4 ms·

The problem is that the owner of the device is considered "untrusted" here. While that sometimes makes sense (for law enforcement purposes), using this for busi

by zb3 3y ago

The problem is that the owner of the device is considered "untrusted" here. While that sometimes makes sense (for law enforcement purposes), using this for business purposes is anticompetitive. It shouldn't be possible for companies to do whatever they want.

charcircuit 3y ago
>using this for business purposes is anticompetitive Businesses not trusting every random person is not anticompetitive. Doing that is how businesses make bad deals, get hacked, or make bad decisions.
- zb3 3y ago
  Of course it is anticompetitive, if a given service (which is defacto mandatory) strikes a deal with select few hardware vendors to artificially make it impossible to access the service using different hardware (for purely business reasons), then it obviously is anticompetitive.
  - charcircuit 3y ago
    >strikes a deal with select few hardware vendors That isn't what is happening. Anyone can become a manufacturer for Windows PCs or Android certified phones.
    - daurentius523 3y ago
      Right because Microsoft and Google don't mandate what can and cannot be installed by manufacturer… oh wait.
      - charcircuit 3y ago
        The whole point of Android certification is that you are following Google's rules. If you make something that is not certified you can not get play services.
        daurentius523 3y ago
        >The whole point of Android certification is that you are following Google's rules. Whole point of WEI is that you are following Google's rules. You essentially acknowledged that YOU CANNOT become manufacturer - you become subcontractor for corporation that dictates what you can and cannot do. Which from point of trust is precisely that - anticompetitive behaviour.
        charcircuit 3y ago
        >Whole point of WEI is that you are following Google's rules. That would be the point of the Google Play attestor. With WEI sites can use anyone as an attestor. It is up for attestors to compete in providing a valuable signal to sites. It's not anticompetitive because you can come up with your own standard of a secure device and get sites to trust your attestor.
        zb3 3y ago
        Even if that'd be the case I'd still consider this API nothing more than a framework for enabling anticompetitive behaviour. But let's go back to the "anyone as attestor" argument. I don't see it in the API at all - I see only content binding..
        charcircuit 3y ago
        When navigator.getEnvironmentIntegrity is called the browser can get an attestation from any single atestor willing to attest to it.
        zb3 3y ago
        I'm unable to understand this. Since the API doesn't provide a way to force a specific atestor to be invoked, doesn't it mean it will be the browser that decides which atestor can run on a given platform? Of course then substitute browser for Chrome and we'll get the obvious outcome - Google will decide.
    - zb3 3y ago
      That's not the competition I really meant, replace hardware vendors with OS vendors / Google. "Android certified" means it follows Google's rules, so there's no way to compete by creating alternative security model (for example where the user has more power). So the anticompetitive part is the attestation part, which artificially makes it impossible to run an app that'd otherwise work on the system that doesn't follow Google's rules.
      - charcircuit 3y ago
        >so there's no way to compete by creating alternative security model (for example where the user has more power). There is a way, by creating a new attestor service that provides less guarantees than what Google Play's attestor provides.
        zb3 3y ago
        Compete in anticompetitiveness? Attestation is the problem itself, it makes it harder to compete, by definition excluding any newly created environment. But this isn't really my problem as I'm not a business. As an user, I'd be happy to have a secure OS with hardware attestation and app security but without Google Adware and Spyware.
        charcircuit 3y ago
        >Compete in anticompetitiveness? Trust isn't anticompetitive.
        zb3 3y ago
        In this context it clearly is - if the server assumes the request sent by the client is always untrusted, then any capable device / app can use the service and it's possible to manufacture that device / app without permission from some company that has a dominant market position.. I acknowledge though, that this is incompatible with many practical scenarios, and CPC advertisements are one of those. It's hard for me to argue here theoretically without taking context into account, as it turns out what I'm arguing for depends on it heavily.. It could be possible for Google to make changes where while theoretically possible to compete, it's not practical, and when it gets practical, Google could make another change and so on..

by zb3 3y ago

charcircuit 3y ago

>using this for business purposes is anticompetitive Businesses not trusting every random person is not anticompetitive. Doing that is how businesses make bad deals, get hacked, or make bad decisions.

zb3 3y ago
Of course it is anticompetitive, if a given service (which is defacto mandatory) strikes a deal with select few hardware vendors to artificially make it impossible to access the service using different hardware (for purely business reasons), then it obviously is anticompetitive.
- charcircuit 3y ago
  >strikes a deal with select few hardware vendors That isn't what is happening. Anyone can become a manufacturer for Windows PCs or Android certified phones.
  - daurentius523 3y ago
    Right because Microsoft and Google don't mandate what can and cannot be installed by manufacturer… oh wait.
    - charcircuit 3y ago
      The whole point of Android certification is that you are following Google's rules. If you make something that is not certified you can not get play services.
      - daurentius523 3y ago
        >The whole point of Android certification is that you are following Google's rules. Whole point of WEI is that you are following Google's rules. You essentially acknowledged that YOU CANNOT become manufacturer - you become subcontractor for corporation that dictates what you can and cannot do. Which from point of trust is precisely that - anticompetitive behaviour.
        charcircuit 3y ago
        >Whole point of WEI is that you are following Google's rules. That would be the point of the Google Play attestor. With WEI sites can use anyone as an attestor. It is up for attestors to compete in providing a valuable signal to sites. It's not anticompetitive because you can come up with your own standard of a secure device and get sites to trust your attestor.
        zb3 3y ago
        Even if that'd be the case I'd still consider this API nothing more than a framework for enabling anticompetitive behaviour. But let's go back to the "anyone as attestor" argument. I don't see it in the API at all - I see only content binding..
        charcircuit 3y ago
        When navigator.getEnvironmentIntegrity is called the browser can get an attestation from any single atestor willing to attest to it.
        zb3 3y ago
        I'm unable to understand this. Since the API doesn't provide a way to force a specific atestor to be invoked, doesn't it mean it will be the browser that decides which atestor can run on a given platform? Of course then substitute browser for Chrome and we'll get the obvious outcome - Google will decide.
  - zb3 3y ago
    That's not the competition I really meant, replace hardware vendors with OS vendors / Google. "Android certified" means it follows Google's rules, so there's no way to compete by creating alternative security model (for example where the user has more power). So the anticompetitive part is the attestation part, which artificially makes it impossible to run an app that'd otherwise work on the system that doesn't follow Google's rules.
    - charcircuit 3y ago
      >so there's no way to compete by creating alternative security model (for example where the user has more power). There is a way, by creating a new attestor service that provides less guarantees than what Google Play's attestor provides.
      - zb3 3y ago
        Compete in anticompetitiveness? Attestation is the problem itself, it makes it harder to compete, by definition excluding any newly created environment. But this isn't really my problem as I'm not a business. As an user, I'd be happy to have a secure OS with hardware attestation and app security but without Google Adware and Spyware.
        charcircuit 3y ago
        >Compete in anticompetitiveness? Trust isn't anticompetitive.
        zb3 3y ago
        In this context it clearly is - if the server assumes the request sent by the client is always untrusted, then any capable device / app can use the service and it's possible to manufacture that device / app without permission from some company that has a dominant market position.. I acknowledge though, that this is incompatible with many practical scenarios, and CPC advertisements are one of those. It's hard for me to argue here theoretically without taking context into account, as it turns out what I'm arguing for depends on it heavily.. It could be possible for Google to make changes where while theoretically possible to compete, it's not practical, and when it gets practical, Google could make another change and so on..