4 ms·

> The biggest issue is that web designers will design around WEI such that the web is unusable without it. For example, while the current use case might be “cap

> The biggest issue is that web designers will design around WEI such that the web is unusable without it. For example, while the current use case might be “captcha without WEI, no captcha with WEI”, a future use case might be “captcha with WEI, 401 without WEI” You know they can do that right now, right? They aren't doing it. Will more do it because it is simpler now? Sure. Will it put "an end to the open web"? Nope. If they wanted to end it, they could have already achieved that. WEI is just simply another better option for the websites which sorely need it. Sure, some other sites will abuse it, but I think you already avoid them since you still think the "open web" is still a thing.

dns_snek 3y ago
"We will abuse this but you should stop complaining because we sorely need this to pad the profit margins for our investors."
helen___keller 3y ago
I’m not sure what you mean by “they aren’t doing it”. WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem.
- meragrin_ 3y ago
  > I’m not sure what you mean by “they aren’t doing it”. Making the web impossible to use if you don't fit into their specific requirements. WEI is just another signal. It won't be the only signal for the vast majority of the web. Google cannot do anything to break the web without the help of Apple. Frankly, Apple has a better chance of breaking anything open than Google does. Apple has the vertical control. Google has what? Chrome? I just don't understand how people seem to think Google has all this power, but continue to ignore Apple. > WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. Yet a lot people seemingly know its going to do this, that, and some other bad thing even though there is no proof and stated goals which are the opposite. > More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem. They cannot prevent websites from requiring X to access their sites. There is no workable solution to force someone to accept traffic against their wishes. If they only accept requests with some custom header, that's their prerogative. Many features of browsers have been (ab)used for "nefarious" purposes. Should we get rid of those? This whole thing feels like since Trump is not president in the US any more, certain people need a boogeyman and are using Google in his place. Anything Google does is automatically bad.
  - daurentius523 3y ago
    Part 2: > Yet a lot people seemingly know its going to do this, that, and some other bad thing Original https://news.ycombinator.com/item?id=36935843 https://news.ycombinator.com/item?id=36935843 New Because any other option is not sensible: 1. Authors don't understand what tech they use. (not possible as they acknowledge issues) 2. Authors don't understand that something unrealistic is unrealistic. Idea that you can give companies or corporations tools to check "did user modify his environment" and they would not use it to exclude users is stupid or disingenuous because advocates for this did exactly comment in such way: We want this proposal to do precisely that. Again Google tries to defend it by saying "we will return invalid 'false' for some of the users/times of Chrome users" [to make sure that website will not do that] which for me is not only bad because it then creates "when google revokes this policy we are in even worse situation" but then leaves the issue how google decides "who" to give back this 'false': I will reject times immediately not only because this can be easily circumvented by website [check n-times] to detriment of user but it would also contradict official documentation of WEI (same token for same input from user). And this leads us to another point - if Google wants to return false negatives it would need to either keep information that is supposed to return 'false' - EU will not be very happy with that (also it does contradict this "chrome users"); or more likely it will be implemented in chrome. Now when we established that implementation in chrome is most probable - we can also establish that: A) Implement this on profile basis - companies will ask you to reset profile if you are this false negative. B) Implement on connection basis - companies will ask you to refresh. C) Implement on device age / os version / type - Google can even make the manufacturers happy with this one. … as you can see at most this will be nuisance and if by some weird way: Z) Implement on Super-complicated basis - this will be still possible because… 3. Google plays disingenuous word game with us here by saying - We won't destroy open web Other Chromium browsers may ignore that Google X% false negative (Google may loose few % of users before it scrapes this policy). And there is 0 need for Google to actually do something when companies will misuse this API. In simple words the part that should worry you is not that "Google will destroy web by using this API on Chrome and it services", what must worry you is that other companies will do that for Google and Google will wash their hands from this by saying "We wanted good but didn't work". You can see that tone from the Google - We don't want that so we created these "holdouts". They are proposing thing that any sensible person see as clear cut attack (or stupid idea that can only work this way) on Privacy and Your Right to use Your Device (and for some people Your OS and/or Your Browser) as You want to use. They are at fault here.
zb3 3y ago
How can they verify it now with hardware-based security? They can't, that's why WEI is proposed, to bridge device attestation API. While trivial fingerprinting methods can be bypassed, TEE-based methods are pretty much impossible to bypass ($500K reward for that)

dns_snek 3y ago

"We will abuse this but you should stop complaining because we sorely need this to pad the profit margins for our investors."

helen___keller 3y ago

I’m not sure what you mean by “they aren’t doing it”. WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem.

meragrin_ 3y ago
> I’m not sure what you mean by “they aren’t doing it”. Making the web impossible to use if you don't fit into their specific requirements. WEI is just another signal. It won't be the only signal for the vast majority of the web. Google cannot do anything to break the web without the help of Apple. Frankly, Apple has a better chance of breaking anything open than Google does. Apple has the vertical control. Google has what? Chrome? I just don't understand how people seem to think Google has all this power, but continue to ignore Apple. > WEI doesn’t exist yet, obviously nobody is blocking clients who aren’t attested. Yet a lot people seemingly know its going to do this, that, and some other bad thing even though there is no proof and stated goals which are the opposite. > More to the point, even the author of this proposal has recognized this is an issue, identified it as so in the proposal, then failed to put forward a workable solution. That’s my problem. They cannot prevent websites from requiring X to access their sites. There is no workable solution to force someone to accept traffic against their wishes. If they only accept requests with some custom header, that's their prerogative. Many features of browsers have been (ab)used for "nefarious" purposes. Should we get rid of those? This whole thing feels like since Trump is not president in the US any more, certain people need a boogeyman and are using Google in his place. Anything Google does is automatically bad.
- daurentius523 3y ago
  Part 2: > Yet a lot people seemingly know its going to do this, that, and some other bad thing Original https://news.ycombinator.com/item?id=36935843 https://news.ycombinator.com/item?id=36935843 New Because any other option is not sensible: 1. Authors don't understand what tech they use. (not possible as they acknowledge issues) 2. Authors don't understand that something unrealistic is unrealistic. Idea that you can give companies or corporations tools to check "did user modify his environment" and they would not use it to exclude users is stupid or disingenuous because advocates for this did exactly comment in such way: We want this proposal to do precisely that. Again Google tries to defend it by saying "we will return invalid 'false' for some of the users/times of Chrome users" [to make sure that website will not do that] which for me is not only bad because it then creates "when google revokes this policy we are in even worse situation" but then leaves the issue how google decides "who" to give back this 'false': I will reject times immediately not only because this can be easily circumvented by website [check n-times] to detriment of user but it would also contradict official documentation of WEI (same token for same input from user). And this leads us to another point - if Google wants to return false negatives it would need to either keep information that is supposed to return 'false' - EU will not be very happy with that (also it does contradict this "chrome users"); or more likely it will be implemented in chrome. Now when we established that implementation in chrome is most probable - we can also establish that: A) Implement this on profile basis - companies will ask you to reset profile if you are this false negative. B) Implement on connection basis - companies will ask you to refresh. C) Implement on device age / os version / type - Google can even make the manufacturers happy with this one. … as you can see at most this will be nuisance and if by some weird way: Z) Implement on Super-complicated basis - this will be still possible because… 3. Google plays disingenuous word game with us here by saying - We won't destroy open web Other Chromium browsers may ignore that Google X% false negative (Google may loose few % of users before it scrapes this policy). And there is 0 need for Google to actually do something when companies will misuse this API. In simple words the part that should worry you is not that "Google will destroy web by using this API on Chrome and it services", what must worry you is that other companies will do that for Google and Google will wash their hands from this by saying "We wanted good but didn't work". You can see that tone from the Google - We don't want that so we created these "holdouts". They are proposing thing that any sensible person see as clear cut attack (or stupid idea that can only work this way) on Privacy and Your Right to use Your Device (and for some people Your OS and/or Your Browser) as You want to use. They are at fault here.

zb3 3y ago

How can they verify it now with hardware-based security? They can't, that's why WEI is proposed, to bridge device attestation API. While trivial fingerprinting methods can be bypassed, TEE-based methods are pretty much impossible to bypass ($500K reward for that)