3 ms·

Apple have already been shipping an equivalent attestation mechanism in Safari for a year.

by jsnell 3y ago

DaiPlusPlus 3y ago
Safari's support for WebAuthn does not include support for "direct attestation", if that's what you're referring to. EDIT: Or do you mean "Private Access Tokens"? I just found out about this now and wow... looks like I've got some reading to do, but so-far it seems far more limited in scope than Google's version, and doesn't seem like it can be used to fingerprint visitors between sessions either. ( https://httptoolkit.com/blog/apple-private-access-tokens-attestation/ https://httptoolkit.com/blog/apple-private-access-tokens-att... )
- jsnell 3y ago
  I indeed mean PATs. They are not more limited than WEI in any meaningful way. Both could in principle attest anything. Both claim they are meant to attest only certain kinds of properties. They would be just as useful (or useless) for fingerprinting.
tw061023 3y ago
Apple doesn't have a monopoly on the web ad market, and thus this is kind of irrelevant - they aren't forcing this down everyone's throat. Though I cannot help but wonder why exactly they did that. Some kind of a corporate requirement?
- jsnell 3y ago
  So, first of all, the entire point of the GP was that Apple would be slow to implement this. Clearly that is not true. But also JFC, it is amazing how the moment it is pointed out that Apple is already doing a thing that's being railing at, and the reaction shifts from outrage to basically "I wonder what amazing and important reason they have for doing this" and "nobody but Apple can possibly be allowed to benefit from this because monopoly". Apple's stated reason is exactly the same as Google's. To make a privacy-preserving anti-abuse signal for browsers. Apple need it because they are piping their best customers' traffic into what is basically an open sewer of IP reputation (Apple Private Relay), and need a way to avoid said customers giving up in disgust due to the high rate of captchas. Google need it because they want to remove all fingerprinting vectors, and need privacy-preserving replacements for legit use cases.
  - tw061023 3y ago
    > basically "I wonder what amazing and important reason they have for doing this" That's not what I said. I don't care who does this, I will despise it either way, I just hope that Apple at least has a proper justification to do this. > Google need it because they want to remove all fingerprinting vectors, and need privacy-preserving replacements for legit use cases "Legit" defined by whom? Google? I am sorry but at this point Google has burned almost all trust, at least with me.
    - surajrmal 3y ago
      Putting your head in the sand and making assumptions doesn't lead to good outcomes. If you can't find the time to understand what is being discussed, perhaps it is better to simply not offer an opinion on the matter. Opinions based on assumptions are dangerous.

Apple have already been shipping an equivalent attestation mechanism in Safari for a year.

by jsnell 3y ago

Apple have already been shipping an equivalent attestation mechanism in Safari for a year.

Safari's support for WebAuthn does not include support for "direct attestation", if that's what you're referring to. EDIT: Or do you mean "Private Access Tokens"? I just found out about this now and wow... looks like I've got some reading to do, but so-far it seems far more limited in scope than Google's version, and doesn't seem like it can be used to fingerprint visitors between sessions either. ( https://httptoolkit.com/blog/apple-private-access-tokens-attestation/ https://httptoolkit.com/blog/apple-private-access-tokens-att... )

jsnell 3y ago
I indeed mean PATs. They are not more limited than WEI in any meaningful way. Both could in principle attest anything. Both claim they are meant to attest only certain kinds of properties. They would be just as useful (or useless) for fingerprinting.

tw061023 3y ago

Apple doesn't have a monopoly on the web ad market, and thus this is kind of irrelevant - they aren't forcing this down everyone's throat. Though I cannot help but wonder why exactly they did that. Some kind of a corporate requirement?

jsnell 3y ago
So, first of all, the entire point of the GP was that Apple would be slow to implement this. Clearly that is not true. But also JFC, it is amazing how the moment it is pointed out that Apple is already doing a thing that's being railing at, and the reaction shifts from outrage to basically "I wonder what amazing and important reason they have for doing this" and "nobody but Apple can possibly be allowed to benefit from this because monopoly". Apple's stated reason is exactly the same as Google's. To make a privacy-preserving anti-abuse signal for browsers. Apple need it because they are piping their best customers' traffic into what is basically an open sewer of IP reputation (Apple Private Relay), and need a way to avoid said customers giving up in disgust due to the high rate of captchas. Google need it because they want to remove all fingerprinting vectors, and need privacy-preserving replacements for legit use cases.
- tw061023 3y ago
  > basically "I wonder what amazing and important reason they have for doing this" That's not what I said. I don't care who does this, I will despise it either way, I just hope that Apple at least has a proper justification to do this. > Google need it because they want to remove all fingerprinting vectors, and need privacy-preserving replacements for legit use cases "Legit" defined by whom? Google? I am sorry but at this point Google has burned almost all trust, at least with me.
  - surajrmal 3y ago
    Putting your head in the sand and making assumptions doesn't lead to good outcomes. If you can't find the time to understand what is being discussed, perhaps it is better to simply not offer an opinion on the matter. Opinions based on assumptions are dangerous.