3 ms·

Out of curiosity, is there anything stopping websites from detecting if a browser has WEI and then simply not serving the website? It would be amusing to see b

Out of curiosity, is there anything stopping websites from detecting if a browser has WEI and then simply not serving the website? It would be amusing to see browsers get pressured to not implement certain features for them to access the web, rather than the other way around. And it would be ironic for it to be a DRM feature. Is there any reason at all that websites can't do this?

trashburger 3y ago
> Out of curiosity, is there anything stopping websites from detecting if a browser has WEI and then simply not serving the website? Of course, just check for the existence of the attestation API described by the spec. > Is there any reason at all that websites can't do this? Because it would be an extremely dumb move regarding reach. Banning WEI-enabled user agents means you're banning over 80% of your traffic. This might be okay for a small blog or if the website owner is big into activism, but if you have a commercial interest you absolutely can't do this. Plus, blocking WEI-enabled user agents only hurts the user in the end; Google won't walk back on such an aggressively-pushed feature simply because some site refuses to serve Chrome users.
- friendzis 3y ago
  > Because it would be an extremely dumb move regarding reach. Unless you are a de facto monopoly. Google can mandate WEI because they are a monopoly, other monopolies can do the opposite. Sadly, it is hard to imagine a monopolic website that both is used day to day and does not meaningfully benefit from WEI. Banks, utilities, etc. are used too rarely to matter.
  - rezonant 3y ago
    I expect, if given the chance, large banks will adopt WEI just like they adopted integrity APIs on iOS and Android. And they'll put up a prompt telling you to use "a secure browser".
    - friendzis 3y ago
      You are most likely right on the expected outcome, I would bet money on that outcome too. However, I do not think banks get any tangible benefit from WEI, since banks have strong form of mandatory 2FA on every destructive step anyway.
- developer93 3y ago
  Could it be used to differentiate content? Serve a more privacy friendly schpiel to those without it and something now mainstream to those with?
1letterunixname 3y ago
Websites can do whatever they want if there's logic added to do it. I remember a few annoying personal homepages that would refuse to load using a particular browser. If you want to ban all Firefox users on Linux, you could add a middleware to your tech stack that checks for User-Agent. This is how many mobile redirection sites work. So then, by extension, if a particular company wants to mandate WEI, then that's their prerogative but I won't be a customer of theirs for long.
kiliankoe 3y ago
Not that it makes any kind of difference for a tiny personal homepage, but I recently added just that on mine: https://github.com/kiliankoe/kilian.io/blob/master/index.html#L38 https://github.com/kiliankoe/kilian.io/blob/master/index.htm...
1MachineElf 3y ago
For US government websites, there could be a legal argument that it unjustly limits access to government services. Would be interesting to see how that plays out in court.

trashburger 3y ago

> Out of curiosity, is there anything stopping websites from detecting if a browser has WEI and then simply not serving the website? Of course, just check for the existence of the attestation API described by the spec. > Is there any reason at all that websites can't do this? Because it would be an extremely dumb move regarding reach. Banning WEI-enabled user agents means you're banning over 80% of your traffic. This might be okay for a small blog or if the website owner is big into activism, but if you have a commercial interest you absolutely can't do this. Plus, blocking WEI-enabled user agents only hurts the user in the end; Google won't walk back on such an aggressively-pushed feature simply because some site refuses to serve Chrome users.

friendzis 3y ago
> Because it would be an extremely dumb move regarding reach. Unless you are a de facto monopoly. Google can mandate WEI because they are a monopoly, other monopolies can do the opposite. Sadly, it is hard to imagine a monopolic website that both is used day to day and does not meaningfully benefit from WEI. Banks, utilities, etc. are used too rarely to matter.
- rezonant 3y ago
  I expect, if given the chance, large banks will adopt WEI just like they adopted integrity APIs on iOS and Android. And they'll put up a prompt telling you to use "a secure browser".
  - friendzis 3y ago
    You are most likely right on the expected outcome, I would bet money on that outcome too. However, I do not think banks get any tangible benefit from WEI, since banks have strong form of mandatory 2FA on every destructive step anyway.
developer93 3y ago
Could it be used to differentiate content? Serve a more privacy friendly schpiel to those without it and something now mainstream to those with?

1letterunixname 3y ago

Websites can do whatever they want if there's logic added to do it. I remember a few annoying personal homepages that would refuse to load using a particular browser. If you want to ban all Firefox users on Linux, you could add a middleware to your tech stack that checks for User-Agent. This is how many mobile redirection sites work. So then, by extension, if a particular company wants to mandate WEI, then that's their prerogative but I won't be a customer of theirs for long.

kiliankoe 3y ago

Not that it makes any kind of difference for a tiny personal homepage, but I recently added just that on mine: https://github.com/kiliankoe/kilian.io/blob/master/index.html#L38 https://github.com/kiliankoe/kilian.io/blob/master/index.htm...

1MachineElf 3y ago

For US government websites, there could be a legal argument that it unjustly limits access to government services. Would be interesting to see how that plays out in court.