10 ms·

Think of it as a way for Google coercing websites into implementing WEI. Any site can be marked as insecure if it doesn't block non wei compliant devices. You

by devsda 3y ago

Think of it as a way for Google coercing websites into implementing WEI. Any site can be marked as insecure if it doesn't block non wei compliant devices. You may ask why does that make a website insecure? They can give any number of reasons that can be silly, made up or outright lies as long as they are able to convince larger public. For example, they can claim that a site that allows shady(read wei non-compliant) clients is more susceptible to hacking and can be a threat to your data and your devices as well. Therefore it is insecure. This may come across as silly to techies, but it can sound reasonable to people who don't understand the web in general.

jsnell 3y ago
> Think of it as a way for Google coercing websites into implementing WEI. And why exactly do you think they'd want to do that? What do they gain from it? What do you even think the WEI is that you think this motivation makes the tiniest bit of sense?
- devsda 3y ago
  > What do you even think the WEI is that you think this motivation makes the tiniest bit of sense? First let me add some snippets on what the authors of WEI think can be gained from it: * This is beneficial for anti-fraud measures. Websites commonly use fingerprinting techniques to try to verify that a real human is using a real device[1] One of the proposed use cases: Detect non-human traffic in advertising to improve user experience and access to web content* [2] Another snippet : we could standardize the set of signals that browsers will receive from attesters, and have one of those signals be whether the attester recommends the browser for sites to trust (based on a well-defined acceptance criteria). As new browsers are introduced, they would need to demonstrate to attesters (a relatively small group) that they pass the bar, but they wouldn't need to convince all the websites in the world [2] This is clearly an attempt at gatekeeping both web client software and the clients themselves. > What do they gain from it? I think we can agree that Google is primarily an advertising and search company. One of the threats to Google's revenue as an advertising company is ad-fraud and this 'anti-fraud' measures protect their bottom-line. Another threat is ad-blocking and though they don't explicitly mention it, the WEI "bar" mentioned above can potentially be used to prevent ad-blocking by denying attestation to clients capable of ad-blocking (either directly or by allowing plugins). Client attestation also prevents bots(both good & bad bots of all types including new search indexing bots) from accessing websites. This has a nice side-effect for Google that it restricts building a new search engine(a competitor) without its blessing. Search is a gateway to Google's advertising. > And why exactly do you think they'd want to do that? Like any product that any company introduces, it is to drive adoption? The more websites use it, the more normalized and legitimate WEI becomes. Once it becomes a standard and an integral part of web, it is easier to dictate terms that keep their position entrenched. We can argue whether ad-blocking or bots are good or not and whether these concerns are all pure speculation or hyperbole. But once the technical capability is there and it is only the ethical/moral belief of corporate executives( and probability of government intervention) that prevent it, I wouldn't trust them to do the right thing especially when money is involved. [1] - https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_kGO22g/m/XCAIgPtxAQAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_... [2] - https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/...
  - jsnell 3y ago
    Ok, so I think below are the only parts of your reply relevant to the "force every website to implement it" idea: > Client attestation also prevents bots(both good & bad bots of all types including new search indexing bots) from accessing websites. This has a nice side-effect for Google that it restricts building a new search engine(a competitor) without its blessing. Search is a gateway to Google's advertising. Um, no. Let's imagine a world where Chrome starts warning about "websites that don't support WEI". What does that actually mean? At most it'd mean warning about websites that don't request an attestation. It cannot possibly be a warning about how the website uses the attestation, or whether it even uses it. So in this world where you imagine that Google Search can attest that a request is coming from their crawler, and every site in the world has been strongarmed into requesting an attestation by the mustache-twirling villains at Chrome, nothing about crawlability by smaller search engines has changed. Other search engines can provide their own attestations, and the sites can choose whether to trust them. Websites can choose to ignore the attestations entirely. > Like any product that any company introduces, it is to drive adoption? The more websites use it, the more normalized and legitimate WEI becomes. Normalized and legitimate in whose view? Why do they need that legitimacy? It's normally an invisible feature to the users. If it ships in Chrome and is available for Google to use for protecting their own properties against abuse, that's all they really need. They want to make the mechanism available for other sites and other browsers, but not because that third-party adoption is particularly important. The reality is, anyone with an anti-abuse problem will be delighted to have this signal available, especially as the browser fingerprinting surface will keep shrinking over the next few years. There will be no need to coerce sites to use the API. It's just a really stupid idea. High visiblity, absurdily high risk of a backlash (having it be a security warning would be obviously untrue), and all for literally no rewards. I will happily take a bet at 100:1 odds that this prediction will not become true. It will not happen by 2027 like the author thinks. It will not happen by 2033. And if that's really the most realistic threat to digital freedom that you can envision, we're in a pretty good shape.
b3orn 3y ago
Any random website can implement WEI, using it as a means to deem a website "safe" doesn't make much sense. You could use a list of "trusted" domains for that to mark websites as "safe". WEI's intention/threat is to kill smaller browsers that refuse to implement it.

by devsda 3y ago

jsnell 3y ago

> Think of it as a way for Google coercing websites into implementing WEI. And why exactly do you think they'd want to do that? What do they gain from it? What do you even think the WEI is that you think this motivation makes the tiniest bit of sense?

devsda 3y ago
> What do you even think the WEI is that you think this motivation makes the tiniest bit of sense? First let me add some snippets on what the authors of WEI think can be gained from it: * This is beneficial for anti-fraud measures. Websites commonly use fingerprinting techniques to try to verify that a real human is using a real device[1] One of the proposed use cases: Detect non-human traffic in advertising to improve user experience and access to web content* [2] Another snippet : we could standardize the set of signals that browsers will receive from attesters, and have one of those signals be whether the attester recommends the browser for sites to trust (based on a well-defined acceptance criteria). As new browsers are introduced, they would need to demonstrate to attesters (a relatively small group) that they pass the bar, but they wouldn't need to convince all the websites in the world [2] This is clearly an attempt at gatekeeping both web client software and the clients themselves. > What do they gain from it? I think we can agree that Google is primarily an advertising and search company. One of the threats to Google's revenue as an advertising company is ad-fraud and this 'anti-fraud' measures protect their bottom-line. Another threat is ad-blocking and though they don't explicitly mention it, the WEI "bar" mentioned above can potentially be used to prevent ad-blocking by denying attestation to clients capable of ad-blocking (either directly or by allowing plugins). Client attestation also prevents bots(both good & bad bots of all types including new search indexing bots) from accessing websites. This has a nice side-effect for Google that it restricts building a new search engine(a competitor) without its blessing. Search is a gateway to Google's advertising. > And why exactly do you think they'd want to do that? Like any product that any company introduces, it is to drive adoption? The more websites use it, the more normalized and legitimate WEI becomes. Once it becomes a standard and an integral part of web, it is easier to dictate terms that keep their position entrenched. We can argue whether ad-blocking or bots are good or not and whether these concerns are all pure speculation or hyperbole. But once the technical capability is there and it is only the ethical/moral belief of corporate executives( and probability of government intervention) that prevent it, I wouldn't trust them to do the right thing especially when money is involved. [1] - https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_kGO22g/m/XCAIgPtxAQAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_... [2] - https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/...
- jsnell 3y ago
  Ok, so I think below are the only parts of your reply relevant to the "force every website to implement it" idea: > Client attestation also prevents bots(both good & bad bots of all types including new search indexing bots) from accessing websites. This has a nice side-effect for Google that it restricts building a new search engine(a competitor) without its blessing. Search is a gateway to Google's advertising. Um, no. Let's imagine a world where Chrome starts warning about "websites that don't support WEI". What does that actually mean? At most it'd mean warning about websites that don't request an attestation. It cannot possibly be a warning about how the website uses the attestation, or whether it even uses it. So in this world where you imagine that Google Search can attest that a request is coming from their crawler, and every site in the world has been strongarmed into requesting an attestation by the mustache-twirling villains at Chrome, nothing about crawlability by smaller search engines has changed. Other search engines can provide their own attestations, and the sites can choose whether to trust them. Websites can choose to ignore the attestations entirely. > Like any product that any company introduces, it is to drive adoption? The more websites use it, the more normalized and legitimate WEI becomes. Normalized and legitimate in whose view? Why do they need that legitimacy? It's normally an invisible feature to the users. If it ships in Chrome and is available for Google to use for protecting their own properties against abuse, that's all they really need. They want to make the mechanism available for other sites and other browsers, but not because that third-party adoption is particularly important. The reality is, anyone with an anti-abuse problem will be delighted to have this signal available, especially as the browser fingerprinting surface will keep shrinking over the next few years. There will be no need to coerce sites to use the API. It's just a really stupid idea. High visiblity, absurdily high risk of a backlash (having it be a security warning would be obviously untrue), and all for literally no rewards. I will happily take a bet at 100:1 odds that this prediction will not become true. It will not happen by 2027 like the author thinks. It will not happen by 2033. And if that's really the most realistic threat to digital freedom that you can envision, we're in a pretty good shape.

b3orn 3y ago

Any random website can implement WEI, using it as a means to deem a website "safe" doesn't make much sense. You could use a list of "trusted" domains for that to mark websites as "safe". WEI's intention/threat is to kill smaller browsers that refuse to implement it.