3 ms·

> An attestation taken does not contain information about the device that can be used to identify since the data the site gets is low entropy. Citation needed

> An attestation taken does not contain information about the device that can be used to identify since the data the site gets is low entropy. Citation needed, how does WEI make it _impossible_ for attesters to return higher entropy information? Pinkie promises are insufficient. > WEI doesn't stop you from changing your user agent False, this is an explicit design goal: "Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device." > nor does it prevent you from using your privacy web extentions Not an explicit goal, but a very obvious next step with strong economic incentives. > Physical handcuffs would be very intrusive, but that isn't what is happening here. Seeing a message that says "Sorry, this website is only accessible by browsers that support WEI" is very intrusive. > WEI doesn't prevent you from participating in the web or needing to meet someone else's specification. You can even make an attestation service for your own browser. Categorically false, no website is going to trust your attestation service. This is equivalent to saying "Just create your own CA". > I disagree that beivg a to lie about what your device is running in a building block of all civil rights because the physical analog, fraud, is illegal, and the world seems better without people commuting fraud to one another. No, the physical analog is "lying", which isn't illegal in most situations, and required in some - such as when a stalker asks you where you live.

charcircuit 3y ago
>how does WEI make it _impossible_ for attesters to return higher entropy information? It isn't impossible, but doing so would violate users privacy which isn't the goal of the proposal. You don't need WEI to violate people's privacy. >False, this is an explicit design goal: "Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device." That statement means that the site would learn that for example the server can trust that the user is using Chrome on windows. A feature of Chrome is that it's possible to spoof your user agent. >Seeing a message that says "Sorry, this website is only accessible by browsers that support WEI" is very intrusive. This can apply to anyone API. It's happened for WebGPU. It's blocking users is not a goal of the API. >no website is going to trust your attestation service. This is equivalent to saying "Just create your own CA". It is possible to create your own CA. How do you think things like Lets Encrypt came into existence. Trust is hard to earn. That doesn't mean that it is impossible to get people to trust you. >No, the physical analog is "lying", which isn't illegal in most situations I agree, but WEI is meant to be used in situations where lying should be illegal.
- zb3 3y ago
  > but WEI is meant to be used in situations where lying should be illegal. But here I once again have to point out that in practice this will look very different. The practical effect is that if someone installs LineageOS or even AOSP to get rid of Google spyware and preinstalled bloatware, then these attestation checks will fail and that user will not be able to use apps that are necessary in practice. The question is whether this is really a "side effect" or just the actual goal.
  - hot_gril 3y ago
    The actual goal is probably that Google and others prevent ad-blocking. WEI itself is not meant as a fingerprint, but with unblockable ads comes unblockable tracking (not that I personally care about tracking). Like, look at YouTube on iPhones, they blocked background playback in the app and even got Apple to block it in Safari in iOS update 10. They don't need WEI to keep the vast majority of users away from obscure alternative OSes, but as a side effect those would be impacted.
    - charcircuit 3y ago
      YouTube contractually must pay extra when people play music in the background. It's why it's a premium only feature.
      - hot_gril 3y ago
        Right, and they'll want to enforce things like this on desktop too.

charcircuit 3y ago

>how does WEI make it _impossible_ for attesters to return higher entropy information? It isn't impossible, but doing so would violate users privacy which isn't the goal of the proposal. You don't need WEI to violate people's privacy. >False, this is an explicit design goal: "Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device." That statement means that the site would learn that for example the server can trust that the user is using Chrome on windows. A feature of Chrome is that it's possible to spoof your user agent. >Seeing a message that says "Sorry, this website is only accessible by browsers that support WEI" is very intrusive. This can apply to anyone API. It's happened for WebGPU. It's blocking users is not a goal of the API. >no website is going to trust your attestation service. This is equivalent to saying "Just create your own CA". It is possible to create your own CA. How do you think things like Lets Encrypt came into existence. Trust is hard to earn. That doesn't mean that it is impossible to get people to trust you. >No, the physical analog is "lying", which isn't illegal in most situations I agree, but WEI is meant to be used in situations where lying should be illegal.

zb3 3y ago
> but WEI is meant to be used in situations where lying should be illegal. But here I once again have to point out that in practice this will look very different. The practical effect is that if someone installs LineageOS or even AOSP to get rid of Google spyware and preinstalled bloatware, then these attestation checks will fail and that user will not be able to use apps that are necessary in practice. The question is whether this is really a "side effect" or just the actual goal.
- hot_gril 3y ago
  The actual goal is probably that Google and others prevent ad-blocking. WEI itself is not meant as a fingerprint, but with unblockable ads comes unblockable tracking (not that I personally care about tracking). Like, look at YouTube on iPhones, they blocked background playback in the app and even got Apple to block it in Safari in iOS update 10. They don't need WEI to keep the vast majority of users away from obscure alternative OSes, but as a side effect those would be impacted.
  - charcircuit 3y ago
    YouTube contractually must pay extra when people play music in the background. It's why it's a premium only feature.
    - hot_gril 3y ago
      Right, and they'll want to enforce things like this on desktop too.