4 ms·

There are API’s that chrome provides that allows servers to validate whether the request came from an official chrome browser. That would detect that this curl

There are API’s that chrome provides that allows servers to validate whether the request came from an official chrome browser. That would detect that this curl isn’t really chrome. It’d be nice if something could support curl’s arguments but drive an actual headless chrome browser.

binarymax 2y ago
I’m interested in learning more about this. Are these APIs documented anywhere and are there server side implementation examples that you know of? EDIT: this is the closest I could find. https://developers.google.com/chrome/verified-access/overview https://developers.google.com/chrome/verified-access/overvie... ...but it's not generic enough to lead me to the declaration you made.
- KTibow 2y ago
  I think they confused Chrome and Googlebot.
bowmessage 2y ago
There’s no way this couldn’t be replicated by a special build of curl.
darrenf 2y ago
Are you referring to the Web Environment Integrity[0] stuff, or something else? 'cos WEI was abandoned in late 2023. [0] https://github.com/explainers-by-googlers/Web-Environment-Integrity/ https://github.com/explainers-by-googlers/Web-Environment-In...
do_not_redeem 2y ago
Siblings are being more charitable about this, but I just don't think what you're suggesting is even possible. An HTTP client sends a request. The server sends a response. The request and response are made of bytes. Any bytes Chrome can send, curl-impersonate could also send. Chromium is open source. If there was some super secret handshake, anyone could copy that code to curl-impersonate. And if it's only in closed-source Chrome, someone will disassemble it and copy it over anyway.
- gruez 2y ago
  >Chromium is open source. If there was some super secret handshake, anyone could copy that code to curl-impersonate. And if it's only in closed-source Chrome, someone will disassemble it and copy it over anyway. Not if the "super secret handshake" is based on hardware-backed attestation.
  - do_not_redeem 2y ago
    True, but beside the point. GP claims the API can detect the official chrome browser, and the official chrome browser runs fine without attestation.
- dist-epoch 2y ago
  > someone will disassemble it and copy it over anyway. Not if Chrome uses homomorphic encryption to sign a challange. It's doable today. But then you could run a real Chrome and forward the request to it.
  - do_not_redeem 2y ago
    No, even homomorphic encryption wouldn't help. It doesn't matter how complicated the operation is, if you have a copy of the Chrome binary, you can observe what CPU instructions it uses to sign the challenge, and replicate the operations yourself. Proxying to a real Chrome is the most blunt approach, but there's nothing stopping you from disassembling the binary and copying the code to run in your own process, independent of Chrome.
    - dist-epoch 2y ago
      > you can observe what CPU instructions it uses to sign the challenge, and replicate the operations yourself. No you can't, that's the whole thing with homomorphic encryption. Ask GPT to explain it to you why it's so. You have no way of knowing the bounds of the code I will access from the inside the homomorphic code. Depending on the challenge I can query parts of the binary and hash that in the response. So you will need to replicate the whole binary. Similar techniques are already used today by various copy-protection/anti-cheat game protectors. Most of them remain unbroken.

binarymax 2y ago

I’m interested in learning more about this. Are these APIs documented anywhere and are there server side implementation examples that you know of? EDIT: this is the closest I could find. https://developers.google.com/chrome/verified-access/overview https://developers.google.com/chrome/verified-access/overvie... ...but it's not generic enough to lead me to the declaration you made.

KTibow 2y ago
I think they confused Chrome and Googlebot.

bowmessage 2y ago

There’s no way this couldn’t be replicated by a special build of curl.

darrenf 2y ago

Are you referring to the Web Environment Integrity[0] stuff, or something else? 'cos WEI was abandoned in late 2023. [0] https://github.com/explainers-by-googlers/Web-Environment-Integrity/ https://github.com/explainers-by-googlers/Web-Environment-In...

do_not_redeem 2y ago

Siblings are being more charitable about this, but I just don't think what you're suggesting is even possible. An HTTP client sends a request. The server sends a response. The request and response are made of bytes. Any bytes Chrome can send, curl-impersonate could also send. Chromium is open source. If there was some super secret handshake, anyone could copy that code to curl-impersonate. And if it's only in closed-source Chrome, someone will disassemble it and copy it over anyway.

gruez 2y ago
>Chromium is open source. If there was some super secret handshake, anyone could copy that code to curl-impersonate. And if it's only in closed-source Chrome, someone will disassemble it and copy it over anyway. Not if the "super secret handshake" is based on hardware-backed attestation.
- do_not_redeem 2y ago
  True, but beside the point. GP claims the API can detect the official chrome browser, and the official chrome browser runs fine without attestation.
dist-epoch 2y ago
> someone will disassemble it and copy it over anyway. Not if Chrome uses homomorphic encryption to sign a challange. It's doable today. But then you could run a real Chrome and forward the request to it.
- do_not_redeem 2y ago
  No, even homomorphic encryption wouldn't help. It doesn't matter how complicated the operation is, if you have a copy of the Chrome binary, you can observe what CPU instructions it uses to sign the challenge, and replicate the operations yourself. Proxying to a real Chrome is the most blunt approach, but there's nothing stopping you from disassembling the binary and copying the code to run in your own process, independent of Chrome.
  - dist-epoch 2y ago
    > you can observe what CPU instructions it uses to sign the challenge, and replicate the operations yourself. No you can't, that's the whole thing with homomorphic encryption. Ask GPT to explain it to you why it's so. You have no way of knowing the bounds of the code I will access from the inside the homomorphic code. Depending on the challenge I can query parts of the binary and hash that in the response. So you will need to replicate the whole binary. Similar techniques are already used today by various copy-protection/anti-cheat game protectors. Most of them remain unbroken.