4 ms·

Why? I don't know the name of anyone who worked on Private Access Tokens at Apple or Cloudflare. Likewise the developers who worked on the Secure Enclave, or th

Why? I don't know the name of anyone who worked on Private Access Tokens at Apple or Cloudflare. Likewise the developers who worked on the Secure Enclave, or the slow march Windows has taken to enforce TPM's. This was mostly a media/social media storm in a teacup. With bad press because its Google. Chromium is huge because its open source, so the bar is higher than Macos, Safari & Windows. But it didnt make this proposal much different/worse than any of the others that already exist and are enforced. At least we got some hilarious statements like "its not needed because bots identify themselves by their user agent!"

kccqzy 3y ago
The bad press is simply because Google has a bad PR team that does not do an adequate job to control its brand reputation. As simple as that. When other companies attempt this, at least the PR department does some damage control be it press releases or press conferences or whatnot. Google didn't.
jchw 3y ago
Private Access Tokens are bad too, but they were much more limited in scope based on their design. One of the design elements of WEI in its own words is that some use cases would only work if it could be required for all users. Meanwhile PAT is attestation but the scope is explicitly intended to be for fulfilling the role CAPTCHA does today... optionally. Nothing about extensions like adblock that I am aware of. The point was to put users on proxies at the same level as users on residential IPs. But is PAT good? Well no. It's bad for similar but ultimately different reasons. But until Chrome adopts it, it's just not scary. The health of the open web depends on not having different user agents being treated as second-class citizens. Not only that, but locking the internet behind CAPTCHAs and remote attestation to fight bots is bad because it will always be playing favorites to bots like Google's. Today, and in the past, we've already seen what it looks like when the Internet does this. But it's just not going to be an acceptable solution to bots. If the Internet of the future is a hellscape of big corps controlling literally everything that remains with cryptographically enforced adblock, Yes I'd happily see it burn down instead. I don't really care if other people would prefer that to nothing, because to me its a worthless future and a waste. Attestation is not a real option that's really on the table.

kccqzy 3y ago

The bad press is simply because Google has a bad PR team that does not do an adequate job to control its brand reputation. As simple as that. When other companies attempt this, at least the PR department does some damage control be it press releases or press conferences or whatnot. Google didn't.

jchw 3y ago

Private Access Tokens are bad too, but they were much more limited in scope based on their design. One of the design elements of WEI in its own words is that some use cases would only work if it could be required for all users. Meanwhile PAT is attestation but the scope is explicitly intended to be for fulfilling the role CAPTCHA does today... optionally. Nothing about extensions like adblock that I am aware of. The point was to put users on proxies at the same level as users on residential IPs. But is PAT good? Well no. It's bad for similar but ultimately different reasons. But until Chrome adopts it, it's just not scary. The health of the open web depends on not having different user agents being treated as second-class citizens. Not only that, but locking the internet behind CAPTCHAs and remote attestation to fight bots is bad because it will always be playing favorites to bots like Google's. Today, and in the past, we've already seen what it looks like when the Internet does this. But it's just not going to be an acceptable solution to bots. If the Internet of the future is a hellscape of big corps controlling literally everything that remains with cryptographically enforced adblock, Yes I'd happily see it burn down instead. I don't really care if other people would prefer that to nothing, because to me its a worthless future and a waste. Attestation is not a real option that's really on the table.