null0pointer 3y ago> we just want to verify if a visitor is faking their device or user agent What does it mean to fake a device or user agent? Their intent is probably devices and user agents who say they’re one thing but are actually another. But browsers have been lying about who they are for decades. And what’s the difference between a fake device/UA and an unusual device/UA? Probably none, as far as they’re concerned.
- CharlesW 3y ago> Sounds an awful lot like WAI to me, but at least it's called a "Privacy Access Tokens" so it surely must be good...? Google's PR strategy is to say "no need to worry, it's just like this Apple thing". But as Google themselves note in their explainer¹, they're quite different, and Google considers PAT insufficient for the kind of enforcement they intend to do. For example, PAT is ultimately just "not a bot" attestation and so doesn't involve the exchange of device and browser environment data. In contrast, WEI needs that data to enable the kind of "DRM for the web" use cases we're reading about. https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#privacy-pass--private-access-tokens https://github.com/RupertBenWiser/Web-Environment-Integrity/...
- uzername 3y agoI read about this last year in the original Cloudflare post. Cloudflare is a darling but I thought this one was dangerous for the web too.