Gregory's Serveraw fuck google's trying to make DRM for websites https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md
|
73 comments
 @rcombs from my earlier post: > the problems this tries to solve is hard! unfortunately, some things simply should not be built, regardless of how much easier it makes things for Google and consider this: Google maintains one of the world’s biggest web scrapers. because Google is dominant in search, people will allowlist the Google scraper attestation (if it exists) no matter what. guess what individual users won’t be able to do?  @rcombs @kouhai In a world with functional #antitrust and anti-competitive practices regulation, making this would be corporate suicide.   @merospit@infosec.exchange @rcombs@social.treehouse.systems could also use it to block chromium-based browsers.  @rcombs here’s a good girhub issue on this https://github.com/RupertBenWiser/Web-Environment-Integrity/issues/28 @esther @rcombs I like this particular comment on it: https://github.com/RupertBenWiser/Web-Environment-Integrity/issues/28#issuecomment-1642097940 > their measures are insufficient and always will be, because the underlying idea is flawed  @hirnsalat @rcombs I love the way that they talk about whether or not to serve an ad - sure, you don't want to serve one to a crawler bot. I'll bet my arse thought that this thing is tuned to recognise ad blockers and script blockers as non-human and to block you from the content. @hirnsalat @rcombs @ascott @hirnsalat @rcombs "We want to assert complete market capture & dominance and the lack of antitrust means you can get fucked."  @lispi314 @ascott @hirnsalat @rcombs i gave up on that fight a long time ago. the public will never be against being controlled until it personally fucks them. and by then they are too individuated to matter.
@rcombs Websites have had DRM for decades. That's how Netflix determines whether you're allowed to see 4k video or not.  @blakeyrat @rcombs Sure? But we sure as hell shouldn't allow it to get even worse than it already is. @blakeyrat @chiraag @rcombs @blakeyrat @chiraag @rcombs @blakeyrat @chiraag @rcombs @ascott @chiraag @rcombs If computer security folks are really concerned about this thing, a good first step would be to figure out how the fuck to explain it to people using brief, concrete examples that don't rely on guesswork or conspiracy theories. I'll hold off on panicking over it now. I just wanted to point out it's dumb to say "Google is adding DRM to the web!" when it's had DRM for decades, that was the main thing I had to say, haha. @blakeyrat @chiraag @rcombs @ascott @blakeyrat @chiraag @rcombs It's instead a way more direct anti-competitive setup and I expect it to result in litigation for exactly those reasons. That doesn't prevent it from causing damages in the meantime. @blakeyrat @rcombs Yes, but that applies to only media elements. This applies to entire websites, and, if I read the explainer correctly, also requires a rootkit on your device so the attester can be sure it's running what it says it is. (The example rootkit being Google Play Services on Android.)  @rcombs it's more like Google Play SafetyNet for websites. we already have DRM on the web, sadly  @rcombs I'm glad the authors kindly put their names on it so they can be shitlisted from the industry.  @rcombs I love how number one on their list of "scenarios where users depend on client trust" is "advertisers can only afford to pay for humans to see the ads". Also love how the whole scheme is predicated on having a single "attester" that gatekeeps which *operating systems* are valid. It's AppStores for Websites. This idea needs to be killed with fire, and everyone involved should be shamed. @schizanon @rcombs I'm half thinking it should be banned right now, and half thinking it should be used to dissolve the first implementer's corporate charter on the spot on antitrust grounds (I'm not sure if corporations get "being made examples of" as warnings). @rcombs So it's CAs but in reverse (users certify thru the attester and the server has a list of approved attesters), and also if you mod/patch your browser it can just lie to the attester and it's all meaningless? This seems like someone's pitch to get a promo that solves nothing and actively makes things more complex and worse. @rcombs well can’t wait for mirrors to useful sites to get big again, outside of that I’m just gonna stop using any site that enables this  @rcombs This goal gives me hope: ● Continue to allow web browsers to browse the Web without attestation. But then this example use case gives me pause: ● Detect compromised devices where user data would be at risk https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md  @rcombs “Users often depend on websites trusting the client environment they run in. This trust may assume that the client environment is honest about certain aspects of itself, keeps user data and intellectual property secure, and is transparent about whether or not a human is using it. This trust is the backbone of the open internet (…).”  @rcombs just linking up our thoughts on it (it's bad) https://mastodon.social/@irenes/110742053004822833  @rcombs@social.treehouse.systems nope nope nope nope, fuck that  @rcombs FWIW, I've worked with those people (Borbala was my tech lead, then manager for ~2.5 years), and I genuinely believe they're trying to do the right thing here. The bot problem on the internet is not well understood by the average user/developer, mostly because that's an area where "obscurity" is still part of the best strategies the defenders have, and also because the bad actors focus their efforts on just a few targets (Google, Meta, Twitter, etc.). @rcombs the proposal does talk about the DRM aspects of this, and tries to propose solutions that mitigate that issue. I don't know whether they're appropriate solutions or not, whether they go far enough or not, etc. I think that would be a healthy debate. Saying "user agents shouldn't do that" is basically saying it's fine for millions of users every month to get their bank accounts stolen, their personal information sold on black markets, etc. -- unless you have a magic solution. @delroth you're equating bots with, what, bruteforce attempts on user passwords? which is an extremely mitigable problem that's entirely solved by passkey usage @rcombs in general: there are 10-100s active full-time criminal groups targeting Google users at all times. Some are interested in stealing SSNs and passport photos from gmail. Some are interested in stolen credit cards (via reselling tradeable in-game items in Play Store games, for example). Some deploy cryptolockers on Google Drive. Often they either have credentials, phish them, or have session tokens stolen by malware on device. Passkey/2FA helps, but doesn't prevent the latter. @rcombs Google isn't just fighting that on one front, they've been strongly pushing for 2FA for years. They were the first to deploy Security Keys for a reason. There's been many efforts to try and bind session tokens to devices too. Example: Channel ID. Unfortunately not successful. The "defense front" you're seeing is trying to detect suspicious actions coming from non legitimate devices. If someone gmail-searches "SSN" and you can detect it's not a real browser, you can issue a challenge. @rcombs this isn't really the appropriate format to try and summarize 3 years of learning about this in the field, working with probably some of the foremost experts in the field. I also likely will get into NDA things pretty quickly with more details. Those experts are people I recognize in the list of authors of the proposal. They're people that have spent their whole career working on protecting users from data theft / impersonation. I personally trust that they have done their homework. @rcombs another angle: do you think those people don't know how bad such a proposal looks, especially coming from Google? Look at the list of non-goals, the number of counter-measures they propose to avoid this being too abusable, etc. They clearly understand your viewpoint as well, to some extent. And yet they still thought it would be a good move to publish this proposal. Do you think they would have done so if "this ain't gonna solve that case" (or rather: "help", you can't "solve" abuse)?  @ariadne @rcombs I think that's always a reasonable worry (though tbf I do personally think providers should have a choice of how they charge for their content). But note that the proposal in question explicitly states as a non-goal "Enforce or interfere with browser functionality, including plugins and extensions." @delroth @ariadne @rcombs That may be a "non-goal" as far as the spec is concerned, but after reading the explainer it's clear to me that none of the other goals of the spec can be achieved without also making that possible. And on the commercial internet, the incentives for both attesters and site operators point towards doing that. @carcosa if that's the case (I haven't done a full technical analysis of what they propose): I think that's a fair criticism, and I don't think a spec proposal should be accepted when it's not self-consistent. I think that's significantly more nuanced and actionable commentary than "DRM bad", and I presume that this is part of what the spec review process would go into (W3C/Whatwg/... have privacy experts reviewing these things, and they seem to already have been engaged). @delroth Yeah. Specifically, look at the discussions of the holdback mechanism, which is the one part that is supposed to prevent website operators from discriminating against unattestable browsers. Stakeholders in the security business are arguing that it's not acceptable to have holdbacks at all; I'm arguing that if implemented, holdbacks will erode over time until attestation can be used to discriminate on the basis of browser/plugins/etc. @ariadne@social.treehouse.systems @delroth@mastodon.delroth.net @rcombs@social.treehouse.systems @rcombs I'm assuming that anything coming from the Google dev universe is designed to make a walled garden that benefits Google. I glanced and skimmed this page. Doesn't make a whole lot of sense, nor do see a use case for the WWW. |
@rcombs Oh fucking hell. I mean not entirely unexpected, but uh, no Google, you cannot.