4 ms·

I mean, devil's advocate here, this tech already exists and the question is do we do client attestation in a browser or pretend remote attestation doesn't exist

by tapoxi 3y ago

I mean, devil's advocate here, this tech already exists and the question is do we do client attestation in a browser or pretend remote attestation doesn't exist. If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? I'm not trying to argue in favor of WEI, I just think this doesn't magically disappear if Google doesn't implement in Chrome, it just moves the problem elsewhere. The fight was implementing TPM in the first place.

shadowgovt 3y ago
You are correct, and that is fine. If the ecosystem becomes "You control your browser but not the apps on your mobile device," that's pretty much the status quo.
bayindirh 3y ago
The problem is, this is very open (or even designed) to be abused by their implementers. It's akin to having only Microsoft as the Secure Boot key authority. Mobile devices already has tons of attestation features. Secure enclaves, security processors, cryptographic capabilities of SIM cards (e.g. I carry my private key inside my SIM card, and use it as a wet signature, legally). We do not need this tech which can and will be abused to lock any tech savvy person from daily internet based on arbitrary rules. There are no checks and balances. This is a very broad set of capabilities which is forced upon users. This is no proposal, or experiment. It's a force-push attempt.
- judge2020 3y ago
  There were proposals for protecting against this in the WEI explainer under "Open Questions" https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#open-questions https://github.com/RupertBenWiser/Web-Environment-Integrity/...
  - bayindirh 3y ago
    I skimmed the link you provided, thanks. It looks like they propose to mix false signals to prevent this from being abused, but oh. That's easy to bypass. Require two attestations back to back to see whether they differ, or put up a page saying, "can you please try again?" The open question is circling around the question, can we make it work in a way, such that it doesn't work for bad guys, but works for good guys. Mathematics & cryptography doesn't work like that. It doesn't discriminate. It levels everyone. It'll either become an iron fist or a Swiss Cheese. There can be no middle. This is maths.
    - wmf 3y ago
      We can't even agree on who the good guys and bad guys are. Is a bank bad for excluding certain browsers?
      - WarOnPrivacy 3y ago
        > We can't even agree on who the good guys and bad guys are. This is true. In these discussions of trust, my measurement of a bad actor is who is in a position to harm me and has a history of causing harm. High on my list are LEO and other government interests (fed,state,local).
      - pdonis 3y ago
        > Is a bank bad for excluding certain browsers? Yes, because it's stupid; they don't need to. The bank cares about correctly identifying who I am, not what client I am using. Nor do they exclude certain browsers because those browsers make it easier for a user to lie about who they are; they don't. Banks exclude certain browsers because their technically incompetent coders convinced their technically incompetent managers to do so.
        pmontra 3y ago
        As someone wrote in one of the top comments, banks will use it because regulators will ask them to.
  - soraminazuki 3y ago
    Some people can't help bringing this up in every WEI-related thread only to be debunked each time. This very article graciously mentions it and explains why it's a non-solution. That "proposal" is doublethink in its purest form. WEI is a technology for restricting access to web services. But at the same time, it would try to prevent web service providers from doing exactly that?
- minsc_and_boo 3y ago
  Noob question: Can you do attestation with mobile web, or is it app only?
  - pdonis 3y ago
    Sure, if your mobile device is only allowed to use "approved" web browsers. Which is one of the key harms to users that the proposed WEI standard will inflict.
- politelemon 3y ago
  Based on what you're saying though, it's already been forced on users through mobile devices. This is the next step in a series of steps which weren't argued against. It's not that we don't need this tech, is that we didn't need this tech and are making noise and it now.
  - bayindirh 3y ago
    Putting boot signing and “OS integrity control” aside, current iteration of TPM devices are not this intrusive. They allow me to generate and/or store keys and do cryptographic things with these keys securely. They store my information locally, and if implemented right, this data can’t leave that chip. Even OS integrity check is done locally. You can’t ask arbitrary measurements out of it. WEI is different. Rules come from outside. Acceptable parameters are decided by another party. You have no pieces of the system in your possession. You are a Furby forced to tell something with the will of the attester through the filter tuned and configured elsewhere. I can disable TPM or force it to reset itself if I want to. Even Apple’s security processors can be wiped clean of your data. WEI is not like that.
    - WarOnPrivacy 3y ago
      Treating end-users as a threat is galling, given the crappy security all over the web - IOT, infrastructure (BGP,DNS), leaky S3 buckets, misconfigured government sites, etc.
  - danShumway 3y ago
    The best time to have fought against this tech would have been when it got proposed on mobile devices. The second best time is now.
mike_d 3y ago
> pretend remote attestation doesn't exist This. Nothing in my skim of the spec prevents me from using your hacked machine as an attestation oracle. This does nothing but add additional value to compromising end user devices.
realusername 3y ago
> If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? The way forward is getting it removed in mobile devices as well.
nightpool 3y ago
I would suggest reading the TAG's Web Platform Design Principles document, it does a really good job laying out why the web is different from mobile and native applications and the reasons why some APIs, like client attestation, work in a mobile environment but would damage the web platform if they're implemented. For example, the WEI proposal violates the "It should be safe to visit a web page" principle (https://www.w3.org/TR/design-principles/#safe-to-browse https://www.w3.org/TR/design-principles/#safe-to-browse): When adding new features, design them to preserve the user expectation that visiting a web page is generally safe. The Web is named for its hyperlinked structure. In order for the web to remain vibrant, users need to be able to expect that merely visiting any given link won’t have implications for the security of their computer, or for any essential aspects of their privacy. For example, an API which allows any website to detect the use of assistive technologies may make users of these technologies feel unsafe visiting unknown web pages, since any web page may detect this private information. If users have a realistic expectation of safety, they can make informed decisions between Web-based technologies and other technologies. For example, users may choose to use a web-based food ordering page, rather than installing an app, since installing a native app is riskier than visiting a web page. I know a lot of savvy, non-technical users who absolutely refuse to install mobile apps on their phone except from the most trusted of sources, and I think this principle is a good structural framework for reasoning through why users still prefer the web.
- freedomben 3y ago
  Likewise, and that's the advice I give everyone. Most things are perfectly fine as a web page. The app offers no benefit to the user. It only benefits the app owner.
- JohnFen 3y ago
  > I know a lot of savvy, non-technical users who absolutely refuse to install mobile apps on their phone Yes. Mobile apps are far too risky, in my opinion. These days, the only ones I install are ones that I've written myself.
- Brian_K_White 3y ago
  "In order for the web to remain vibrant" The people pushing these things do not care about this at all. To them it's like something a child would say and marks the speaker as utterly irellevant and silly, not even a real person due any respect at all.
zb3 3y ago
> services that need a "trusted client" Should be outlawed, with the exception of dedicated hardware. Stop invading my devices.
hot_gril 3y ago
> If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? Yes, and this has already been happening. For example, Venmo used to have a fully-functional web app, but now you can't send/receive money on it. Many Chase features are also phone-only. Edit: And a lot of these apps block jailbroken iPhones or rooted Androids if they can detect that.
- boring_twenties 3y ago
  Venmo is usable on the web again as of at least a year or so ago. Not sure what changed their mind.
  - hot_gril 3y ago
    Oh, that's interesting. Was not the case in 2021 at least. Maybe now they're worried about the new competition that does have web apps?
matheusmoreira 3y ago
We choose neither of the options you presented. Instead we recognize that remote attestation is inherently abusive technology and ban it in all its forms. It should be illegal for any kind of service to ever require a "trusted client" in any context. Interoperability should be law whether they like it or not.
caskstrength 3y ago
Yes and that is okay. The Web should remain open and some app stores could be walled gardens.
ndriscoll 3y ago
On my machine, it wouldn't be pretending that remote attestation doesn't exist. It does not exist, and if e.g. banks decided to require it, that'd just be locking me out. I have no attestation daemon, and if I did, it wouldn't be trusted by them. It doesn't matter if Firefox adds it too; it straight up won't work on my computer. People keep talking about browsers, but I'd prefer to continue running an operating system that doesn't have adware and spyware built in. My computer that I own is under my control, which is what these remote attestation features are meant to prevent. That is the fundamental problem. If this kind of thing gets implemented by my bank/brokerage, I have to either buy a new computer just for them, or do all my banking over the phone or in person. It's incredibly wasteful and doesn't even help with security, but once it exists, it will get added to a checklist that banks will adhere to.
michael1999 3y ago
This is entirely about Google trying to deal with ad click fraud. They desperately want a solution in the browser. They will ship this, standard or not. But I don't see a reason for Apple to ship this in Safari, or Firefox neither. So I expect this will be a real test of Chrome's market power. Will any sites start blocking non-WEI browsers? Locking out iPhones seems insane. Or will we see differential ad rates for WEI environments?
pdonis 3y ago
> do we do client attestation in a browser or pretend remote attestation doesn't exist Neither. The issue is that this is being framed as a "client attestation" problem, when the actual problem that needs to be solved (as opposed to a "problem" that certain companies would like to "solve" to benefit themselves at users' expense) is a user attestation problem. My bank has no reason to care what client I am using to access their online services. They do have a reason to care about correctly identifying who I am. But there are already ways to do that that are just as good as anything WEI will provide. Companies that do care what client I am using don't care for my benefit. They care for their benefit. But as long as they can't get the law to tilt the playing field in their favor, I can just refuse to use their services if they refuse to accept my client. As soon as "client attestation" becomes a legal requirement, though, then it's not just those particular companies that will use it; everybody will have to, including my bank, even though my bank has no reason to do so other than the law if such a law passes.
danShumway 3y ago
> it just moves the problem elsewhere. Good. The point here is to shrink the space where client attestation is used, not to expand it. Every time it shrinks a little bit more is a victory. Let's get it out of the browser and then we can tackle native attestation for apps next. > If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? This is verbatum the argument that was brought up for EME. But now we have the benefit of looking back at EME and seeing what the impact was. It didn't stop the movement towards native apps, businesses like Netflix implemented EME and kept many of the same restrictions they were going to implement anyway. It did end up harming browser diversity. I understand that it sounds scary to say "we're just not going to do this" on the web when sites might be pushing a scare tactic of "we're just going to go native then." But... we've been through this, caving doesn't work. The sites that want to go native will go native, WEI on its own will not be a business justification for websites to stay on the web or to leave the web. The sites that do want to go native-only will not suddenly make a website just because WEI exists. They'll do the same stuff they wanted to do anyway, and if WEI is available, they will simply add that to their toolkit as a way to limit user agency alongside everything else they're doing. It's good if businesses that want to rely on client attestation are "punished" by being forced to abandon their web presence. And frankly, people underestimate how much power the web has. Refusing to support WEI will not kill the web.
raxxorraxor 3y ago
Yes, they should leave the web then. They won't do that anyway because they would loose users. True that TPM shouldn't be embraced either, it will just create ambitions.

by tapoxi 3y ago

shadowgovt 3y ago

You are correct, and that is fine. If the ecosystem becomes "You control your browser but not the apps on your mobile device," that's pretty much the status quo.

bayindirh 3y ago

The problem is, this is very open (or even designed) to be abused by their implementers. It's akin to having only Microsoft as the Secure Boot key authority. Mobile devices already has tons of attestation features. Secure enclaves, security processors, cryptographic capabilities of SIM cards (e.g. I carry my private key inside my SIM card, and use it as a wet signature, legally). We do not need this tech which can and will be abused to lock any tech savvy person from daily internet based on arbitrary rules. There are no checks and balances. This is a very broad set of capabilities which is forced upon users. This is no proposal, or experiment. It's a force-push attempt.

judge2020 3y ago
There were proposals for protecting against this in the WEI explainer under "Open Questions" https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#open-questions https://github.com/RupertBenWiser/Web-Environment-Integrity/...
- bayindirh 3y ago
  I skimmed the link you provided, thanks. It looks like they propose to mix false signals to prevent this from being abused, but oh. That's easy to bypass. Require two attestations back to back to see whether they differ, or put up a page saying, "can you please try again?" The open question is circling around the question, can we make it work in a way, such that it doesn't work for bad guys, but works for good guys. Mathematics & cryptography doesn't work like that. It doesn't discriminate. It levels everyone. It'll either become an iron fist or a Swiss Cheese. There can be no middle. This is maths.
  - wmf 3y ago
    We can't even agree on who the good guys and bad guys are. Is a bank bad for excluding certain browsers?
    - WarOnPrivacy 3y ago
      > We can't even agree on who the good guys and bad guys are. This is true. In these discussions of trust, my measurement of a bad actor is who is in a position to harm me and has a history of causing harm. High on my list are LEO and other government interests (fed,state,local).
    - pdonis 3y ago
      > Is a bank bad for excluding certain browsers? Yes, because it's stupid; they don't need to. The bank cares about correctly identifying who I am, not what client I am using. Nor do they exclude certain browsers because those browsers make it easier for a user to lie about who they are; they don't. Banks exclude certain browsers because their technically incompetent coders convinced their technically incompetent managers to do so.
      - pmontra 3y ago
        As someone wrote in one of the top comments, banks will use it because regulators will ask them to.
- soraminazuki 3y ago
  Some people can't help bringing this up in every WEI-related thread only to be debunked each time. This very article graciously mentions it and explains why it's a non-solution. That "proposal" is doublethink in its purest form. WEI is a technology for restricting access to web services. But at the same time, it would try to prevent web service providers from doing exactly that?
minsc_and_boo 3y ago
Noob question: Can you do attestation with mobile web, or is it app only?
- pdonis 3y ago
  Sure, if your mobile device is only allowed to use "approved" web browsers. Which is one of the key harms to users that the proposed WEI standard will inflict.
politelemon 3y ago
Based on what you're saying though, it's already been forced on users through mobile devices. This is the next step in a series of steps which weren't argued against. It's not that we don't need this tech, is that we didn't need this tech and are making noise and it now.
- bayindirh 3y ago
  Putting boot signing and “OS integrity control” aside, current iteration of TPM devices are not this intrusive. They allow me to generate and/or store keys and do cryptographic things with these keys securely. They store my information locally, and if implemented right, this data can’t leave that chip. Even OS integrity check is done locally. You can’t ask arbitrary measurements out of it. WEI is different. Rules come from outside. Acceptable parameters are decided by another party. You have no pieces of the system in your possession. You are a Furby forced to tell something with the will of the attester through the filter tuned and configured elsewhere. I can disable TPM or force it to reset itself if I want to. Even Apple’s security processors can be wiped clean of your data. WEI is not like that.
  - WarOnPrivacy 3y ago
    Treating end-users as a threat is galling, given the crappy security all over the web - IOT, infrastructure (BGP,DNS), leaky S3 buckets, misconfigured government sites, etc.
- danShumway 3y ago
  The best time to have fought against this tech would have been when it got proposed on mobile devices. The second best time is now.

mike_d 3y ago

> pretend remote attestation doesn't exist This. Nothing in my skim of the spec prevents me from using your hacked machine as an attestation oracle. This does nothing but add additional value to compromising end user devices.

realusername 3y ago

> If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? The way forward is getting it removed in mobile devices as well.

nightpool 3y ago

I would suggest reading the TAG's Web Platform Design Principles document, it does a really good job laying out why the web is different from mobile and native applications and the reasons why some APIs, like client attestation, work in a mobile environment but would damage the web platform if they're implemented. For example, the WEI proposal violates the "It should be safe to visit a web page" principle (https://www.w3.org/TR/design-principles/#safe-to-browse https://www.w3.org/TR/design-principles/#safe-to-browse): When adding new features, design them to preserve the user expectation that visiting a web page is generally safe. The Web is named for its hyperlinked structure. In order for the web to remain vibrant, users need to be able to expect that merely visiting any given link won’t have implications for the security of their computer, or for any essential aspects of their privacy. For example, an API which allows any website to detect the use of assistive technologies may make users of these technologies feel unsafe visiting unknown web pages, since any web page may detect this private information. If users have a realistic expectation of safety, they can make informed decisions between Web-based technologies and other technologies. For example, users may choose to use a web-based food ordering page, rather than installing an app, since installing a native app is riskier than visiting a web page. I know a lot of savvy, non-technical users who absolutely refuse to install mobile apps on their phone except from the most trusted of sources, and I think this principle is a good structural framework for reasoning through why users still prefer the web.

freedomben 3y ago
Likewise, and that's the advice I give everyone. Most things are perfectly fine as a web page. The app offers no benefit to the user. It only benefits the app owner.
JohnFen 3y ago
> I know a lot of savvy, non-technical users who absolutely refuse to install mobile apps on their phone Yes. Mobile apps are far too risky, in my opinion. These days, the only ones I install are ones that I've written myself.
Brian_K_White 3y ago
"In order for the web to remain vibrant" The people pushing these things do not care about this at all. To them it's like something a child would say and marks the speaker as utterly irellevant and silly, not even a real person due any respect at all.

zb3 3y ago

> services that need a "trusted client" Should be outlawed, with the exception of dedicated hardware. Stop invading my devices.

hot_gril 3y ago

> If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? Yes, and this has already been happening. For example, Venmo used to have a fully-functional web app, but now you can't send/receive money on it. Many Chase features are also phone-only. Edit: And a lot of these apps block jailbroken iPhones or rooted Androids if they can detect that.

boring_twenties 3y ago
Venmo is usable on the web again as of at least a year or so ago. Not sure what changed their mind.
- hot_gril 3y ago
  Oh, that's interesting. Was not the case in 2021 at least. Maybe now they're worried about the new competition that does have web apps?

matheusmoreira 3y ago

We choose neither of the options you presented. Instead we recognize that remote attestation is inherently abusive technology and ban it in all its forms. It should be illegal for any kind of service to ever require a "trusted client" in any context. Interoperability should be law whether they like it or not.

caskstrength 3y ago

Yes and that is okay. The Web should remain open and some app stores could be walled gardens.

ndriscoll 3y ago

On my machine, it wouldn't be pretending that remote attestation doesn't exist. It does not exist, and if e.g. banks decided to require it, that'd just be locking me out. I have no attestation daemon, and if I did, it wouldn't be trusted by them. It doesn't matter if Firefox adds it too; it straight up won't work on my computer. People keep talking about browsers, but I'd prefer to continue running an operating system that doesn't have adware and spyware built in. My computer that I own is under my control, which is what these remote attestation features are meant to prevent. That is the fundamental problem. If this kind of thing gets implemented by my bank/brokerage, I have to either buy a new computer just for them, or do all my banking over the phone or in person. It's incredibly wasteful and doesn't even help with security, but once it exists, it will get added to a checklist that banks will adhere to.

michael1999 3y ago

This is entirely about Google trying to deal with ad click fraud. They desperately want a solution in the browser. They will ship this, standard or not. But I don't see a reason for Apple to ship this in Safari, or Firefox neither. So I expect this will be a real test of Chrome's market power. Will any sites start blocking non-WEI browsers? Locking out iPhones seems insane. Or will we see differential ad rates for WEI environments?

pdonis 3y ago

> do we do client attestation in a browser or pretend remote attestation doesn't exist Neither. The issue is that this is being framed as a "client attestation" problem, when the actual problem that needs to be solved (as opposed to a "problem" that certain companies would like to "solve" to benefit themselves at users' expense) is a user attestation problem. My bank has no reason to care what client I am using to access their online services. They do have a reason to care about correctly identifying who I am. But there are already ways to do that that are just as good as anything WEI will provide. Companies that do care what client I am using don't care for my benefit. They care for their benefit. But as long as they can't get the law to tilt the playing field in their favor, I can just refuse to use their services if they refuse to accept my client. As soon as "client attestation" becomes a legal requirement, though, then it's not just those particular companies that will use it; everybody will have to, including my bank, even though my bank has no reason to do so other than the law if such a law passes.

danShumway 3y ago

> it just moves the problem elsewhere. Good. The point here is to shrink the space where client attestation is used, not to expand it. Every time it shrinks a little bit more is a victory. Let's get it out of the browser and then we can tackle native attestation for apps next. > If this gets rejected, would that mean that services that need a "trusted client" simply deprecate their web apps and rely on a iOS/Android app? This is verbatum the argument that was brought up for EME. But now we have the benefit of looking back at EME and seeing what the impact was. It didn't stop the movement towards native apps, businesses like Netflix implemented EME and kept many of the same restrictions they were going to implement anyway. It did end up harming browser diversity. I understand that it sounds scary to say "we're just not going to do this" on the web when sites might be pushing a scare tactic of "we're just going to go native then." But... we've been through this, caving doesn't work. The sites that want to go native will go native, WEI on its own will not be a business justification for websites to stay on the web or to leave the web. The sites that do want to go native-only will not suddenly make a website just because WEI exists. They'll do the same stuff they wanted to do anyway, and if WEI is available, they will simply add that to their toolkit as a way to limit user agency alongside everything else they're doing. It's good if businesses that want to rely on client attestation are "punished" by being forced to abandon their web presence. And frankly, people underestimate how much power the web has. Refusing to support WEI will not kill the web.

raxxorraxor 3y ago

Yes, they should leave the web then. They won't do that anyway because they would loose users. True that TPM shouldn't be embraced either, it will just create ambitions.