4 ms·

Though, of course, as with DRM, if it becomes standard for let's say, all payment sites to require it enabled, your choice becomes "stop using the internet" or

Though, of course, as with DRM, if it becomes standard for let's say, all payment sites to require it enabled, your choice becomes "stop using the internet" or switch browsers

nottheengineer 3y ago
There's a third option: Just stop paying for stuff that uses this.
- klardotsh 3y ago
  Which works until (1) your job depends on it, or (2) your bank/credit union depends on it. I have to use Chromium for Slack Huddles for example, since evidently Slack Huddles "don't support" Firefox on Linux (it's WebRTC, wtf?). I don't really get an opt out of using Chromium for those couple occasions a week, because work. Now imagine that, but with GoogleDRM.
  - wetpaws 3y ago
    [dead]
  - judge2020 3y ago
    1 makes sense, no? assuming your job has certain security policies in place to ensure compliance with laws and regulations, requiring some level of attestation + MDM to ensure this compliance.
    - klardotsh 3y ago
      Well, I was thinking more of the "your work requires you to use some SaaS shit that transitively requires this attestation, whether it's legally required or not" angle. Like if, I don't know, let's say your time tracking software or something started depending on WEI.
  - willow8349 3y ago
    [dead]
  - analognoise 3y ago
    My bank and job will both send me paper in the mail instead of this horse shit. It's still an option and it looks increasingly like a good one. Make them print everything out, for the rest of time.
- wodenokoto 3y ago
  And do what? Que up at the only bank branch that is manned within 100 miles to pay your bills?
judge2020 3y ago
That also applies to Javascript, or being forced to use some form of an up-to-date browser. What is different with WEI? I didn't see many people debating the actual text of the WEI explainer[0] on the HN posts about WEI, and that's probably because they were links to articles about WEI. The HN post for the explainer with the most upvotes only has 89[1], likely because most of HN treats the upvote as "I agree/like this" instead of "boost this topic for discussion". 0: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/... 1: https://news.ycombinator.com/item?id=36785516 https://news.ycombinator.com/item?id=36785516
- rolph 3y ago
  whenever something is devised [e.g.upvotes,javascript,thumbtacks] there are those who use it for the intended purpose, and those who find as many usefull purposes for it as possible.
- userbinator 3y ago
  WEI is cryptographic. All the previous restrictions have had some form of workaround, but without the keys, you're not going to get past remote attestation. Governments are scared that people will use encryption against them. Now we should be scared that companies are using encryption against us. I'm not in favour of banning encryption either, but the situation is more subtle. Encryption is a weapon, and not surprisingly that's why it was classified as such and strongly controlled only a few decades ago, so I don't expect there to be an easy way to solve this ...just like the debate around 2nd Amendment.
  - EMIRELADERO 3y ago
    There is a legislatively easy way to solve this. Make "people who have full control over all aspects of their devices" a protected class. Make it illegal to refuse service to those people. Getting there is a whole different level of difficult, of course.
  - LexiMax 3y ago
    > All the previous restrictions have had some form of workaround, but without the keys, you're not going to get past remote attestation. What's stopping other browsers from piggybacking off of Chrome's keys?
dleeftink 3y ago
I wonder if payment sites and similar services want to exclude a large swathe of customers on older devices or risk excluding those that cannot be verified due to other technical limitations (e.g. device configurations WEI isn't optimised for).
- judge2020 3y ago
  A large number of banks already have jailbreak / root detection and will refuse to function if it detects such (usually there are bypass tools available).
wpm 3y ago
Or, like lots of other DRM, wait until someone figures out a workaround.
- Dah00n 3y ago
  We have a system like it on phones already. Circumventing it to use a bank app while having a rooted phone is a pain in the ass and oftentimes impossible. Almost all users would not know how to even do this if it was required to use your browser. That's close to being the same as no workaround.
ssss11 3y ago
Yes! There are so many use cases where a false alternate option is given as part of reasoning why the given solution is ok, often the only option is accept this or stop using it. This is why users don’t complain about e.g. privacy tracking. It’s not that they like being tracked, it’s that you consent or don’t use the product.
deleted 3y ago
[deleted]

Though, of course, as with DRM, if it becomes standard for let's say, all payment sites to require it enabled, your choice becomes "stop using the internet" or switch browsers

nottheengineer 3y ago

There's a third option: Just stop paying for stuff that uses this.

klardotsh 3y ago
Which works until (1) your job depends on it, or (2) your bank/credit union depends on it. I have to use Chromium for Slack Huddles for example, since evidently Slack Huddles "don't support" Firefox on Linux (it's WebRTC, wtf?). I don't really get an opt out of using Chromium for those couple occasions a week, because work. Now imagine that, but with GoogleDRM.
- wetpaws 3y ago
  [dead]
- judge2020 3y ago
  1 makes sense, no? assuming your job has certain security policies in place to ensure compliance with laws and regulations, requiring some level of attestation + MDM to ensure this compliance.
  - klardotsh 3y ago
    Well, I was thinking more of the "your work requires you to use some SaaS shit that transitively requires this attestation, whether it's legally required or not" angle. Like if, I don't know, let's say your time tracking software or something started depending on WEI.
- willow8349 3y ago
  [dead]
- analognoise 3y ago
  My bank and job will both send me paper in the mail instead of this horse shit. It's still an option and it looks increasingly like a good one. Make them print everything out, for the rest of time.
wodenokoto 3y ago
And do what? Que up at the only bank branch that is manned within 100 miles to pay your bills?

judge2020 3y ago

That also applies to Javascript, or being forced to use some form of an up-to-date browser. What is different with WEI? I didn't see many people debating the actual text of the WEI explainer[0] on the HN posts about WEI, and that's probably because they were links to articles about WEI. The HN post for the explainer with the most upvotes only has 89[1], likely because most of HN treats the upvote as "I agree/like this" instead of "boost this topic for discussion". 0: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/... 1: https://news.ycombinator.com/item?id=36785516 https://news.ycombinator.com/item?id=36785516

rolph 3y ago
whenever something is devised [e.g.upvotes,javascript,thumbtacks] there are those who use it for the intended purpose, and those who find as many usefull purposes for it as possible.
userbinator 3y ago
WEI is cryptographic. All the previous restrictions have had some form of workaround, but without the keys, you're not going to get past remote attestation. Governments are scared that people will use encryption against them. Now we should be scared that companies are using encryption against us. I'm not in favour of banning encryption either, but the situation is more subtle. Encryption is a weapon, and not surprisingly that's why it was classified as such and strongly controlled only a few decades ago, so I don't expect there to be an easy way to solve this ...just like the debate around 2nd Amendment.
- EMIRELADERO 3y ago
  There is a legislatively easy way to solve this. Make "people who have full control over all aspects of their devices" a protected class. Make it illegal to refuse service to those people. Getting there is a whole different level of difficult, of course.
- LexiMax 3y ago
  > All the previous restrictions have had some form of workaround, but without the keys, you're not going to get past remote attestation. What's stopping other browsers from piggybacking off of Chrome's keys?

dleeftink 3y ago

I wonder if payment sites and similar services want to exclude a large swathe of customers on older devices or risk excluding those that cannot be verified due to other technical limitations (e.g. device configurations WEI isn't optimised for).

judge2020 3y ago
A large number of banks already have jailbreak / root detection and will refuse to function if it detects such (usually there are bypass tools available).

wpm 3y ago

Or, like lots of other DRM, wait until someone figures out a workaround.

Dah00n 3y ago
We have a system like it on phones already. Circumventing it to use a bank app while having a rooted phone is a pain in the ass and oftentimes impossible. Almost all users would not know how to even do this if it was required to use your browser. That's close to being the same as no workaround.

ssss11 3y ago

Yes! There are so many use cases where a false alternate option is given as part of reasoning why the given solution is ok, often the only option is accept this or stop using it. This is why users don’t complain about e.g. privacy tracking. It’s not that they like being tracked, it’s that you consent or don’t use the product.

deleted 3y ago

[deleted]