4 ms·
> Out of curiosity, is there anything stopping websites from detecting if a browser has WEI and then simply not serving the website? Of course, just check for
by trashburger 3y ago
> Out of curiosity, is there anything stopping websites from detecting if a browser has WEI and then simply not serving the website?
Of course, just check for the existence of the attestation API described by the spec.
> Is there any reason at all that websites can't do this?
Because it would be an extremely dumb move regarding reach. Banning WEI-enabled user agents means you're banning over 80% of your traffic. This might be okay for a small blog or if the website owner is big into activism, but if you have a commercial interest you absolutely can't do this. Plus, blocking WEI-enabled user agents only hurts the user in the end; Google won't walk back on such an aggressively-pushed feature simply because some site refuses to serve Chrome users.
- friendzis 3y ago> Because it would be an extremely dumb move regarding reach. Unless you are a de facto monopoly. Google can mandate WEI because they are a monopoly, other monopolies can do the opposite. Sadly, it is hard to imagine a monopolic website that both is used day to day and does not meaningfully benefit from WEI. Banks, utilities, etc. are used too rarely to matter.
- rezonant 3y agoI expect, if given the chance, large banks will adopt WEI just like they adopted integrity APIs on iOS and Android. And they'll put up a prompt telling you to use "a secure browser".
- friendzis 3y agoYou are most likely right on the expected outcome, I would bet money on that outcome too. However, I do not think banks get any tangible benefit from WEI, since banks have strong form of mandatory 2FA on every destructive step anyway.
- developer93 3y agoCould it be used to differentiate content? Serve a more privacy friendly schpiel to those without it and something now mainstream to those with?