...with Apple and Microsoft, Mutahar's turn to take a look at "Web Environment Integrity"
Yesterday I saw a meme on reddit about browsers and I did not see even one person mentioning this WEI shit. Everyone was praising Chrome. We are truly fucked.
So reddit is definetly being astrosurfed hard isnt it?
Always has been
"Turns around and disarms astronaut"
It's because people that are about FOSS, freedom and privacy have moved to lemmy already
I imagine some will change their minds as soon as ad blocking starts to fail.
One thing I don't understand about all of this WEI: can't we just use a user agent switcher / spoofer to 'look' like chrome or any other browser and OS to counter this?
This isn't about a user agent. In basic terms there is supposed to be some kind of software that attests that the browser is actually what it claims to be. On the other side, a server can trust this "attester" or not. So even if you wrote software that always attests what the browser claims to be, Netflix for example could say "nah, I don't trust you bro".
On Android this attestation would be done by the Google play services (afaik). On desktop, the OSs would need to implement this attestation.
Please someone correct me if I'm wrong on this.
While I haven't seen data to back this up, another Lemmy user called out that Intel chips may have support for running secure code the user cannot modify. The results are signed by an encryption key on the motherboard/CPU that cannot be extracted to fake the signature.
So let's say Chrome asks this hardware module to hash the executable code and some state for itself currently in RAM and sign it with Intel's private key on the motherboard/CPU. The "some state" portion ensures the hash is always unique. Maybe it is just a timestamp. Regardless, this helps the attestation server know Chrome has not been modified because the hash is unique and cannot simply be captured in flight once and then replayed/faked over and over like a user-agent string.
I have finally made the full conversion away from Google. Email, browser, search all out of their hands. The one that took the longest to happen was the browser. Firefox finally is working great for me now.
Email is tough one for me. Any recommendations? I tried Proton but their mobile app is (was?) disaster, and only limited to one logged in account at once which is a deal breaker for me.
Posteo or Runbox are good libre options. You have to rent however
zoho mail is what I use.
apple might oppose this to some point, they're often not in line with google.
The best way to oppose this is to use non-chromium browsers like Firefox and take away Google’s source of power: chromium market share
i agree, the problem is, that if google succeeds and (popular/mainstream) websites refuse to let said browsers access the sites, it's an uphill battle in wich we will eventually lose the normie webizens.
And there’s the core problem: the proportion of people on the internet who have no idea what they’re doing has grown by orders of magnitude, and big tech has realized they can just treat and exploit them like cattle, because almost nobody has a full and complete understanding of what’s going on, or how policies driven by big tech like this are catastrophically bad for normal users on the internet.
Apple only opposes Google when new browser capabilites like PWAs, Bluetooth API, NFC API,... might be a threat to the Appstore monopoly on iOS.
I think they are very much onboard with this since it you could potentially make live hell for Hackintosh and Jailbreak users.
i wouldn't be so sure about it. apple strongarmed google with jpgxl support and the european union pryed open their eco system, at least for eu citizens. apple currently positioning themselves on the side of privacy advocates would lose this standing (and many customers who switched to iphone because of it). i know, they could sugarcoat this, but i have a little hope left that they will draw a line on at least the most user hostile stuff.
Honestly my hope is still that the EU intervenes, which I consider to be around 50% given they’re a generally a bit of a mixed bag when it comes to regulations.
When Apple becomes my last hope, I’ll know times are bad. Having said that, it’s one of the parties that may actually oppose. The other big guy that may have some power in this, Microsoft, is probably more likely to adapt this catastrophe of an idea.
Apple already shipped attestation. It's in Safari in both desktop and mobile. Unfortunately. It's just going to take a couple big players to make this a blight everywhere. Netflix implementing this might do it. Google's main sites would work.
the EU can be really schizo when it comes to stuff like that, that's true. i don't trust them. and apple as a last hope ... well, maybe when it comes to big tech. can't think of anything better within the FAANG pantheon.
Apple loves control; the only reason I can think of that would make them oppose Google's Web Integrity proposal is that they don't think it goes far enough.
Or they'll come out with their own and try to be the dominant WEI code.
Yesterday I saw a meme on reddit about browsers and I did not see even one person mentioning this WEI shit. Everyone was praising Chrome. We are truly fucked.
So reddit is definetly being astrosurfed hard isnt it?
Always has been
"Turns around and disarms astronaut"
It's because people that are about FOSS, freedom and privacy have moved to lemmy already
I imagine some will change their minds as soon as ad blocking starts to fail.
One thing I don't understand about all of this WEI: can't we just use a user agent switcher / spoofer to 'look' like chrome or any other browser and OS to counter this?
This isn't about a user agent. In basic terms there is supposed to be some kind of software that attests that the browser is actually what it claims to be. On the other side, a server can trust this "attester" or not. So even if you wrote software that always attests what the browser claims to be, Netflix for example could say "nah, I don't trust you bro".
On Android this attestation would be done by the Google play services (afaik). On desktop, the OSs would need to implement this attestation.
Please someone correct me if I'm wrong on this.
While I haven't seen data to back this up, another Lemmy user called out that Intel chips may have support for running secure code the user cannot modify. The results are signed by an encryption key on the motherboard/CPU that cannot be extracted to fake the signature.
So let's say Chrome asks this hardware module to hash the executable code and some state for itself currently in RAM and sign it with Intel's private key on the motherboard/CPU. The "some state" portion ensures the hash is always unique. Maybe it is just a timestamp. Regardless, this helps the attestation server know Chrome has not been modified because the hash is unique and cannot simply be captured in flight once and then replayed/faked over and over like a user-agent string.
Here is an alternative Piped link(s): https://piped.video/watch?v=5joNRJ3C5ho
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source, check me out at GitHub.
I have finally made the full conversion away from Google. Email, browser, search all out of their hands. The one that took the longest to happen was the browser. Firefox finally is working great for me now.
Email is tough one for me. Any recommendations? I tried Proton but their mobile app is (was?) disaster, and only limited to one logged in account at once which is a deal breaker for me.
Posteo or Runbox are good libre options. You have to rent however
zoho mail is what I use.
apple might oppose this to some point, they're often not in line with google.
The best way to oppose this is to use non-chromium browsers like Firefox and take away Google’s source of power: chromium market share
i agree, the problem is, that if google succeeds and (popular/mainstream) websites refuse to let said browsers access the sites, it's an uphill battle in wich we will eventually lose the normie webizens.
And there’s the core problem: the proportion of people on the internet who have no idea what they’re doing has grown by orders of magnitude, and big tech has realized they can just treat and exploit them like cattle, because almost nobody has a full and complete understanding of what’s going on, or how policies driven by big tech like this are catastrophically bad for normal users on the internet.
Apple only opposes Google when new browser capabilites like PWAs, Bluetooth API, NFC API,... might be a threat to the Appstore monopoly on iOS.
I think they are very much onboard with this since it you could potentially make live hell for Hackintosh and Jailbreak users.
i wouldn't be so sure about it. apple strongarmed google with jpgxl support and the european union pryed open their eco system, at least for eu citizens. apple currently positioning themselves on the side of privacy advocates would lose this standing (and many customers who switched to iphone because of it). i know, they could sugarcoat this, but i have a little hope left that they will draw a line on at least the most user hostile stuff.
Honestly my hope is still that the EU intervenes, which I consider to be around 50% given they’re a generally a bit of a mixed bag when it comes to regulations.
When Apple becomes my last hope, I’ll know times are bad. Having said that, it’s one of the parties that may actually oppose. The other big guy that may have some power in this, Microsoft, is probably more likely to adapt this catastrophe of an idea.
Apple already shipped attestation. It's in Safari in both desktop and mobile. Unfortunately. It's just going to take a couple big players to make this a blight everywhere. Netflix implementing this might do it. Google's main sites would work.
the EU can be really schizo when it comes to stuff like that, that's true. i don't trust them. and apple as a last hope ... well, maybe when it comes to big tech. can't think of anything better within the FAANG pantheon.
Apple loves control; the only reason I can think of that would make them oppose Google's Web Integrity proposal is that they don't think it goes far enough.
Or they'll come out with their own and try to be the dominant WEI code.
Apple already has their own thing for this https://httptoolkit.com/blog/apple-private-access-tokens-attestation/
welp, i guess it's over.
I think they already implemented this onto Safari