🆘
this post was submitted on 12 Oct 2023
785 points (97.8% liked)
196
16708 readers
2310 users here now
Be sure to follow the rule before you head out.
Rule: You must post before you leave.
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
From my understanding, it allows a website to check if you’re running a Chromium browser, and block your access to the site or to features of the site if you aren’t
Well then I am a chromium browser. At least as long you need to think that.
What technology they are using I can't fake on a Firefox?
It's the API itself, it's a little more complicated than just checking if you have a chromium browser. What it's looking for is special tokens generated by google within chromium browsers. Google is selling this idea as a way to help verify identity of the end user and thus block bots. That's concerning, because it suggests that google will have some verification method likely involving ID and generate a unique token with that info associated with it. This is a real concern for web privacy for like a million reasons, obviously, and ideally should not be adopted by anyone. If other tech gatekeepers adopt it (and they would love to) it will block giant swathes of the internet from people refusing to use the tech and further googles monopoly over general consumer browser use. Now, could the token be fudged? Possibly. But it will take time to figure out.
And what's really fucking infuriating about this is that it honestly has nothing to do with making the internet a better place to be or improving the safety of the internet or protecting children or anything like that.
It's about ads.
They're literally trying to fuck the entire internet in broad daylight so that they have a way to guarantee to their advertisers that they are targeting you with the ads the advertisers want you to see.
"integrity"
🤔 So what happens if you look up porn on a chromium browser and then try to run for office years later? Couldn't they in principle blackmail whoever they wanted?
This is why google wanted to deprecate the User-Agent header.
god that'll make it impossible to do a bunch of frontend work for anything but their browser. which is another reason they want to do it, i'm sure
They deprecated it as in it always is set to the same value regardless of the chrome version.
... Oh. Sorry friend, they're using TEE, trusted execution environment, aka the place where a key is put by the manufacturer and not available to the user without an exploit or taking apart the processor. Faking it isn't going to be like changing the user agent
Fun how companies came up with a way to run code on our hardware at home without our ability to modify it
Well then I won't use it and maybe cut my access to their Services
Yeah... That's about where I'm at. I figure I'll keep an old computer set up to deal with things I have to use, but the corporate Internet is really starting to suck. When Reddit went down, I started the long and painful process of finding a better way... It's going to involve quite a lot of custom solutions, but at least it starts off crappy and quickly improves instead of the opposite
Bing for enterprise is already blocking browsers that aren't Edge. Clicking "Edge" from the list of browser identities in Firefox seems to go around the block.
Soon, we'll get to "Best viewed with Chrome", "Best viewed on 1920x1080", "Google Chrome NOW!" even though other browsers could load the webpages just fine.
Oh, wait.
On what grounds? I know why google wants this, but why would the average website do this?
I can already picture Google down-ranking search results for any website that doesn't implement it because obviously "if they aren't using the integrity API we can't guarantee they're safe for our users"
Which... would just de-value Google Search, no?
This is the process Cory Doctorow termed “enshittification.” Services start out by prioritizing functionality for the users, even running at a loss to do so. This is one reason why new companies have a massive burn rate compared to their income.
The second step is they stop prioritizing users and start prioritizing “partners.” Those could be news sources, sellers, whatever. User functionality is compromised to optimize the “partner” experience.
Finally, they start to fuck over partners too, in order to shovel as much money as possible into the company’s accounts. Facebook did it with news sites - especially video. Twitter is doing a speed run on this. Google is accused of being well on its way with search, and I have no idea about their other services.
So, yes, Google may fuck up search just like Facebook fucked up their feed and Twitter is fucking up absolutely everything.
They've already fucked it up. I've moved on to ddg, which is something I thought I would ever do five years ago. If the ddg integration with bing goes south, then I'll start looking into things like kagi.
To people who know what's going on sure, but for most users, if its not on the first page of Google it doesn't exist.
The 'average' website wouldn't but many of the social giants are desperately looking for a way to limit bot use. So Google gives them what they want and simultaneously gets to be the most reliable advertiser, ensuring impressions are viewed by not just a human but the right human.
How does this limit bot use? Is there something anti bot about chromium? Or does the api do more beyond checking for chromium compatible browsers
Because websites will check if you have a Web Integrity token being sent along by the browser and if it cannot find one registrations and login will be closed to your instance.
Edit: And to clarify, you will not get that token unless you verify your identity within the associated google account. Hence why only Chromium browsers will support this. But it isn't about the browser. It's about the token.
But that token is just provided by the browser, isnt it? Can bots not run within an instance of a chromium browser? I dont get how this stops a bot account.
Yeah sorry I just clarified. Read my comment higher up in the thread for more details. The token is generated upon verification of user identity.
This goes with other changes they did to chromium. Google claims it is to prevent bots, but it really is a crackdown on ads blocking and any other "tampering" with their websites.
If you care about keeping web free, you should stop using chrome and its derivatives and switch to Firefox. They are believing that Firefox user base is low and websites can simply exclude FF and force it to implement it as well.
Don’t sites already do this?
browsers can currently report to be anything. which is why Google is trying to stop it.
It's not about whether it's a chromium browser or not. It's about whether a browser is "trusted" and installed from a "trusted" source, like the windows store... Basically gatekeeping. Still, Firefox and any browser could still be approved.
This would be an insane damage to the Linux community since there are many different ways to install programms(including browsers).
Absolutely! I would wager a guess that something like this would require support on a package manager level, meaning that the biggest like Ubuntu or what not could have access to a functioning "trusted" browser. But good luck on a niche distro, or if you want to compile it yourself, or if you want to use certain extensions or....
What's more trusted than source code?
According to Google - probably source code that can't block ads and that is known to not block trackers... basically.
Or the API can die a quick death, like so many other Google products.