On: Unpacking Google’s Web Environment Integrity specification

[Zopieux]

As usual, a thousand word essay on Google's WEI without ever mentioning that Apple sailed that ship silently a while ago, therefore not attracting any attention or backlash.

https://httptoolkit.com/blog/apple-private-access-tokens-att...

https://toot.cafe/@pimterry/110775130465014555

The sorry state of tech news / blogs. Regurgitating the same drama without ever looking at the greater picture.

[probably_wrong → Zopieux]

I didn't notice it because I, just like a majority of internet users worldwide, do not own any Apple products and therefore I was never affected and probably never will be.

I do, however, routinely interact with websites that implement Google Analytics and/or Google ads. If those sites start rejecting my browser of choice I will most certainly be locked out of a significant portion of the internet. And the remaining 60% of all internet users would be essentially forced to accept this technology or else. That's an order of magnitude or two more users, and seems to me like a good reason to raise the alarm.

[bezout → Zopieux]

The post states it. This is not a problem because Safari is not the leading web browser. Apple has very limited power over what they can do with it.

[kevincox → bezout]

Exactly. Websites will not require this version because they know that Safari is a minority market share and they can't force users to buy an Apple product. However if this is supported by Chrome and Safari all of a sudden the equation flips and many sites will feel that they can reject service to other users.

[YetAnotherNick → bezout]

Safari is not only leading browser in mobile, it is the only choice any iphone users have unlike chrome where user has choice to not use it. I would be more wary of safari changes than chrome changes.

[pakyr → YetAnotherNick]

> Safari is not only leading browser in mobile

No it's not? Android has upwards of 70% of the mobile market[0], and Chrome has nearly 65% of the mobile browser market, compared to Safari with under 25%.[1]

> the only choice any iphone users have

Sort of. WebKit is the only choice iOS users have, but there are plenty of browsers available on iOS (including Chrome and Firefox) that use WebKit, not just Safari.

[0]https://gs.statcounter.com/os-market-share/mobile/worldwide

[1]https://gs.statcounter.com/browser-market-share/mobile/world...

[ur-whale → Zopieux]

> As usual, a thousand word essay on Google's WEI without ever mentioning that Apple sailed that ship silently

The "look! there's a bigger asshole over there" defense.

Never a winning strategy.

[bryanrasmussen → ur-whale]

isn't it - you forgot to mention the smaller asshole who has less power to abuse?

[Spivak → bryanrasmussen]

Or realistically, this has already shipped and the world didn't end.

[Klonoar → Spivak]

The reach of Apple doing it isn’t the same as what Google will do with Chrome.

[fecs → Klonoar]

https://www.statista.com/statistics/1045192/share-of-mobile-.... iOS is the dominant mobile platform in the US. Yet, the sky did not fall when thiw was introduced. Why not?

[EdwardDiego → Spivak]

What's the market share of Safari?

[wmf → Zopieux]

Personally I don't think PATs are nearly as bad as WEI. PATs just bypass CAPTCHAs while WEI will presumably lock people out of sites completely.

[freedomben → wmf]

WEI can't lock people out of sites either. It's all on the website owner. A site owner could easily lock Apple users who aren't authed via PAT today if they wanted to. The only thing that's stopped them from doing so already is that most users are non-Apple browsers so it wouldn't make sense.

[hooverd → Zopieux]

Clearly it should have gotten more attention.