It's like everything is named ironically these days. There is nothing "trusted" about a device whose sole purpose is secure things against the person who ostensibly owns it.
this post was submitted on 22 Jul 2023
229 points (98.7% liked)
1118 readers
33 users here now
Welcome to the Google community! This is a place to discuss everything related to Google products, services, features, and discussions.
ChromeOS discussions are welcome!
General discussions about Google products, updates, tips, and related topics are welcome. However, for specific technical support, account-related inquiries, advertising questions, and other issues, please direct them to official Google support channels.
Rules
- Stay on topic: All posts should be related to Google products, services, or the Google ecosystem.
- Respectful discussions: Treat fellow community members with respect and engage in constructive discussions. Avoid personal attacks, harassment, or offensive language.
- No support inquiries: Please refrain from posting individual support inquiries or account-related issues. Use official Google support channels for assistance.
- No spam or self-promotion: Do not post spam or self-promotional content. This includes links to personal websites, blogs, or products/services.
- No illegal content: Do not share or discuss illegal content, including piracy, hacking, or copyright infringement.
- No misleading information: Avoid spreading false or misleading information about Google or its products.
- No inappropriate content: Do not post or link to any inappropriate or NSFW (Not Safe for Work) content.
- No off-topic discussions: Keep the discussions focused on Google products, services, and related topics. Avoid unrelated or off-topic discussions.
- No excessive advertising: Do not excessively promote products, services, or websites.
- Follow community guidelines: Adhere to the overall community guidelines and terms of service.
founded 1 year ago
MODERATORS
Corporate doublespeak is great, isn’t it?
Just like the Patriot Act which totally went against the 4th amendment
What's that, Google? You say you want me to switch to DuckDuckGo and Firefox? And you're insistent that I do it? Okay, sure.
https://www.tomsguide.com/news/duckduckgo-privacy-browser-facing-backlash-over-microsoft-trackers
DDG is far from perfect. It's like Brave. They like to make you think they're all about privacy, when they're not. I recommend you use Bing.
This comment is sponsored by Microsoft.
(Joke aside, if you want privacy, use a search engine without logging in and use a VPN.)
So Google wants to do to the whole internet what Spez did to Reddit?
Yeah, good luck with that.
Except Google actually has the power to do that. Do you think Youtube content creators are going to use Peertube? No I don't think so.
This will be great, just filter me out from all ad content. I will not even need ad blocker.
Your doctor, tax office and other public services or your employer or job seeking webite says hi.
Very few of us can truly live without the internet.
How does this affect browser modifications and extensions?
Web Environment Integrity attests the legitimacy of the underlying hardware and software stack, it does not restrict the indicated application’s functionality: E.g. if the browser allows extensions, the user may use extensions; if a browser is modified, the modified browser can still request Web Environment Integrity attestation.
In other words, you don't have to worry about the removal of ad blockers. At least, not through this Google proposal.
You do have to worry, because that part is essentially bullshit designed to soothe you while ignoring the actual problem. The attester (in practice the platform holder, so Google/Apple/Microsoft) is allowed to pick which apps can use the API. The criteria they are supposed to use (as well as the entire privacy section) is a "todo" in the actual spec, but even then, there is literally nothing stopping them from deviating from those criteria as the spec isn't legally binding. It is entirely plausible for Google to deny attestation capability to Firefox and other browsers capable of ad blocking.
Sure, they can request it. It doesn't mean that they will receive it, or that websites will be okay with the result. The "risk of websites using this functionality to exclude specific attesters or non-attestable browsers" is something not excluded by either the spec or the explainer; all it says is they "look forward to discussion on this topic". Google, Apple and Microsoft will be the ones in charge of deciding which browsers are non-attestable.
More importantly, if they allow modified web browsers, it is completely pointless for their very own stated goals. Doubly so because the attestation can't be meaningfully bound to the device (ie you can build a modified Chromium that does nothing but request attestation results and forward them to a bot running on a desktop and the website would be none the wiser).
So in order to accomplish what you're saying, all attesters would have to reject all browsers with extension functionality then, right? And if they really wanted to eliminate ad blocking, those browsers would not even be allowed to run debugging scripts.
I don't see a lot of buy in from users to such a system. The proposal requires the site, the user, and the attestor to comply. I don't see any plans for an overhaul of the entire tech infrastructure.
The worst that can happen as I understand it is a handful of websites will start blocking users who aren't validated per the spec, they'll display a message like "this website only works in BrowserEveryoneHates", and then a competitor will swoop in that works in every browser.
The best that can happen is users will have a little more security from tampered software, advertisers won't lose as much money from bots, among other things as they describe in the spec.
I'm open to changing my mind, but this is just how I understand it so far.