4 ms·

The problem is, this is very open (or even designed) to be abused by their implementers. It's akin to having only Microsoft as the Secure Boot key authority. M

The problem is, this is very open (or even designed) to be abused by their implementers. It's akin to having only Microsoft as the Secure Boot key authority. Mobile devices already has tons of attestation features. Secure enclaves, security processors, cryptographic capabilities of SIM cards (e.g. I carry my private key inside my SIM card, and use it as a wet signature, legally). We do not need this tech which can and will be abused to lock any tech savvy person from daily internet based on arbitrary rules. There are no checks and balances. This is a very broad set of capabilities which is forced upon users. This is no proposal, or experiment. It's a force-push attempt.

judge2020 3y ago
There were proposals for protecting against this in the WEI explainer under "Open Questions" https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#open-questions https://github.com/RupertBenWiser/Web-Environment-Integrity/...
- bayindirh 3y ago
  I skimmed the link you provided, thanks. It looks like they propose to mix false signals to prevent this from being abused, but oh. That's easy to bypass. Require two attestations back to back to see whether they differ, or put up a page saying, "can you please try again?" The open question is circling around the question, can we make it work in a way, such that it doesn't work for bad guys, but works for good guys. Mathematics & cryptography doesn't work like that. It doesn't discriminate. It levels everyone. It'll either become an iron fist or a Swiss Cheese. There can be no middle. This is maths.
  - wmf 3y ago
    We can't even agree on who the good guys and bad guys are. Is a bank bad for excluding certain browsers?
    - WarOnPrivacy 3y ago
      > We can't even agree on who the good guys and bad guys are. This is true. In these discussions of trust, my measurement of a bad actor is who is in a position to harm me and has a history of causing harm. High on my list are LEO and other government interests (fed,state,local).
    - pdonis 3y ago
      > Is a bank bad for excluding certain browsers? Yes, because it's stupid; they don't need to. The bank cares about correctly identifying who I am, not what client I am using. Nor do they exclude certain browsers because those browsers make it easier for a user to lie about who they are; they don't. Banks exclude certain browsers because their technically incompetent coders convinced their technically incompetent managers to do so.
      - pmontra 3y ago
        As someone wrote in one of the top comments, banks will use it because regulators will ask them to.
        pdonis 3y ago
        Yes, if it becomes a regulatory requirement. But it shouldn't.
    - xerox13ster 3y ago
      Yes. What about screen reading browsers? What about neurodivergent people who cannot function on an "approved" OS because of the inherent ways it manages, stores, and presents information? What if that OS has an ACID compliant browser capable of accessing the banks website if they didn't have remote attestation? What about the millions of people unable to afford to upgrade their hardware to Windows 11? Or that don't have TPM available and therefore can't use any other Windows version because 10 fell out of support, so they're running a Linux distro with an unapproved web browser?
- soraminazuki 3y ago
  Some people can't help bringing this up in every WEI-related thread only to be debunked each time. This very article graciously mentions it and explains why it's a non-solution. That "proposal" is doublethink in its purest form. WEI is a technology for restricting access to web services. But at the same time, it would try to prevent web service providers from doing exactly that?
minsc_and_boo 3y ago
Noob question: Can you do attestation with mobile web, or is it app only?
- pdonis 3y ago
  Sure, if your mobile device is only allowed to use "approved" web browsers. Which is one of the key harms to users that the proposed WEI standard will inflict.
politelemon 3y ago
Based on what you're saying though, it's already been forced on users through mobile devices. This is the next step in a series of steps which weren't argued against. It's not that we don't need this tech, is that we didn't need this tech and are making noise and it now.
- bayindirh 3y ago
  Putting boot signing and “OS integrity control” aside, current iteration of TPM devices are not this intrusive. They allow me to generate and/or store keys and do cryptographic things with these keys securely. They store my information locally, and if implemented right, this data can’t leave that chip. Even OS integrity check is done locally. You can’t ask arbitrary measurements out of it. WEI is different. Rules come from outside. Acceptable parameters are decided by another party. You have no pieces of the system in your possession. You are a Furby forced to tell something with the will of the attester through the filter tuned and configured elsewhere. I can disable TPM or force it to reset itself if I want to. Even Apple’s security processors can be wiped clean of your data. WEI is not like that.
  - WarOnPrivacy 3y ago
    Treating end-users as a threat is galling, given the crappy security all over the web - IOT, infrastructure (BGP,DNS), leaky S3 buckets, misconfigured government sites, etc.
- danShumway 3y ago
  The best time to have fought against this tech would have been when it got proposed on mobile devices. The second best time is now.

judge2020 3y ago

There were proposals for protecting against this in the WEI explainer under "Open Questions" https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#open-questions https://github.com/RupertBenWiser/Web-Environment-Integrity/...

bayindirh 3y ago
I skimmed the link you provided, thanks. It looks like they propose to mix false signals to prevent this from being abused, but oh. That's easy to bypass. Require two attestations back to back to see whether they differ, or put up a page saying, "can you please try again?" The open question is circling around the question, can we make it work in a way, such that it doesn't work for bad guys, but works for good guys. Mathematics & cryptography doesn't work like that. It doesn't discriminate. It levels everyone. It'll either become an iron fist or a Swiss Cheese. There can be no middle. This is maths.
- wmf 3y ago
  We can't even agree on who the good guys and bad guys are. Is a bank bad for excluding certain browsers?
  - WarOnPrivacy 3y ago
    > We can't even agree on who the good guys and bad guys are. This is true. In these discussions of trust, my measurement of a bad actor is who is in a position to harm me and has a history of causing harm. High on my list are LEO and other government interests (fed,state,local).
  - pdonis 3y ago
    > Is a bank bad for excluding certain browsers? Yes, because it's stupid; they don't need to. The bank cares about correctly identifying who I am, not what client I am using. Nor do they exclude certain browsers because those browsers make it easier for a user to lie about who they are; they don't. Banks exclude certain browsers because their technically incompetent coders convinced their technically incompetent managers to do so.
    - pmontra 3y ago
      As someone wrote in one of the top comments, banks will use it because regulators will ask them to.
      - pdonis 3y ago
        Yes, if it becomes a regulatory requirement. But it shouldn't.
  - xerox13ster 3y ago
    Yes. What about screen reading browsers? What about neurodivergent people who cannot function on an "approved" OS because of the inherent ways it manages, stores, and presents information? What if that OS has an ACID compliant browser capable of accessing the banks website if they didn't have remote attestation? What about the millions of people unable to afford to upgrade their hardware to Windows 11? Or that don't have TPM available and therefore can't use any other Windows version because 10 fell out of support, so they're running a Linux distro with an unapproved web browser?
soraminazuki 3y ago
Some people can't help bringing this up in every WEI-related thread only to be debunked each time. This very article graciously mentions it and explains why it's a non-solution. That "proposal" is doublethink in its purest form. WEI is a technology for restricting access to web services. But at the same time, it would try to prevent web service providers from doing exactly that?

minsc_and_boo 3y ago

Noob question: Can you do attestation with mobile web, or is it app only?

pdonis 3y ago
Sure, if your mobile device is only allowed to use "approved" web browsers. Which is one of the key harms to users that the proposed WEI standard will inflict.

politelemon 3y ago

Based on what you're saying though, it's already been forced on users through mobile devices. This is the next step in a series of steps which weren't argued against. It's not that we don't need this tech, is that we didn't need this tech and are making noise and it now.

bayindirh 3y ago
Putting boot signing and “OS integrity control” aside, current iteration of TPM devices are not this intrusive. They allow me to generate and/or store keys and do cryptographic things with these keys securely. They store my information locally, and if implemented right, this data can’t leave that chip. Even OS integrity check is done locally. You can’t ask arbitrary measurements out of it. WEI is different. Rules come from outside. Acceptable parameters are decided by another party. You have no pieces of the system in your possession. You are a Furby forced to tell something with the will of the attester through the filter tuned and configured elsewhere. I can disable TPM or force it to reset itself if I want to. Even Apple’s security processors can be wiped clean of your data. WEI is not like that.
- WarOnPrivacy 3y ago
  Treating end-users as a threat is galling, given the crappy security all over the web - IOT, infrastructure (BGP,DNS), leaky S3 buckets, misconfigured government sites, etc.
danShumway 3y ago
The best time to have fought against this tech would have been when it got proposed on mobile devices. The second best time is now.