4 ms·

> (…) we'll see what happens once Chrome becomes the only browser that you can use to log in to your bank. I guess the EU will sue Google for anti-competitive

by irdc 3y ago

> (…) we'll see what happens once Chrome becomes the only browser that you can use to log in to your bank. I guess the EU will sue Google for anti-competitive behaviour.

msla 3y ago
OK, we'll have twenty browsers, all different skins on Chromium and all controlled by Google, and see if the EU legislators can understand the concept, and, if they can, whether the banks will allow them to continue to understand said concept.
Dah00n 3y ago
I doubt they will since it is the bank using a feature, not Google that force them.
ggm 3y ago
If the reason "only chrome" works is that the others refuse to ship signed binaries, I think google is going to be in court with a reasonable case. They make the signing barrier low. It's as low as store entry. The refusal to sign code isn't an "only google can do it" thing its "only signed browsers can do it, but there can be many signed browsers" of course the case is more complex: the reasons they won't sign will be material.
- irdc 3y ago
  Yes, but each and every website needs to explicitly allow each and every browser key. Which increases barriers to entry for new browser vendors and makes Open Source / Free Software browsers nigh impossible. The EU isn’t stupid and is kinda fond of Open Source / Free Software (because it serves as a way to make the EU economy and society less dependent on foreign tech giants). Don’t worry, Brussels will save ya. :)
  - mike_hearn 3y ago
    > Yes, but each and every website needs to explicitly allow each and every browser key You mean like how browsers need to explicitly allow each and every root CA key? If that's the basis on which a legal case is built then it'd fail even in the ECJ, because all that's required is set up an equivalent of the root store programmes and it's solved. The way this would actually work is something like: websites just "apt-get install browser-keys", add a bit of JS to their HTML and now their nginx or apache or AWS LB just adds an extra header to proxied HTTP requests saying "X-User-Agent-Accuracy: HIGH" and "X-Extensions-Signing-Keys: <...>". Then every so often you do an apt-get update and the latest round of browser/extension signing keys get added. So there's no reason why obscure browsers can't take part in this scheme, just like how obscure CAs can take part in the web PKI. Nor does it make open source browsers impossible. Just like how there are open source CA software stacks, so too can you compile your own browser, publish the code, sign binaries of it and get those signing keys into whatever equivalent of the root store programme would appear. Availability of source code is irrelevant. Establishing trust in your operation is the hard part but you have to do that anyway if you want to get users, just like how you can set up your own CA using a simple GUI on macOS but getting people to actually trust it is a different kettle of fish. Not that there's much chance of any of this actually happening outside of mobile anyway. It's all quite theoretical on desktop. Windows is too far behind on remote attestation tech and the general OS security stance for it to happen anytime soon, especially with so many users not upgrading to Windows 11. But if people want to argue against remote attestation, you'll have to learn how it actually works. Otherwise you're just going to make bad arguments and your opponents will beat you.
    - irdc 3y ago
      > The way this would actually work is something like: websites just "apt-get install browser-keys" (…) Then every so often you do an apt-get update and the latest round of browser/extension signing keys get added. Do you remember when MSIE was the dominant browser and websites started to sniff User-Agent headers to dissuade or sometimes even block visitors using other browsers? Because I do. This will be even worse.
p-e-w 3y ago
Sure. And impose a fine of 3-5 billion Euros. Which Google will fight in the courts for a few years, then eventually pay. Without actually changing their practices. For which they will again be fined a few years later. I wouldn't be surprised if the people who are ultimately behind WEI are already anticipating those fines, and have concluded that they will be well worth the gain in control that this feature gives to Google.
- irdc 3y ago
  I don’t expect the EU to allow Google to treat fines as just a part of doing business. If a fine doesn’t lead in a change of behaviour, more rigorous measures will probably be implemented. EU lawmakers are itching for a reason to split up big tech giants; Google may very well give them one. And representing a sizable part of the global economy, the EU is something you ignore at your peril.
  - p-e-w 3y ago
    > I don’t expect the EU to allow Google to treat fines as just a part of doing business. Why would you not expect that? That's exactly how EU fines have worked for the past 10 years.
usr1106 3y ago
And Google will pay some small percentage of their billions of profit after many years of legal proceedings. Google is being sued in various EU countries and by commission more or less continuously. It hasn't hindered them from becoming a 99% monopoly for Android phone apps. (Yes, the case is slightly different because there is still Apple. But as a consumer I can not say today I use Google and tomorrow I prefer to install an app from Apple, so once you made a decision you lost any market competition for years ahead.)
bawolff 3y ago
I mean, you have to actually be anticompetitive for them to sue. Its not an antipopularity contest. I doubt implementing an open standard (no matter how much i dont like it) meets the mark for anticompetitive behaviour.
- irdc 3y ago
  It’s anticompetitive for the very reason places like HN have been up in arms about it (and rightly so IMO): it serves to limit which browser software a user may use to access a site. The fact that it’s an open standard is immaterial.
  - bawolff 3y ago
    If it serves to limit the browser software to chrome, than sure. But if its an open ecosystem than i think anticompetitiveness is a hard argument to make. Making a popular product with choices that we don't like is not anti-competitive.

by irdc 3y ago

> (…) we'll see what happens once Chrome becomes the only browser that you can use to log in to your bank. I guess the EU will sue Google for anti-competitive behaviour.

msla 3y ago

OK, we'll have twenty browsers, all different skins on Chromium and all controlled by Google, and see if the EU legislators can understand the concept, and, if they can, whether the banks will allow them to continue to understand said concept.

Dah00n 3y ago

I doubt they will since it is the bank using a feature, not Google that force them.

ggm 3y ago

If the reason "only chrome" works is that the others refuse to ship signed binaries, I think google is going to be in court with a reasonable case. They make the signing barrier low. It's as low as store entry. The refusal to sign code isn't an "only google can do it" thing its "only signed browsers can do it, but there can be many signed browsers" of course the case is more complex: the reasons they won't sign will be material.

irdc 3y ago
Yes, but each and every website needs to explicitly allow each and every browser key. Which increases barriers to entry for new browser vendors and makes Open Source / Free Software browsers nigh impossible. The EU isn’t stupid and is kinda fond of Open Source / Free Software (because it serves as a way to make the EU economy and society less dependent on foreign tech giants). Don’t worry, Brussels will save ya. :)
- mike_hearn 3y ago
  > Yes, but each and every website needs to explicitly allow each and every browser key You mean like how browsers need to explicitly allow each and every root CA key? If that's the basis on which a legal case is built then it'd fail even in the ECJ, because all that's required is set up an equivalent of the root store programmes and it's solved. The way this would actually work is something like: websites just "apt-get install browser-keys", add a bit of JS to their HTML and now their nginx or apache or AWS LB just adds an extra header to proxied HTTP requests saying "X-User-Agent-Accuracy: HIGH" and "X-Extensions-Signing-Keys: <...>". Then every so often you do an apt-get update and the latest round of browser/extension signing keys get added. So there's no reason why obscure browsers can't take part in this scheme, just like how obscure CAs can take part in the web PKI. Nor does it make open source browsers impossible. Just like how there are open source CA software stacks, so too can you compile your own browser, publish the code, sign binaries of it and get those signing keys into whatever equivalent of the root store programme would appear. Availability of source code is irrelevant. Establishing trust in your operation is the hard part but you have to do that anyway if you want to get users, just like how you can set up your own CA using a simple GUI on macOS but getting people to actually trust it is a different kettle of fish. Not that there's much chance of any of this actually happening outside of mobile anyway. It's all quite theoretical on desktop. Windows is too far behind on remote attestation tech and the general OS security stance for it to happen anytime soon, especially with so many users not upgrading to Windows 11. But if people want to argue against remote attestation, you'll have to learn how it actually works. Otherwise you're just going to make bad arguments and your opponents will beat you.
  - irdc 3y ago
    > The way this would actually work is something like: websites just "apt-get install browser-keys" (…) Then every so often you do an apt-get update and the latest round of browser/extension signing keys get added. Do you remember when MSIE was the dominant browser and websites started to sniff User-Agent headers to dissuade or sometimes even block visitors using other browsers? Because I do. This will be even worse.

p-e-w 3y ago

Sure. And impose a fine of 3-5 billion Euros. Which Google will fight in the courts for a few years, then eventually pay. Without actually changing their practices. For which they will again be fined a few years later. I wouldn't be surprised if the people who are ultimately behind WEI are already anticipating those fines, and have concluded that they will be well worth the gain in control that this feature gives to Google.

irdc 3y ago
I don’t expect the EU to allow Google to treat fines as just a part of doing business. If a fine doesn’t lead in a change of behaviour, more rigorous measures will probably be implemented. EU lawmakers are itching for a reason to split up big tech giants; Google may very well give them one. And representing a sizable part of the global economy, the EU is something you ignore at your peril.
- p-e-w 3y ago
  > I don’t expect the EU to allow Google to treat fines as just a part of doing business. Why would you not expect that? That's exactly how EU fines have worked for the past 10 years.

usr1106 3y ago

And Google will pay some small percentage of their billions of profit after many years of legal proceedings. Google is being sued in various EU countries and by commission more or less continuously. It hasn't hindered them from becoming a 99% monopoly for Android phone apps. (Yes, the case is slightly different because there is still Apple. But as a consumer I can not say today I use Google and tomorrow I prefer to install an app from Apple, so once you made a decision you lost any market competition for years ahead.)

bawolff 3y ago

I mean, you have to actually be anticompetitive for them to sue. Its not an antipopularity contest. I doubt implementing an open standard (no matter how much i dont like it) meets the mark for anticompetitive behaviour.

irdc 3y ago
It’s anticompetitive for the very reason places like HN have been up in arms about it (and rightly so IMO): it serves to limit which browser software a user may use to access a site. The fact that it’s an open standard is immaterial.
- bawolff 3y ago
  If it serves to limit the browser software to chrome, than sure. But if its an open ecosystem than i think anticompetitiveness is a hard argument to make. Making a popular product with choices that we don't like is not anti-competitive.