5 ms·

This is attributing intentions to Google when it's unclear what they're going to do. Probably even unclear to them. Not all anti-fraud measures are DRM. If "hol

This is attributing intentions to Google when it's unclear what they're going to do. Probably even unclear to them. Not all anti-fraud measures are DRM. If "holdout sets" get implemented then it can't be used as DRM, because it will randomly fail. What we know now is that they wanted to run an experiment to gather some data. Since it's in Chromium, they needed to explain it, and they explained it poorly.

ogn3rd 3y ago
It's not unclear. They "lost" 22 Billion due to ad blockers.
- midoridensha 3y ago
  That's nothing. I actually lost a trillion dollars just now. Apple is worth about $1T, and because Apple and its shareholders didn't simply gift me their entire company, I've now lost $1T. And that's just a drop in the bucket for money I've lost in the last few minutes!
devsda 3y ago
Holdout sounds like it is explicitly added to ward off any criticisms insinuating DRM. If a server is not denying access for clients with no valid attestation then what exactly are the servers gaining from implementing WEI? CAPTCHAs also reasonably prove that the user is a human and legitimate but not all captcha challenges are solveable by humans in one go. Businesses have denied access for those failures and they just repeat the challenge until the captcha is solved successfully. If the failures are less per client they can easily be treated as tradeoff against security. What's stopping websites from doing the same with WEI? They can always deny access and repeatedly request attestation until a positive reply comes. This is acceptable for those "attested" clients where the failures are random and within an upper bound. But a client without attestation can always be denied or they can be shown different limited content altogether. In both the cases the unapproved clients are at a disadvantage.
- hurutparittya 3y ago
  I 100% agree with this. But even if holdouts could magically prevent the abuse of this API there is still a massive issue. Once this standard gets wider adoption and it's time to boil the frog further literally all it takes to disable holdouts is editing a single value in the attester code. They will justify it by saying holdouts are no longer needed because 98% of clients are already compliant.
matheusmoreira 3y ago
Bullshit. Stop assuming the trillion dollar corporation is incompetent and blameless. They know exactly what they are doing. Remote attestation allows them to determine that a web page has been "tampered with". Tampering includes deleting ads and corporate spyware as well as user scripts, extensions and automation. It is obvious how Google and all other corporations stand to gain from such technology.

ogn3rd 3y ago

It's not unclear. They "lost" 22 Billion due to ad blockers.

midoridensha 3y ago
That's nothing. I actually lost a trillion dollars just now. Apple is worth about $1T, and because Apple and its shareholders didn't simply gift me their entire company, I've now lost $1T. And that's just a drop in the bucket for money I've lost in the last few minutes!

devsda 3y ago

Holdout sounds like it is explicitly added to ward off any criticisms insinuating DRM. If a server is not denying access for clients with no valid attestation then what exactly are the servers gaining from implementing WEI? CAPTCHAs also reasonably prove that the user is a human and legitimate but not all captcha challenges are solveable by humans in one go. Businesses have denied access for those failures and they just repeat the challenge until the captcha is solved successfully. If the failures are less per client they can easily be treated as tradeoff against security. What's stopping websites from doing the same with WEI? They can always deny access and repeatedly request attestation until a positive reply comes. This is acceptable for those "attested" clients where the failures are random and within an upper bound. But a client without attestation can always be denied or they can be shown different limited content altogether. In both the cases the unapproved clients are at a disadvantage.

hurutparittya 3y ago
I 100% agree with this. But even if holdouts could magically prevent the abuse of this API there is still a massive issue. Once this standard gets wider adoption and it's time to boil the frog further literally all it takes to disable holdouts is editing a single value in the attester code. They will justify it by saying holdouts are no longer needed because 98% of clients are already compliant.

matheusmoreira 3y ago

Bullshit. Stop assuming the trillion dollar corporation is incompetent and blameless. They know exactly what they are doing. Remote attestation allows them to determine that a web page has been "tampered with". Tampering includes deleting ads and corporate spyware as well as user scripts, extensions and automation. It is obvious how Google and all other corporations stand to gain from such technology.