Request for Mozilla Position on an Emerging Web Specification Specification Title: Web Environment Integrity API Specification or proposal URL (if available): https://rupertbenwiser.github.io/Web-E...
Can someone explain to me the google API and DRM situation in stupid people terms? I’m stupidly tech illiterate but I know that this is a big deal and I would like to understand
Sure thing. With this current proposal, when you visit a website, the site asks your browser if you’re willing to display it as intended, basically with all and any adverts. If the answer is no, then you can’t see the content, if the answer is yes, then you’re likely using Chrome or a Chromium based browser and Google can guarantee more ad impressions, because they’re first and foremost an advert selling company.
I may not be 100% right, as I haven’t looked at it in detail, but I think it’s even a bit more than that. Since the way that’s proven is by the browser vendor signing the request (I assume with an HTTP header or something), you could also verify it’s from a specific vendor. So even if Mozilla says, yes, we’ll display your ads, a website could still lock down to Chrome. It would probably also significantly hamper new browsers, and browsers with a security/anti-ad focus, as they won’t be recognised by major websites that use the new protocol until they have market share, which they won’t get if they don’t have access to major websites.
A) Maybe not you, maybe not me or anyone else here, but 99.99% of the rest of the world? And when the rest leave, is Mozilla really going to be able to justify maintaining a browser for those that remain?
B) There might not be a website that would do it, but what about if practically all websites with any corporate backing did it?
This is the fundamental point that so many techies fail to get. Saying “I’ll be fine, I’ll do X” is irrelevant. If nobody’s doing what you want to do, then eventually you won’t be able to do it either.
Because it’s not just going to say yes. It’s going to say yes, and then present an unique key that browser made for themselves. Other browsers might be able to spoof the key, but the proposal might have cryptographically expensive to even try.
And that signature can’t be spoofed? Or the browser can’t be sandboxed and quarantined so it is made unaware of such software, and the software applied retroactively?
People will always find a workaround, look at rooting of phones for example. But they shouldn’t have to. I mean look at how banking apps refuse to work on rooted phones but work in a browser on your desktop without any issues. It will be the same with this. Your device is rooted, we can’t show you this webpage.
I bet you heard about safetynet on android devices. It is a service that checks if you run a genuine licensed not-modified version of android. If not - app developer can just restrict you access to the app. It is mostly used by banking apps, but there’re many examples of not security critical apps utilize this.
Google wants to do the same but for browsers and websites. If you run firefox or modified chrome or use adblocks: youtube, twitter, etc. would be able to detect it and can restrict access to the website.
If you root your device correctly. Can’t expect most mobile users to do that. Can’t expect users with locked bootloaders to do that. Can’t even expect many power users to do that. A lot of very tech literate people I know that customise their computer OS heavily still don’t want to root their phone.
if they dont like your browser you cant view the site , ultimately its gonna be google who will be deciding what conditions your browser has to fulfill to be approved and the big one they wont say outright is adblockers , if you have an adblocker they will not allow you to veiw the site
Can someone explain to me the google API and DRM situation in stupid people terms? I’m stupidly tech illiterate but I know that this is a big deal and I would like to understand
Sure thing. With this current proposal, when you visit a website, the site asks your browser if you’re willing to display it as intended, basically with all and any adverts. If the answer is no, then you can’t see the content, if the answer is yes, then you’re likely using Chrome or a Chromium based browser and Google can guarantee more ad impressions, because they’re first and foremost an advert selling company.
I may not be 100% right, as I haven’t looked at it in detail, but I think it’s even a bit more than that. Since the way that’s proven is by the browser vendor signing the request (I assume with an HTTP header or something), you could also verify it’s from a specific vendor. So even if Mozilla says, yes, we’ll display your ads, a website could still lock down to Chrome. It would probably also significantly hamper new browsers, and browsers with a security/anti-ad focus, as they won’t be recognised by major websites that use the new protocol until they have market share, which they won’t get if they don’t have access to major websites.
Removed by mod
A) Maybe not you, maybe not me or anyone else here, but 99.99% of the rest of the world? And when the rest leave, is Mozilla really going to be able to justify maintaining a browser for those that remain? B) There might not be a website that would do it, but what about if practically all websites with any corporate backing did it?
This is the fundamental point that so many techies fail to get. Saying “I’ll be fine, I’ll do X” is irrelevant. If nobody’s doing what you want to do, then eventually you won’t be able to do it either.
I mean, they already do that by filtering out user agents. But this is certainly a step beyond.
Which is why all browsers cross identify as other browsers. This would make it easier for sites to block and harder for browsers to work around.
Thanks so much, I understand now. God, is that a shitty move for Google to pull
Why can’t your browser lie and say “yes of course I’m displaying everything my fingers definitely aren’t crossed behind my back”?
Because it’s not just going to say yes. It’s going to say yes, and then present an unique key that browser made for themselves. Other browsers might be able to spoof the key, but the proposal might have cryptographically expensive to even try.
What about replying yes, then blocking ads?
Your device would return a signature to say that there’s no adblocking software on the device.
And that signature can’t be spoofed? Or the browser can’t be sandboxed and quarantined so it is made unaware of such software, and the software applied retroactively?
People will always find a workaround, look at rooting of phones for example. But they shouldn’t have to. I mean look at how banking apps refuse to work on rooted phones but work in a browser on your desktop without any issues. It will be the same with this. Your device is rooted, we can’t show you this webpage.
I bet you heard about safetynet on android devices. It is a service that checks if you run a genuine licensed not-modified version of android. If not - app developer can just restrict you access to the app. It is mostly used by banking apps, but there’re many examples of not security critical apps utilize this.
Google wants to do the same but for browsers and websites. If you run firefox or modified chrome or use adblocks: youtube, twitter, etc. would be able to detect it and can restrict access to the website.
Removed by mod
If you root your device correctly. Can’t expect most mobile users to do that. Can’t expect users with locked bootloaders to do that. Can’t even expect many power users to do that. A lot of very tech literate people I know that customise their computer OS heavily still don’t want to root their phone.
Only because nobody is actually enforcing key-backed attestation.
if they dont like your browser you cant view the site , ultimately its gonna be google who will be deciding what conditions your browser has to fulfill to be approved and the big one they wont say outright is adblockers , if you have an adblocker they will not allow you to veiw the site
deleted by creator