3 ms·

The security engineer in me loved this proposal, the privacy/FOSS enthusiast in me hated it.

by xvector 3y ago

rightbyte 3y ago
I read the proposal to be a way for sites to execute a hash function on my ram? It sounds like a security nightmare.
- hurryer 3y ago
  It could ensure that an employee laptop is not infected when connecting to the intranet which could prevent customer data leakage which would be a benefit for all of us.
  - rightbyte 3y ago
    Such a scan would take like half an hour. You need to scan each unloaded executable. WEI won't be used for that. It will be used for blocking ad blockers and ensure Google's malware is active. I am quite sure that the client programs need to be cooperating for the WEI to be practical.
  - drtgh 3y ago
    It would not ensure the laptop is not infected. It would only ensure that the laptop user does not run software that is not approved by Google or similar, a DRM, as Trojans will continue to find ways to disguise themselves and insert themselves into authorized processes. The company would find difficult to run custom software not covered by such DRM. In time, the Web Environment Integrity API organisation would say that there are too many authorisation requests or similar and demand economic compensation from developers to be included in the authorized filter scans, at time the supposed initial objective is not accomplished, as this DRM does not ensure the laptop is not infected.
    - hurryer 3y ago
      In was speaking in general about remote attestation, not about the Chrome only one. A good example is Xbox, for which there is no known custom software, which in turn guarantees the lack of cheating software.
- gruez 3y ago
  I'm not sure how you got that impression. Attestation doesn't require any sort of scans on your current memory content, only the hash of the code that was executed. https://en.wikipedia.org/wiki/Trusted_Computing#Remote_attestation https://en.wikipedia.org/wiki/Trusted_Computing#Remote_attes...
  - rightbyte 3y ago
    And for us that do not run Harvard architecture computers? https://en.m.wikipedia.org/wiki/Harvard_architecture https://en.m.wikipedia.org/wiki/Harvard_architecture
knaidofngio 3y ago
It seems to me like most security engineers have a strange view of security. They seem to take an abstract view of security as enforcing certain invariants in a system, but have no problem with exploiting other systems or abusing human beings. Google will gladly exploit my system, coming up with ever-more-nefarious ways of making it disclose my private information and trying to limit what software I'm able to run. Yet they employ myriad security engineers and have the ability to dictate de-facto standards for the security of the web. How is it that their "Project Zero" can speak at a conference without getting booed out of the room?
- xvector 3y ago
  > but have no problem with exploiting other systems or abusing human beings. Security is about making sure that something happen via a certain path, without things going wrong in ways that can be abused. Web Integrity effectively enables a way for, say, a bank to validate that the request isn't coming from botnet VMs spun up in the cloud, but rather an actual device with an actual human behind it. In fact, many websites already try to accomplish this with fingerprinting, which is why certain browsers and VPNs are already effectively blocked from the web. Yes, it has the effect of limiting your freedom and privacy, but there is a definite security gain here that will lower the likelihood of account compromise. Security != privacy; and security != freedom. Often there's a tradeoff. Security engineers are employed by their company to increase security - not freedom, and not privacy (unless mandated by regulation), hence the bias you typically see from them.

The security engineer in me loved this proposal, the privacy/FOSS enthusiast in me hated it.

rightbyte 3y ago

I read the proposal to be a way for sites to execute a hash function on my ram? It sounds like a security nightmare.

hurryer 3y ago
It could ensure that an employee laptop is not infected when connecting to the intranet which could prevent customer data leakage which would be a benefit for all of us.
- rightbyte 3y ago
  Such a scan would take like half an hour. You need to scan each unloaded executable. WEI won't be used for that. It will be used for blocking ad blockers and ensure Google's malware is active. I am quite sure that the client programs need to be cooperating for the WEI to be practical.
- drtgh 3y ago
  It would not ensure the laptop is not infected. It would only ensure that the laptop user does not run software that is not approved by Google or similar, a DRM, as Trojans will continue to find ways to disguise themselves and insert themselves into authorized processes. The company would find difficult to run custom software not covered by such DRM. In time, the Web Environment Integrity API organisation would say that there are too many authorisation requests or similar and demand economic compensation from developers to be included in the authorized filter scans, at time the supposed initial objective is not accomplished, as this DRM does not ensure the laptop is not infected.
  - hurryer 3y ago
    In was speaking in general about remote attestation, not about the Chrome only one. A good example is Xbox, for which there is no known custom software, which in turn guarantees the lack of cheating software.
gruez 3y ago
I'm not sure how you got that impression. Attestation doesn't require any sort of scans on your current memory content, only the hash of the code that was executed. https://en.wikipedia.org/wiki/Trusted_Computing#Remote_attestation https://en.wikipedia.org/wiki/Trusted_Computing#Remote_attes...
- rightbyte 3y ago
  And for us that do not run Harvard architecture computers? https://en.m.wikipedia.org/wiki/Harvard_architecture https://en.m.wikipedia.org/wiki/Harvard_architecture

knaidofngio 3y ago

It seems to me like most security engineers have a strange view of security. They seem to take an abstract view of security as enforcing certain invariants in a system, but have no problem with exploiting other systems or abusing human beings. Google will gladly exploit my system, coming up with ever-more-nefarious ways of making it disclose my private information and trying to limit what software I'm able to run. Yet they employ myriad security engineers and have the ability to dictate de-facto standards for the security of the web. How is it that their "Project Zero" can speak at a conference without getting booed out of the room?

xvector 3y ago
> but have no problem with exploiting other systems or abusing human beings. Security is about making sure that something happen via a certain path, without things going wrong in ways that can be abused. Web Integrity effectively enables a way for, say, a bank to validate that the request isn't coming from botnet VMs spun up in the cloud, but rather an actual device with an actual human behind it. In fact, many websites already try to accomplish this with fingerprinting, which is why certain browsers and VPNs are already effectively blocked from the web. Yes, it has the effect of limiting your freedom and privacy, but there is a definite security gain here that will lower the likelihood of account compromise. Security != privacy; and security != freedom. Often there's a tradeoff. Security engineers are employed by their company to increase security - not freedom, and not privacy (unless mandated by regulation), hence the bias you typically see from them.