5 ms·

> How about you offer a reasonable opposing viewpoint Read the proposal: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md htt

• trogdolon 3y ago
  > if you for example would trust let's say Opera as the attester, Opera would need to trust windows or Linux or Android as the OS attester. But it's not the user ("you") deciding which attesters to trust - it's website operators. And they will choose to trust only attesters that meaningfully (cryptographically) verify the user's client environment, including the secure boot chain, OS, and browser. Otherwise the attestation can be spoofed, in why case why would they bother using the EnvironmentIntegrity API at all?
  • meragrin_ 3y ago
    > But it's not the user ("you") deciding which attesters to trust - it's website operators. You know what? They are already doing it. This just gives them another option. > And they will choose to trust only attesters that meaningfully (cryptographically) verify the user's client environment, including the secure boot chain, OS, and browser. Otherwise the attestation can be spoofed, in why case why would they bother using the EnvironmentIntegrity API at all? You might as well complain that any website requires any sort of authentication or authorization. How is WEI any different from all the other current methods which have not killed the "open web" in the way the hysteria over WEI is claiming?
    • zb3 3y ago
      Those methods didn't kill the open web because they could be bypassed, and that's precisely why WEI was proposed.
      • meragrin_ 3y ago
        Really?? Mind telling me how to access Netflix, Disney+, or any other streaming service without authentication/authorization? I'll take the information on banks too.
        • zb3 3y ago
          Where did I say you could access these without authentication? Nowhere. But I can still access them with my device being controlled by me, I can create bots/extensions to export and archive content. I can because there's no reliable method to identify whether my device acts in my interest, so they have no choice - they have to restort to methods that can be cracked. WEI is an attempt to introduce that reliable method. Sure, there's EME with Widevine L1, but this is currently limited to providing media content, not apps themselves. That's why WEI is considered the DRM for the web.
• dns_snek 3y ago
  > Read the proposal I have, and that is not a viewpoint unless you wrote the proposal. > if you have read the proposal, it's clear that they are being careful and are upfront about the some potential misuses and the proposed handing of them. The goal of the proposal is strictly incompatible with our freedoms. After all, restricting which devices, environments and software we're allowed to use to visit the website is the entire point of this proposal, is it not? > again there is no such thing proposed. The "attester" is not specifically Google. anyone can become an "attester". The chain of trust is a chain that trusts tokens not specific "things". if you for example would trust let's say Opera as the attester, Opera would need to trust windows or Linux or Android as the OS attester. So what? Even if this were true in any practical sense, as a user I have no control over which attesters the website trusts - and they will require attestation from parties that attest that I'm running the latest version of Windows or MacOS with Spyware version 5.49.182 installed, and another party that attests that their ads are visible in my framebuffer. That won't happen immediately, of course, it would be much too obvious. But introduction of WEI establishes a clear path forward towards that reality. Once WEI is in place, the chain of trust will continuously creep up the stack until everything from the TPM chip up to your framebuffer and display is locked down. They'll slowly boil the frog, like they always do. > The analogy here is the certificate Authorities. You may very well have a "let's encrypt" attester that democratizes the good parts (certification) without the bad parts (too much information) . That's a terrible analogy. For one, the only thing TLS server certificates attest to is that I *the user* am connected to the *server* that I intended to connect to. A better analogy would be mandatory TLS client certificates which would attest that I'm John Doe, underage, registered to reside in a country where the legal drinking age is 18, warning the websites that my juvenile criminal record is spotty. That's what WEI is comparable to, and you'd see a similar level of pushback if that's what was being introduced.
• roywiggins 3y ago
  > anyone can become an "attester". Good luck getting your bank to trust any ol' attester and not just FAANGs.
• helen___keller 3y ago
  > it's clear that they are being careful and are upfront about the some potential misuses and the proposed handing of them. On the contrary, my main issue is that they identify one of the primary issues and fail to address it. The biggest issue is that web designers will design around WEI such that the web is unusable without it. For example, while the current use case might be “captcha without WEI, no captcha with WEI”, a future use case might be “captcha with WEI, 401 without WEI” Essentially this means an end to the open web: websites block you if you aren’t attested. If you want to browse from NewOS, tough cookies that’s not recognized by attesters This is addressed in the proposal in “Open Questions > How will we prevent this signal from being used to exclude vendors”. The only proposed solution is in section “Holdback”: “[…] we are evaluating whether attestation signals must sometimes be held back for a meaningful number of requests […] Such a holdback would encourage web developers to use signals for aggregate analysis and opportunistic reduction of friction, as opposed to a quasi-allowlist […]” This is a massive potential issue. The author acknowledges WEI could become an allowlist for the web. The author implicitly acknowledges this is most likely if most clients are using WEI (hence, the proposed solution of artificially decreasing WEI usage via holdback) And even then, the proposed solution of holdback is not a solid one. There’s no technical reason that WEI will continue to have holdback in the future, at best maybe a google pinky promise. Further, there’s solid game theoretic reasons we can predict that holdback may vanish: if popular sites start using WEI as an allowlist, then any browser with holdback will have a degraded browsing experience on a percentage of visits. You can win market share by abandoning holdback! As a tragedy of the commons, we can reasonably assume in the long term WEI is supported on all visits by all major browsers and a nontrivial number of websites use it as an allowlist. In conclusion: the author admits WEI breaks the open web with sufficient market share, but the only proposed solution seems guaranteed to fail in a competitive browser marketplace based on game theory.
  • meragrin_ 3y ago
    > The biggest issue is that web designers will design around WEI such that the web is unusable without it. For example, while the current use case might be “captcha without WEI, no captcha with WEI”, a future use case might be “captcha with WEI, 401 without WEI” You know they can do that right now, right? They aren't doing it. Will more do it because it is simpler now? Sure. Will it put "an end to the open web"? Nope. If they wanted to end it, they could have already achieved that. WEI is just simply another better option for the websites which sorely need it. Sure, some other sites will abuse it, but I think you already avoid them since you still think the "open web" is still a thing.
• daurentius523 3y ago
  "anyone can become an "attester"" - and no site has to respect that. Read between the lines - using TLS as example: I can attest that my site is my by being self-certified but no browser will accept that - as my certificate is not "attested" by browser or OS. The WEI attester is exactly same - if site decides that it trust only Google, Apple and Microsoft - you do not have any way to access the site if you don't have attestation from that group, period. "Opera would need to trust Linux" - Again I need to stress out to anyone who doesn't understand anything about Linux - Linux is not single uniform OS - it is bunch of distributions (OSes) that agree on some common API (not always) to produce more or less something that seems to be single OS for application (often not really) - binary compatibility is not a thing to this degree that linux has many (again no uniformity) separate solutions to make closed source binaries to work. In reality trying to attest "that binary is not modified" on Linux is simply fallacious or outright misguided on basic idea - leaving aside distros that do not ship binaries (Gentoo) many ship often modified versions of software. And Users may modify software as they see fit - so there is literary no way that you can attest Linux.
  • cowl 3y ago
    By Anyone I didn't mean end-users. The TLS analogy stands. No browser has made the decision to trust only one authority. A motivated and funded organisation can become an Authority (like Let's Encrypt did) and the same can happen in the WEI case too. Ofcourse noone can trust self-certification. At the "trust-me-bro" game bots are more convincing than real users.
    • daurentius523 3y ago
      > By Anyone I didn't mean end-users. then it isn't anyone. >and the same can happen in the WEI case too It is impossible to happen in this case. If client has to be certified, then as product OS must be certified out-of-the-box for non-technical user. This will make sure 97% of market is covered by Apple, Microsoft and Google - these are "Authorities" web will have - even if the remaining few percent would be unified - it still will lead to most often then not "not being included" as trustworthy from server side. >The TLS analogy stands. no it does not. TLS cares about connection not OS stack. Also power dynamic flows in opposite direction. >Ofcourse noone can trust self-certification. If you want you can - because You (user) can import any certificate. The problem for me is that: [Free/Open] Source/Linux in their entirety can be attested only if self-certification is possible. AND Self-certification means that WEI doesn't work. AND Any proposal that excludes any OS (or Linux distribution) from web is unacceptable. Do you see logical outcome which this reasoning leads me to? >No browser has made the decision to trust only one authority. But it is not the browser here who has the final power "to trust", it is the server. And companies will only care about Windows, Mac(Safari), Android and Chrome. >A motivated and funded organisation can become an Authority (like Let's Encrypt did) Let's Encrypt could do that because TLS works in reverse direction and it is website that must be certified not the user. > At the "trust-me-bro" game bots are more convincing than real users. Yes exactly which is again everyone's point - for 10001 times and again "You cannot trust the client" - it is impossible to create privacy/[freedom of use for browsers and OS]-focused 'secure' and perfect attestation about client. One has to give - 'security'/perfection or privacy/[freedom of use for browsers and OS]. We calculated what this proposal brings and rejected it on basis that bad is bigger than potential 'good' it can bring. And again to put it clear - you need bots: search crawlers, web archive bots, URL scanners. So put it clear - it is clearly from my perspective a wrong proposal. P.S. This another thing worth considering if you think WEI will create real security: https://news.ycombinator.com/item?id=36985317 https://news.ycombinator.com/item?id=36985317