Unblockable ads, sites can serve you data that you can’t manipulate or copy, micropayments can exist, invasive surveillance.
Surveillance is possibly the worst of the bunch. They say it’s just to do a better job of serving ads, but that’s only the tip of the iceberg. Governments could easily use it to know and track everything you do online. Just wait till the next elected nut job wants a list of everybody that has ever looked at or searched for a certain type of information, maybe they don’t like that you looked up info on abortions or lgbt info, now they can know the full extent of what you saw and when.
Ads will be worse. You think YouTube ads are bad now, just wait till you can’t visit any page without the mandatory viewing of their ads. They can require a cam installed to make sure your eyes are on the ad, helpfully pausing the video when you look away.
You'll need an "approved" browser and potentially "approved" hardware to access the web. Since Cloudflare is on this too, most of the web will be locked for anyone who doesn't use mainstream hardware.
Cloudflare want to be the internets backbone. And they've honestly succeeded.
Now it's almost impossible to access websites in an automated way -- the CTO posted you can just email him (https://news.ycombinator.com/item?id=34639212) and he'll sort it. Because that scales.
edit: Mispoke about the CTO, said he would approve you, I was wrong. Apologies.
Their DNS is "privacy focused", but they provide "aggregated results" of domains. How is that privacy focused?
Cloudflare came from the approach of being a developers friend ("Look! SSL is now free!") but was given the internet on a silver platter.
Yes. Cloudflare was irresponsible in fighting to keep 8chan, Daily Stormer, and Kiwifarms up as long as they did. Every other ISP with a competent abuse desk dropped them. If you don't think that's bad, then let me remind you that back in 2012, Malwarebytes actually had a policy of blocking all Cloudflare services specifically because they were hosting malware and refused to remove it[0]. The excuse Cloudflare used for not removing malware from their network was the same language used to justify keeping the aforementioned sites operational. If Cloudflare was paid to run the Great Firewall of China they'd bend over backwards to try and claim it was to protect Xi Jinping's freedom of speech.
Remember that moderators can be abusive not just in terms of removing content that shouldn't be removed, but also by forcing you to accept things that harm you. Moderation is a trust relationship because I'm delegating my own personal decision to accept or block traffic/content/etc to someone else. Cloudflare is not trustworthy.
Cloudflare also used to be a big pain in the ass for Tor/VPN users because competent DDoS protection requires some kind of traceable identity. Their solution was Privacy Pass - an extension that let you pre-solve their CAPTCHAs. However, this wasn't good enough, so their next solution... was to literally partner with Apple to implement Web Environment Integrity, years before Google even proposed it. Nobody noticed this - not even me - because it was sold as a way to make CAPTCHAs less annoying. It was literally the trojan horse Google could only dream of building.
Sorry, this was wrong. I was a fool to post that without providing context and I apologise. I have updated my comment. I sometimes forget there are real people on the other side of the computer sometimes.
I'm having trouble grasping how WEI works, providing examples of what would and could happen and what to ask/tell the EU specifically.
From my limited understanding it would mean the lockout of people with non-compliant hardware/software, greatly increase the fingerprinting of web browser users and further vendor lock in to Google as a company?
The stated reason is to stop bots from being counted as ad views and make sure that all ad views are done by actual humans. This is likely even honest reasoning from the people developing it.
The same technology could easily be applied to simply blocking anyone who isn't verified (in the name of stopping spam, DDoS, bank security, you name it), meaning anyone not using an approved install of Windows/macOS/Android/iOS is shut out from the internet.
In the long term, in the name of "banking security", they're likely to add a mode that also lets you ensure your pages aren't tampered with by extensions, and there go all the ad blockers.
>> The same technology could easily be applied to simply blocking anyone who isn't verified
Sounds like a great way to enforce censorship:
- websites can deny access to unverified web browsers / web clients
- WEI-enforcing web browsers / web clients can refuse to go to unverified websites (not a stated goal, but it is a logical next step to boost website adoption of WEI APIs once a critical mass of clients is reached)
Google wants to build a wall around the Web and have their own walled garden:
Oh, so it’s like the HDMI DRM that attempts to let displays certify “I’m a real honest-to-goodness TV, not a capture card.”
That one is in the category of things that is little more than a nuisance in practice since it’s so easy to circumvent, but that’s a hardware thing and therefore it’s easier to plug something in that is unauthorized. Things are getting so tightened up on the software side with secure boot, Apple’s read-only system partition and by-default App Store Only policy on the Mac, etc. that I suspect this type of thing will be a pain for normal people, though actual at-scale bad actors will probably figure it out.
It’s far worse. If you go back to to the html and http protocols, they are extremely open and friendly. I would say extremely elegant and helped build the web we know today. But google has been iterating away from open and accessible standards in favour of controlling experiences (see amp, WEI, etc). I’m all in favour of secure boot chains with options for unlocking because of the security benefits. There’s absolutely no good user reason to apply this to web resources though.
I know it's not exactly what you mean, but this is why I dislike HTTP2 and 3 (both also heavily pushed by Google but also others). While open, they are the opposite of "welcoming and friendly".
Indeed. Nor a search company, nor a phone operating system company, nor a maps company, nor an email provider, nor a business software company.
Whatever someone may think of Google or even of ads, it’s smart to keep that important thing in mind and remember their alignment is and must always be toward maximizing and improving advertising.
I think there are a lot of parallels with what Reddit did.
Reddit wanted to control how users consumed content on their site. To control the experience (i.e. monetize with ads), they had to shut down third-party clients, since those could remove ads.
Google appears to be doing the same thing, but for the entire web. WEI is a way for sites that want to monetize with Google ads to prevent folks from accessing their site unless they can cryptographically assure that the user's browser will follow all the rules Google sets. We don't yet know exactly what all those rules will be, but it isn't hard to guess that they'll be along the lines of whatever makes Google the most money.
This applies to desktop browsers, but also affects automated tools like wget and curl. It could kill web scraping altogether.
Third-party clients could have been made to display ads, or they could have gated third-party client access behind Reddit Gold. That wasn't the problem.
The problem was that if you used a third-party client, Reddit would have to coordinate with them to launch whatever new stupid cryptocurrency scam they wanted to push that week. On a web browser they can just push new code into it[0], and their first-party mobile clients can be updated ahead-of-time with support for the feature. But third-party clients would have to spend their own development time adding stupid "click here to get your Snoovatar[1]" links. They could slow-walk that, or just not implement that, and Reddit would have to spend time and money kicking users off that third-party app.
This, incidentally, is why every other major social media platform bans third-party clients. Third-party clients are user agents, not platform agents.
[0] Which, incidentally, makes web browsers not user agents
The Browser application needs to pass a binary image check, and if the browser hash doesn't match Google database, you cannot proceed to the website (since your browser may be corrupted). A major big deal for non main-stream browser, and for non Google browser developers, extension developers (eg. AdBlock), etc. In summary, some websites (like banks, Netflix, etc) will no longer be available for non mainstream browser users. Also, even if you're using Google Chrome, you may need to run the latest version to satisfy the hash check. Every day, the number of broken websites will continue growing until all non Google Chrome users have a blocked internet.
The idea is that an operating system service provides the attestation. In turn, the OS is signed, with the bootloader verifying the signature. The bootloader is also signed, with a hardware chip verifying the signature.
The infrastructure to do signed OS loading is already in place, and on some operating systems (e.g. Android), the OS attestation service is already in place. So everything is mostly in place already to have your browser attest that it is official Google chrome on Google Android on an approved device with a hardware chip that verifies a Google approved boot signature. That hardware chip contains a Google approved private key (a key that's signed by a manufacturer that Google has in turn approved/signed) that can't be extracted, and that's the key that makes the attestation. Replace the hardware boot verify chip with one that will verify software you want, and you lose your attestation key.
They could also make the OS service reach out to a web service to get an attestation that the attestation key hasn't been revoked, so even if someone did physically extract the key from hardware and share it, it could be revoked (assuming each device gets its own key).
In effect, wide use of this kind of thing means that open source software is no longer free since even if you can look at the code, you must be part of the anointed class (i.e. working within our approved by a major corporation) to edit it and run your edits.
Because the encryption key you need to sign the hash lives in EL3[0] and only Google and ARM can load code there. In order to lie about your hash, you have to break ARM TrustZone, and if you do that you can be sued under section 1201 for trafficking in copy protection circumvention tools. In other words, the law that prohibits you from selling DVD copiers can be used to give literally any bullshit the backing of law.
[0] An ARM exception level that sits above hypervisors and is specifically intended to support trusted execution modes for isolated mini-operating-systems that do this sort of shit
> Can you please explain why a third party browser can’t lie about its hash, just like it can lie about it’s user agent?
Because that thing basically describes a proprietary plugin like Activex, Silverlight or Flash before it, so a third party browser which doesn't have that proprietary tech can't fake it, under pretense of "standard". The code of that plugin will not be open source, worse, it will act as a spyware on people's computers at the OS level.
It's like EME before and these proprietary techs have no place in a open standard spec.
This is essentially a backdoor attempt to TiVoize[0] web browsers. The only difference is that, instead of directly using hardware to prevent you from running a modified browser, the intent is to use network effects to accomplish the same thing.
From a very top level view, this gives Google, and other websites, the ability to block requests from devices/browsers they don't approve.
This implements device level verification of the code running your browser. If the device identifies as something Google, or other implementing websites, don't approve, you'll get an error similar to how you see 404 errors for missing/wrong links.
If adopted by publishers, the web will be closed to everyone but allowed browsers on allowed OSes on allowed hardware. No ad blockers, no extensions, no customizations beyond what the few chosen browsers allow explicitly.
To turn your browser (an agent acting on your behalf) into a proprietary application (an agent acting on behalf of a website) -- i.e. the equivalent of forcing you to install a proprietary application in order to visit a website.
If websites wanted this feature, and the choice is between Chrome implementing it versus me installing proprietary software, I would rather choose Chrome, especially since Chrome is implementing it in the open.
There are already various services that require proprietary applications to be installed, most of which are closed-source with dubious security track record. Replacing those propriety apps with a common web browser is not necessarily a bad outcome.
Personally I am voting with my money and just avoid services that are user-hostile, independent of which user-agent I use to access those services.
Nothing will happen. People have been making the same complaints about every new crypto standard for decades, and yet here we are. TPMs are a thing, EME has been around for over a decade now, DRM on the web is as pervasive as it's ever going to get, and yet no one's user experience is any worse than it was before these technologies existed.
It really does feel like something is fundamentally wrong when we're trending towards getting our video and audio content via online streaming but the streaming services are trending towards being gatekeepers more than facilitators.
The temporary nature of any licensing deals behind these services and the resulting lack of reliable long-term access to content have become more and more obvious.
Increasingly the streaming services seem to be so paranoid about piracy that they are blocking "unapproved" players from getting the highest quality versions of the content - as if anyone who wants to pirate any blockbuster movie can't already find a way to get it in 4K somewhere else if they really want to. Meanwhile you can't watch your 4K movie on a service you're literally paying to provide that movie. IIRC Amazon Prime Video still won't even let you have HD content if you're on Linux.
It feels like the commercial incentives for tech firms to create walled gardens and a culture of never owning anything permanently are going largely unchecked and by now the governments who are supposed to act in the interests of their people should really be stepping in with regulation to counter those negative trends.
So, no 4K Netflix on Linux (and not even 1080p without light hacks), presumably because of some incompatibility with the DRM. Still handily beats the situation that existed before. "Similar to video DRM" doesn't scare me. Mass surveillance is scarier.
>DRM on the web is as pervasive as it's ever going to get...
Apple and Google only just now implemented this kind of web DRM, which absolutely can have further restrictions added to it. Careful with your absolutes.
