1y ago

Google Wants To Destroy The Internet...

...with Apple and Microsoft, Mutahar's turn to take a look at "Web Environment Integrity"

28 comments

Yesterday I saw a meme on reddit about browsers and I did not see even one person mentioning this WEI shit. Everyone was praising Chrome. We are truly fucked.
- So reddit is definetly being astrosurfed hard isnt it?
  
  Always has been
- It's because people that are about FOSS, freedom and privacy have moved to lemmy already
- I imagine some will change their minds as soon as ad blocking starts to fail.
- One thing I don't understand about all of this WEI: can't we just use a user agent switcher / spoofer to 'look' like chrome or any other browser and OS to counter this?
  
  While I haven't seen data to back this up, another Lemmy user called out that Intel chips may have support for running secure code the user cannot modify. The results are signed by an encryption key on the motherboard/CPU that cannot be extracted to fake the signature.
  So let's say Chrome asks this hardware module to hash the executable code and some state for itself currently in RAM and sign it with Intel's private key on the motherboard/CPU. The "some state" portion ensures the hash is always unique. Maybe it is just a timestamp. Regardless, this helps the attestation server know Chrome has not been modified because the hash is unique and cannot simply be captured in flight once and then replayed/faked over and over like a user-agent string.
  
  This isn't about a user agent. In basic terms there is supposed to be some kind of software that attests that the browser is actually what it claims to be. On the other side, a server can trust this "attester" or not. So even if you wrote software that always attests what the browser claims to be, Netflix for example could say "nah, I don't trust you bro".
  On Android this attestation would be done by the Google play services (afaik). On desktop, the OSs would need to implement this attestation.
  Please someone correct me if I'm wrong on this.

Here is an alternative Piped link(s): https://piped.video/watch?v=5joNRJ3C5ho
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source, check me out at GitHub.

I have finally made the full conversion away from Google. Email, browser, search all out of their hands. The one that took the longest to happen was the browser. Firefox finally is working great for me now.
- Email is tough one for me. Any recommendations? I tried Proton but their mobile app is (was?) disaster, and only limited to one logged in account at once which is a deal breaker for me.
  
  Posteo or Runbox are good libre options. You have to rent however
  
  zoho mail is what I use.

apple might oppose this to some point, they're often not in line with google.
- The best way to oppose this is to use non-chromium browsers like Firefox and take away Google’s source of power: chromium market share
  
  i agree, the problem is, that if google succeeds and (popular/mainstream) websites refuse to let said browsers access the sites, it's an uphill battle in wich we will eventually lose the normie webizens.
- Apple only opposes Google when new browser capabilites like PWAs, Bluetooth API, NFC API,... might be a threat to the Appstore monopoly on iOS.
  I think they are very much onboard with this since it you could potentially make live hell for Hackintosh and Jailbreak users.
  
  i wouldn't be so sure about it. apple strongarmed google with jpgxl support and the european union pryed open their eco system, at least for eu citizens. apple currently positioning themselves on the side of privacy advocates would lose this standing (and many customers who switched to iphone because of it). i know, they could sugarcoat this, but i have a little hope left that they will draw a line on at least the most user hostile stuff.
- Apple already has their own thing for this https://httptoolkit.com/blog/apple-private-access-tokens-attestation/
  
  welp, i guess it's over.
- I think they already implemented this onto Safari

28 comments