5 ms·

The WEI discourse is just getting comical. it may be bad for the open internet, or for the browser ecosystem. but it's not a security flaw. to say you don't

The WEI discourse is just getting comical. it may be bad for the open internet, or for the browser ecosystem. but it's not a security flaw. to say you don't trust google to be part of any security efforts because they tried to put security in a place you don't want it is silly. you're arguing the slippery slope fallacy here, there's no reason to think that carriers would even want any sort of device attestation, or be legally allowed to do that under the terms of their spectrum licenses.

LightHugger 3y ago
Of course it's a security flaw, but it's a security flaw for the end user, not google. It's google's security, like them putting their own lock on your door that they can a remotely activate on a whim. This is what most humans would call a security flaw, but it's a non traditional one for sure.
- fauigerzigerk 3y ago
  I guess security is only ever defined with respect to specific security threats. There are quite a few of those "dual use" features where you have a primary purpose of protecting some oligopolist's business model but the incidental side-effects range from beneficial to catastrophic in terms of security for users. Take Apple's side-loading ban for instance. It makes obvious sense for Apple's own interests. Beyond this primary purpose, it protects people against getting tricked into installing malware but it also poses a threat to human rights and freedom of speech as it gives whoever is in power central control over the software people can use to protect themselves. Google's WEI is another such dual use technology that can be portrayed in many different ways, because it really does have different consequences for different people at different times.
jchw 3y ago
? I didn't say it's a security flaw. The problem is that it's a terrible, user-hostile, open-web-hostile approach to security that shouldn't have even been proposed. >there's no reason to think that carriers would even want any sort of device attestation With the bargaining power that Google has in the mobile space, I strongly suspect they could find a way to entice carriers into moving towards enforcing device attestation. And I don't just mean forcing devices to attest; I mean things like, Hmmm, are you sure you want these untrusted Android devices on your RCS services? > or be legally allowed to do that under the terms of their spectrum licenses. I don't really like relying on hoping the laws will help, but it would be nice to know for sure if they do. Unfortunately, I am assuming you aren't actually positive. Google Fi definitely favors Google devices heavily and there is no supported way to use a non-data-only device without an Android phone with GMS.
- meragrin_ 3y ago
  > ? I didn't say it's a security flaw. Nobody said you did. Normally, crummy security(security flaws) is what disqualifies someone from security and not functioning security. You're comment implied WEI would work as imagined and you remarked that should disqualify Google from security. That's a bit ass-backwards, disqualifying someone because they didn't introduce security flaws. > The problem is that it's a terrible, user-hostile, open-web-hostile approach to security that shouldn't have even been proposed. But it isn't a security flaw. And no, it isn't a terrible, user-hostile, open-web-hostile approach to security. It's just a gleam in someone's eye who's stated goal is to not create something which is a terrible, user-hostile, open-web-hostile security approach but some additional signal which websites can try to use to filter out malicious traffic. Why do WEI critics always come off as sounding like the "think of children" anti-encryption fear mongers? At least wait until it becomes something first. > With the bargaining power that Google has in the mobile space, I strongly suspect they could find a way to entice carriers into moving towards enforcing device attestation. And I don't just mean forcing devices to attest; I mean things like, Hmmm, are you sure you want these untrusted Android devices on your RCS services? With the bargaining power that Apple has in the mobile space, I strongly suspect carriers can tell Google to pound sand. Unless Google is implementing something Apple has already, I doubt that will happen.
  - nprateem 3y ago
    At least wait until the bank robbers have spent their loot before calling the police, because they might be just about to bring it back.
  - jchw 3y ago
    I don't understand why you think the literal only way a security standard can be bad is if it has a literal security flaw. What Google is doing is bad for reasons other than security flaws, but it's no different from the other reasons why Google being involved in standards other than security standards is bad. It's just that in this case, their evil, user-hostile mechanism has absolutely no reasonable use case outside of security. Yes, developing bad, user-hostile, open-ecosystem-hostile security standards should indeed bar you from security standards work even if the prison you've built for end users is maximally secure.

LightHugger 3y ago

Of course it's a security flaw, but it's a security flaw for the end user, not google. It's google's security, like them putting their own lock on your door that they can a remotely activate on a whim. This is what most humans would call a security flaw, but it's a non traditional one for sure.

fauigerzigerk 3y ago
I guess security is only ever defined with respect to specific security threats. There are quite a few of those "dual use" features where you have a primary purpose of protecting some oligopolist's business model but the incidental side-effects range from beneficial to catastrophic in terms of security for users. Take Apple's side-loading ban for instance. It makes obvious sense for Apple's own interests. Beyond this primary purpose, it protects people against getting tricked into installing malware but it also poses a threat to human rights and freedom of speech as it gives whoever is in power central control over the software people can use to protect themselves. Google's WEI is another such dual use technology that can be portrayed in many different ways, because it really does have different consequences for different people at different times.

jchw 3y ago

? I didn't say it's a security flaw. The problem is that it's a terrible, user-hostile, open-web-hostile approach to security that shouldn't have even been proposed. >there's no reason to think that carriers would even want any sort of device attestation With the bargaining power that Google has in the mobile space, I strongly suspect they could find a way to entice carriers into moving towards enforcing device attestation. And I don't just mean forcing devices to attest; I mean things like, Hmmm, are you sure you want these untrusted Android devices on your RCS services? > or be legally allowed to do that under the terms of their spectrum licenses. I don't really like relying on hoping the laws will help, but it would be nice to know for sure if they do. Unfortunately, I am assuming you aren't actually positive. Google Fi definitely favors Google devices heavily and there is no supported way to use a non-data-only device without an Android phone with GMS.

meragrin_ 3y ago
> ? I didn't say it's a security flaw. Nobody said you did. Normally, crummy security(security flaws) is what disqualifies someone from security and not functioning security. You're comment implied WEI would work as imagined and you remarked that should disqualify Google from security. That's a bit ass-backwards, disqualifying someone because they didn't introduce security flaws. > The problem is that it's a terrible, user-hostile, open-web-hostile approach to security that shouldn't have even been proposed. But it isn't a security flaw. And no, it isn't a terrible, user-hostile, open-web-hostile approach to security. It's just a gleam in someone's eye who's stated goal is to not create something which is a terrible, user-hostile, open-web-hostile security approach but some additional signal which websites can try to use to filter out malicious traffic. Why do WEI critics always come off as sounding like the "think of children" anti-encryption fear mongers? At least wait until it becomes something first. > With the bargaining power that Google has in the mobile space, I strongly suspect they could find a way to entice carriers into moving towards enforcing device attestation. And I don't just mean forcing devices to attest; I mean things like, Hmmm, are you sure you want these untrusted Android devices on your RCS services? With the bargaining power that Apple has in the mobile space, I strongly suspect carriers can tell Google to pound sand. Unless Google is implementing something Apple has already, I doubt that will happen.
- nprateem 3y ago
  At least wait until the bank robbers have spent their loot before calling the police, because they might be just about to bring it back.
- jchw 3y ago
  I don't understand why you think the literal only way a security standard can be bad is if it has a literal security flaw. What Google is doing is bad for reasons other than security flaws, but it's no different from the other reasons why Google being involved in standards other than security standards is bad. It's just that in this case, their evil, user-hostile mechanism has absolutely no reasonable use case outside of security. Yes, developing bad, user-hostile, open-ecosystem-hostile security standards should indeed bar you from security standards work even if the prison you've built for end users is maximally secure.