4 ms·

If the window even applies here, it expanded the moment Google initiated all of this publicly. We're in it now, and fully understanding the issue and the probl

If the window even applies here, it expanded the moment Google initiated all of this publicly. We're in it now, and fully understanding the issue and the problems it purports to solve is incredibly important. Dialogue is all we have, and to even build a solid argument against WEI, understanding the details matters.

JoshTriplett 3y ago
It's worth understanding the problem it purports to solve in order to properly dismiss it. WEI positions itself in a way that sounds ambiguously like it might ever serve the user's purposes, and a clear framing of the problem statement would make it more obvious that it does not serve the user at all. For instance, one of the framings of WEI is that it gives advertisers a way to verify the client so they don't "have" to do fingerprinting. Except WEI does nothing to take away fingerprinting, so advertisers will then have fingerprinting and WEI. (Even if it did simultaneously take away fingerprinting it would still not be OK, but the current framing is not even offering the user benefit it claims to offer.)
- charcircuit 3y ago
  Before taking away fingerprinting there would need to be a sunset period to have everyone migrate over to the new API. Ripping it out before new APIs are available or doing it at the same time is irresponsible.
  - ImPostingOnHN 3y ago
    I'm not sure how that addresses the point you're responding to: regardless of the excuse, WEI with fingerprinting is bad, and WEI without fingerprinting is also bad, and fingerprinting without WEI is also bad doing bad things (for example, any of the 3 above options) is more irresponsible than implementing bad things poorly
    - flangola7 3y ago
      So how do you intend to prevent fraud and abuse? You need signals of some kind to know whether a visitor is likely to be malicious or not.
      - wmf 3y ago
        You don't have to worry about ad fraud if advertising goes away.
      - daurentius523 3y ago
        Let me ask you instead: "how you intend to prevent matrimonial fraud?" … You can not. Because that is not how world works - crime did happen, happens, and will happen. You can stop attempts or fight it by education or by arresting criminals but never eliminate or prevent it. "You need signals of some kind to know whether a visitor is likely to be malicious or not." Innkeeper in 13 century: "I need signals of some kind to know whether a visitor is likely to be malicious or not before he enters." - See how ridiculous it is? You are being being wrong here - you don't have 'visitor' but 'client' and as far as I'm concerned you do not spy on every client to "know" if he "is likely to be malicious or not". You may be suspicious of client activities but that is what you can realistically do. Also define "fraud and abuse" because this can mean many things which may have many solutions.
        charcircuit 3y ago
        >Innkeeper in 13 century: "I need signals of some kind to know whether a visitor is likely to be malicious or not before he enters." - See how ridiculous it is? That innkeeper would have used the signal of how the visitor looks. If a visitor was being malicious and got kicked out, that person could not just come right back in as the inkeeper would be able to tell that he was the same person as before. Also your metaphor is not great because WEI can only happen after the first page load since it requires the site to use javascript to use the api.
        daurentius523 3y ago
  - surajrmal 3y ago
    Agreed. If WEI means browsers can more aggressively restrict fingerprinting in all for it.
    - fruitreunion1 3y ago
      Is there really much browsers can do to actually effectively restrict fingerprinting without going all out like Tor Browser? WEI may disincentivize websites to not use fingerprinting, but if they really wanted to, they could use it for de-anonymization purposes.
    - haswell 3y ago
      I don’t think there is any indication that this would be the automatic outcome.
    - plorkyeran 3y ago
      There is zero connection between WEI existing and browsers being able to restrict fingerprinting.
      - surajrmal 3y ago
        There are various stakeholder interests which need to be balanced. As much as people like to invent nefarious motives, in reality there likely important players on the internet who have valid use cases for fingerprinting which cannot be broken carelessly. Efforts like WEI try to address their needs via alternative means. I agree that it's bot a guarantee, but it certainly seems like a possibility.
        ImPostingOnHN 3y ago
        "There are various stakeholder interests which need to be balanced," said the giving-alcohol-and-cigarettes-to-children lobby, "As much as people like to invent nefarious motives, in reality there are important players manufacturing alcohol and cigarettes who have valid use cases for children consuming them which cannot be broken carelessly."
  - toyg 3y ago
    You can't "take away" fingerprinting, because it isn't a single API or even a single set of APIs. Fingerprinting is a set of techniques; you can nullify some of them, but there is nothing stopping companies from inventing new ones. Despite what Google say, fingerprinting will never go away - any new feature in that space will just be in addition to existing and future fingerprinting techniques.
the_lego 3y ago
But the details aren't the issue. It's the entire idea of remote attestation that is repulsive and user-hostile. Otherwise I agree that examining the details doesn't move the Overton window - the broad idea already did that.
- therein 3y ago
  Details aren't the issue and that's exactly my point. There is no reason to discuss on average how many lightning rods we should place on each street and the necessary budget allocations and compromises that would need to be made and how this whole undertaking would be facilitated. We have been doing just fine without these lightning rods on every street proposal Google made. We knew we could have it, we don't have it because we don't want it.
wudangmonk 3y ago
The problems it aims to solve seems like an issue for google or those that care if their ad is viewed by a human or not. Can someone give a counter argument of how this might benefit the users themselves?. Chrome on android is completely unusable due to no adblocker, is this what WEI will do everywhere?
- fruitreunion1 3y ago
  >Can someone give a counter argument of how this might benefit the users themselves? Remote attestation might reduce the amount of cheaters in games and fraud in banks if implemented properly. So, through potential indirect means. I don't think any of this is worth the loss of user freedom and functionality, though. So I will vehemently oppose WEI and similar to be used outside of internal facilities.
  - therein 3y ago
    Anti-cheats are already remote attestation in theory for online games and they are unable to protect the process perfectly. They are unable to detect alterations to the process memory and be correct in their attestation at all times. And cheating isn't a significant problem in in-browser games, it's not like anyone modified the browser source to create cheats for in-browser games. And for competitive online games, we have a great imperfect attempt at showing what remote attestation would look like. Anti cheat in games. We have AAA titles that work flawlessly under Proton but you can't play them on Linux because anti-cheat needs to do DKOM on your Windows kernel before it lets you play. I agree with the rest of your post though.

JoshTriplett 3y ago

It's worth understanding the problem it purports to solve in order to properly dismiss it. WEI positions itself in a way that sounds ambiguously like it might ever serve the user's purposes, and a clear framing of the problem statement would make it more obvious that it does not serve the user at all. For instance, one of the framings of WEI is that it gives advertisers a way to verify the client so they don't "have" to do fingerprinting. Except WEI does nothing to take away fingerprinting, so advertisers will then have fingerprinting and WEI. (Even if it did simultaneously take away fingerprinting it would still not be OK, but the current framing is not even offering the user benefit it claims to offer.)

charcircuit 3y ago
Before taking away fingerprinting there would need to be a sunset period to have everyone migrate over to the new API. Ripping it out before new APIs are available or doing it at the same time is irresponsible.
- ImPostingOnHN 3y ago
  I'm not sure how that addresses the point you're responding to: regardless of the excuse, WEI with fingerprinting is bad, and WEI without fingerprinting is also bad, and fingerprinting without WEI is also bad doing bad things (for example, any of the 3 above options) is more irresponsible than implementing bad things poorly
  - flangola7 3y ago
    So how do you intend to prevent fraud and abuse? You need signals of some kind to know whether a visitor is likely to be malicious or not.
    - wmf 3y ago
      You don't have to worry about ad fraud if advertising goes away.
    - daurentius523 3y ago
      Let me ask you instead: "how you intend to prevent matrimonial fraud?" … You can not. Because that is not how world works - crime did happen, happens, and will happen. You can stop attempts or fight it by education or by arresting criminals but never eliminate or prevent it. "You need signals of some kind to know whether a visitor is likely to be malicious or not." Innkeeper in 13 century: "I need signals of some kind to know whether a visitor is likely to be malicious or not before he enters." - See how ridiculous it is? You are being being wrong here - you don't have 'visitor' but 'client' and as far as I'm concerned you do not spy on every client to "know" if he "is likely to be malicious or not". You may be suspicious of client activities but that is what you can realistically do. Also define "fraud and abuse" because this can mean many things which may have many solutions.
      - charcircuit 3y ago
        >Innkeeper in 13 century: "I need signals of some kind to know whether a visitor is likely to be malicious or not before he enters." - See how ridiculous it is? That innkeeper would have used the signal of how the visitor looks. If a visitor was being malicious and got kicked out, that person could not just come right back in as the inkeeper would be able to tell that he was the same person as before. Also your metaphor is not great because WEI can only happen after the first page load since it requires the site to use javascript to use the api.
        daurentius523 3y ago
- surajrmal 3y ago
  Agreed. If WEI means browsers can more aggressively restrict fingerprinting in all for it.
  - fruitreunion1 3y ago
    Is there really much browsers can do to actually effectively restrict fingerprinting without going all out like Tor Browser? WEI may disincentivize websites to not use fingerprinting, but if they really wanted to, they could use it for de-anonymization purposes.
  - haswell 3y ago
    I don’t think there is any indication that this would be the automatic outcome.
  - plorkyeran 3y ago
    There is zero connection between WEI existing and browsers being able to restrict fingerprinting.
    - surajrmal 3y ago
      There are various stakeholder interests which need to be balanced. As much as people like to invent nefarious motives, in reality there likely important players on the internet who have valid use cases for fingerprinting which cannot be broken carelessly. Efforts like WEI try to address their needs via alternative means. I agree that it's bot a guarantee, but it certainly seems like a possibility.
      - ImPostingOnHN 3y ago
        "There are various stakeholder interests which need to be balanced," said the giving-alcohol-and-cigarettes-to-children lobby, "As much as people like to invent nefarious motives, in reality there are important players manufacturing alcohol and cigarettes who have valid use cases for children consuming them which cannot be broken carelessly."
- toyg 3y ago
  You can't "take away" fingerprinting, because it isn't a single API or even a single set of APIs. Fingerprinting is a set of techniques; you can nullify some of them, but there is nothing stopping companies from inventing new ones. Despite what Google say, fingerprinting will never go away - any new feature in that space will just be in addition to existing and future fingerprinting techniques.

the_lego 3y ago

But the details aren't the issue. It's the entire idea of remote attestation that is repulsive and user-hostile. Otherwise I agree that examining the details doesn't move the Overton window - the broad idea already did that.

therein 3y ago
Details aren't the issue and that's exactly my point. There is no reason to discuss on average how many lightning rods we should place on each street and the necessary budget allocations and compromises that would need to be made and how this whole undertaking would be facilitated. We have been doing just fine without these lightning rods on every street proposal Google made. We knew we could have it, we don't have it because we don't want it.

wudangmonk 3y ago

The problems it aims to solve seems like an issue for google or those that care if their ad is viewed by a human or not. Can someone give a counter argument of how this might benefit the users themselves?. Chrome on android is completely unusable due to no adblocker, is this what WEI will do everywhere?

fruitreunion1 3y ago
>Can someone give a counter argument of how this might benefit the users themselves? Remote attestation might reduce the amount of cheaters in games and fraud in banks if implemented properly. So, through potential indirect means. I don't think any of this is worth the loss of user freedom and functionality, though. So I will vehemently oppose WEI and similar to be used outside of internal facilities.
- therein 3y ago
  Anti-cheats are already remote attestation in theory for online games and they are unable to protect the process perfectly. They are unable to detect alterations to the process memory and be correct in their attestation at all times. And cheating isn't a significant problem in in-browser games, it's not like anyone modified the browser source to create cheats for in-browser games. And for competitive online games, we have a great imperfect attempt at showing what remote attestation would look like. Anti cheat in games. We have AAA titles that work flawlessly under Proton but you can't play them on Linux because anti-cheat needs to do DKOM on your Windows kernel before it lets you play. I agree with the rest of your post though.