this post was submitted on 26 Jul 2023
906 points (98.9% liked)

Technology

35124 readers
231 users here now

This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.


Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.


Rules:

1: All Lemmy rules apply

2: Do not post low effort posts

3: NEVER post naziped*gore stuff

4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.

5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)

6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist

7: crypto related posts, unless essential, are disallowed

founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 3 points 1 year ago* (last edited 1 year ago) (14 children)

If you don't use a client with certain signature, the web request will end in different response, i. E. an empty response,, as if your client had a certain signature. Please correct me if I am wrong, though.

[–] FreeloadingSponger 3 points 1 year ago (13 children)

Why can't my modded client just give it that signature?

[–] [email protected] 3 points 1 year ago (12 children)

Because you don't have Google's private key. Same reason you can't watch Netflix episodes without Widevine.

[–] FreeloadingSponger 2 points 1 year ago (1 children)

A private key to do what?

I only have the most cursory understanding of what Widevine is, but a quick Google reveals github projects claiming to spoof it.

Where I fail to understand is this. Whatever authentication the open source browser I modify needs to do, I can let it keep doing, because at some point it has to provide my browser C++ code with a clear text DOM before it renders it to an image to be displayed by my window manager. I can write that browser to simply remove DOM elements it deems to be ads - just like ublock does - before it renders it graphically.

The only way around this would be to turn browsers in to a completely dumb terminal that accepts an octet stream of pixel data so it can display bitmaps, which is completely unfeasible (every webserver would become a graphics card for each of it's users), and even if it did that, a simple neural net would identify the ads and remove them.

What am I missing?

[–] [email protected] 1 points 1 year ago* (last edited 1 year ago) (1 children)

The attester will then sign a token containing the attestation and content binding (referred to as the payload) with a private key. The attester then returns the token and signature to the web page. The attester’s public key is available to everyone to request.

— The explainer, section How it works.

Websites will ultimately decide if they trust the verdict returned from the attester. It is expected that the attesters will typically come from the operating system (platform) as a matter of practicality, however this explainer does not prescribe that. For example, multiple operating systems may choose to use the same attester. This explainer takes inspiration from existing native attestation signals such as App Attest and the Play Integrity API.

— The explainer, section Web environment integrity.

Now Julien Picalausa of Vivaldi browser theorizes as follows:

To make matters worse, the primary example given of an attester is Google Play on Android. This means Google decides which browser is trustworthy on its own platform. I do not see how they can be expected to be impartial.

On Windows, they would probably defer to Microsoft via the Windows Store, and on Mac, they would defer to Apple. So, we can expect that at least Edge and Safari are going to be trusted. Any other browser will be left to the good graces of those three companies.

​Of course, you can note one glaring omission in the previous paragraph. What of Linux? Well, that is the big question. Will Linux be completely excluded from browsing the web? Or will Canonical become the decider by virtue of controlling the snaps package repositories? Who knows. But it’s not looking good for Linux.

So, AFAIU, if worst comes to worst you won't be able to run an unsigned browser and browse the web.

[–] FreeloadingSponger 1 points 1 year ago (1 children)

I still don't see why my open source browser can't just lie when it's sending a description of itself to the third party. The only way I could see it working is if that description needs to be encrypted by a key that's compiled in to a closed source browser, and then websites only accept requests from a few closed source browsers.

Is that what you're saying? That unless I have one of a couple accepted clients which are proprietary and closed source, websites just won't work?

[–] [email protected] 1 points 1 year ago* (last edited 1 year ago) (1 children)

It seems logical to assume that there would be no point to the whole thing if it was so easily avoided just by modifying your browser. Someone who's, for example, selling fake engagement (e.g., fake reviews), which is listed as one of the things Ben Wiser at al. want to prevent, will probably have enough technical expertise to use a modified browser that will circumvent WEI, so why would Google even bother?

[–] FreeloadingSponger 1 points 1 year ago (1 children)

To make it harder, even if not impossible, for the average user to ad block them.

Are you asking because you're not sure of the answer, or because you are, and you know that web integrity will require a pre-compiled closed source binary to browse the web?

[–] [email protected] 2 points 1 year ago* (last edited 1 year ago) (1 children)

No, I'm not sure. It's possible that this is a benign technology, but many believe it's not, including people at Mozilla, people at Vivaldi, Cory Doctorow, Jay Freeman (aka "Saurik"), the developer of Cydia (via The Register), so I'm concerned.

This recent blog post also mentions the intent of disallowing unsigned software to browse the web. Perhaps you'll find it interesting.

[–] FreeloadingSponger 1 points 1 year ago
load more comments (10 replies)
load more comments (10 replies)
load more comments (10 replies)