Google Web Environment Integrity Is the New Microsoft Trusted Computing

"Is your stuff going to keep working? There's literally a website dedicated to the products Google has killed. What makes you think you're so special that they won't do that to something you use?"

Of course, you're probably sleeping on the couch that evening...

Once upon a time, I was a homeless teenager running from a cult. If not for software I wouldn't have gotten out of that.

WEI (and other such things) are mainly about regulating who is allowed to write software, and so the way I think about it is this: If WEI existed when I was a homeless teenager, I might be dead.

I do not think I would like your girlfriend very much if she said keeping "her" stuff working was more important than my life, although I could understand her not understanding how big of a deal it is when you talk abstractly about the "open nature of the web" without putting it into human terms;

The "open" part is really important to get across because it means anyone who has the ability to can contribute: Does such a high level academic with a strong mathematical and logical background understand what can be lost not just to industry, but to science itself when a church wants to name itself the arbiter of who can work?

On personal level we have health - why can't I have fries and ice cream all day, everyday. That's what any sensible children would choose. Education - why can't I play video games and watch tik tok attention grabbing videos all day. In fact many do.

On country level, why would we want to help Ukraine or Taiwan. Why would we want to reduce carbon footprint. Stuff just keeps working.

Lead pipe worked just fine. Asbestos worked just fine. Smoking was just fine. Until they aren't.

Secondary effects require experience and education. We are not so good at grasping causal relationship when the results aren't immediate.

Most people are not qualified to give a crap.

We don't adopt medicines on the basis of "most people's" opinion, we don't adopt anything technological with potentially harmful impact on the basis of the opinion of large uninformed masses.

Thats why we have regulators and other institutions that should be informed and give an informed crap. On a ongoing basis and not only a result of popular outrage.

Which brings us to regulatory capture and said institutions actually failing their mandate to serve the interests of the people that fund them.

But now we have something that most people should give a crap about. This is not technical, it goes to the foundation of democracy and governance. Otherwise we might as well stop voting and accept we live in a corporate oligarchy.

I find the easiest way to make these people think, is to attack it from a money angle. Disregard all the ideological, practical, security, surveillance related issues. Ask them how would they feel if from tomorrow, they would need to shell out money, a $100 equivalent of their local currency when buying any kind of computer (ipads, mobile phones, pcs, macs) for a stamp of approval, and then having to fork over $10 every month for renewing an "attestation license".

You are not forced to get this stamp. There will be some websites restricted that you can't access, but your computer will keep working fine. First it will be your bank website, then streaming sites, then food ordering services, and so on, until eventually all the major services will be walled off until you pay.

Because that's what will happen (among other things). All this infrastructure will need setup, maintenance, and it will not be free, and you can bet your ass that FAANG (or whoever will be running the attestation services) will be charging whoever is using their services, and they will be forwarding the bill to you, the end user.

This is why we need to be politically active and politically effective and I'm glad OP called that out in their post too. It's like reminding people to vote when dealing with the consequences of elected officials.

edit: What business, other than an ad business, can safely say "we don't care what digital technologies we invent, as long as they are popular we can make piles of money." IMO, that is the motto of a dominant tech company. You can see a striking example of this failing with the various home assistants. Despite their popularity, tech companies can't figure out a way to shove ads into the UX, so they can't make money.

are they tho

The vast majority of Indian internet users are from mobile. It's a market lead by Xiaomi and other Chinese OEMs who sell phones that dies after a year or two with horrible ota updates. Some people downgrade, some use custom roms. But the majority just buys a new phone every 2-3 years. Or even 1 year. The poorest of people here buys iPhones with financing. Besides you don't need to buy expensive devices. Every GMS certified phone made in the last couple of years has it.

Now for actual computers, most are either prebuilts or laptops. They all come with secure boot since 2013?. The last Windows release without a mandatory TPM is going to be discontinued in 2025, microsoft will scare people into upgrading.

These are old machines. Any laptop made in the last 4 years will be able to access the new closed web so it won't be hard to replace of them.

I'm just hoping this "end of internet" happens really quickly. So that people would notice. One day people should wake up locked out of the web on their expensive devices. If it's a slow boil, we'll be too late to stop it. Again.

And also, frankly, I don't really frakking care if their purpose is to prevent ad fraud. That's not my problem, why should I be the one paying for Google to make more money from a problem they created themselves in the first place. As far as I'm concerned, if Google really wants to prevent ad fraud, they can just stop doing advertising; Problem solved.

They can only blame themselves for faking data.

Already, other browsers have led on tracking protection and control of third-party cookies, affecting Google's business model. So Google built Chrome, invested in it so people would prefer it, pushed it on their websites to ensure people would prefer it, and built a walled garden with Chrome Sync + Passwords.

Then they started using it to decrease privacy by signing in to Chrome when you sign in to Gmail. They track your websites visited and use it to improve their advertising even when the website doesn't use Google ads.

Theirs is the only password manager for Android which is limited to their browser. That's for a reason.

if we don't allow people who are contributing to the problem in any way or are benefitted by it, to oppose it, we are doomed to fail.

This is fundamentally the problem isn't it. They feel entitled _because_ they can dictate terms to the rest of the web, or at least they think so. There's no fixing this by changing Google's mind, only by forcing their hand by making this decision hurt their wallet. And as you point out, that only happens if people stay outside of the Google garden.

There was Opera as well.

MS hasn't thrown in the tower on Edge and is even still working on Internet Explorer.

Frankly I'm unsure if Firefoxs fate was to be EEL (embrace, extend, lock down) would we be worse off or better off than what we are right now with Chrome?

TLDR holdbacks might help with specifically the DRM component; but they can only go one of three ways:

- They can be effective at forcing sites not to rely on attestation, in which case there is no benefit to this proposal because everyone (including users of browsers like Chrome) will still be subjected to the same invasive backup strategies. You'll still be fingerprinted and tracked no matter what because even if you're using Chrome 1/20 times you send a request the website will just revert back to the original fingerprinting.

- Or if they aren't effective at forcing sites not to rely on attestation, well... then they haven't solved the DRM problem.

- Finally, attestation might be used to primarily decrease annoying behaviors, which will still in practice make browsing the web for anyone who doesn't use a browser with attestation so painful that they'll eventually switch. Think "you're not on Chrome, so you're going to see 9x the captchas you otherwise would see."

You can't simultaneously have "this allows us to trust the client" and "we can't rely on it." One of them has to give. At their best holdbacks would turn this into another tracking vector and would change nothing about the web for the better. More likely, holdbacks will allow sites that would previously be judicious about where they used captchas and blocks around the site to start spamming them everywhere -- because Chrome users will only see 5-10% of those annoyances. And at their worst, sites would just not implement the fallbacks because the attestation signal is still reliable enough.

Holdbacks call the entire motivation of this spec into question, since the whole point of holdbacks is to make it impossible for websites to get rid of the invasive "backup" walls and tracking and captchas that the spec claims to be trying to replace. Blocking ad fraud? Blocking automated requests? WEI only helps with that if websites can trust the signal and block browsers that aren't sending it; otherwise websites are right back to square one trying to prevent fraud. But if they can do better blocking based on that signal, then we're back in DRM territory.

----

Another point raised by another commenter: https://news.ycombinator.com/item?id=36884649

Implementing holdbacks in a way that actually prevents DRM is likely to be fairly challenging. In the most straightforward implementation, websites can simply retry the request until they get an attesation token or until they hit 10 iterations, at which point they'll ban you as normal.

Statistically profiling users and determining whether or not their browser supports attestation is likely to be fairly easy, unless Google has a much cleverer implementation of holdbacks than they've revealed so far in the spec.

This would be the worst case scenario -- holdbacks would be used as an excuse to push the changes through and sites would simply ignore them and block users based on aggregate stats: you haven't passed an attestation check in the past 30 minutes even though you made 20 different requests that should have had a token attached? Yeah, you're pretty likely on an "unsupported" browser.

I suspect most politicians this will be far too long and too technical for them to bother with.

We need PQ FIPS and TLS revisions; not this.

Yes completely impossible to fake by design. Otherwise whats the point? But I think the root of trust is whatever signs the hardware TPM module. So, Intel, AMD and Apple.

If I understand it correctly, the secure chain of trust will be something like, hardware TPM module -> secure boot -> windows signed kernel -> Chrome (signed binary). Its not clear to me if desktop linux will be able to participate in this ecosystem at all - which is ironic given how much google uses linux. Maybe a couple of the big distributions like Canonical will be able to sign their linux kernel builds.

> Lastly there is the social problem: is DRM the future of the web?

Its opt-in by website operators at least. Assuming this happens, there are two big questions in my mind:

1. How much of the web will go dark to anyone not using a corpo software stack? I imagine bank websites will adopt this technology immediately, while sites like HN, personal blogs and wikipedia won't touch this stuff. How much of the web will stop working on my terrible "hacker" computer where I use firefox on linux?

2. How will this interact with browser extensions and dev tools? If websites won't function outside of chrome, will we be able to continue to drive chrome programmatically? Will chrome's dev tools still work? Will websites be told about my ad blocker extensions? Will webdriver (and similar tools) be blocked?

This is the actual missing key bit. The problem that Google is trying to solve here is not actually a hardware / computational problem, it's a Real Identity problem. Hardware / TPMs are a poor proxy for solving that problem.

There's drastically less eWaste and impact on software freedom if you seek attestation from a national ID provider than if you seek attestation from one of a handful of personal electronics OEMs. National ID providers can offer to sign not only Real Identity attestations, but also anonymized attestations to protect citizen privacy. A web operator can decide whether to allow for attestations from only their own national ID provider, foreign national ID providers, private ID providers, or none at all if they just have a read-only site and don't really care.

The truth is that government inaction is forcing Big Tech down the road of violating user privacy and freedoms to solve Big Tech's problems. But getting the government to offer a flat Identity Provider playing field would solve these problems in a way that doesn't require such violation.

I'd expect threshold cryptography to solve that issue in the near future.

Citation needed. I'm pretty sure all Chromebooks have a TPM and it's a firm requirement for making one. ChromeOS uses the TPM extensively and fully supports remote attestation:

https://www.chromium.org/developers/design-documents/tpm-usa...

TPMs have been a requirement on PCs since at least 2016 I think, and in reality most came with them before that too (but there's a v1 vs v2 difference).

> a 1.X version of the TPM. In theory it performs just as well as TPM 2.X but they will not be supported because, again, I will not be able to use my own keys.

This is all wrong. TPM 1.2 uses SHA1 for everything which is a broken hash function so there is a major difference in robustness between them. That's why TPM 1.2 is being phased out. It has nothing to do with "using your own keys" which is out of the domain of what TPMs do anyway, TPMs are always owned by the device user. You're thinking of firmware boot signing and other things that are separate to the TPM chip but even there, you can use your own signing keys.

if they control your computer, they can prevent you from incurring in 'illegal' activities such as piracy

but it all boils down to the logic of the market, the raw fact that capitalism works even with marginal costs. but when copying (and distribution) costs go lower (less than 'marginal' down to zero cost) it all starts to break down

if people aren't selling digital assets to each other (which doesn't make sense with the technology we have right now), they cannot be taxed and so on.

solution: fix the technology. make it so that only those with specially authorized keys (trust worthy actors) can copy digital information at will. everybody else will have to pay them for this privilege.

oh and nevermind the fact that computers work by copying bits all over the place

I speculate that it might start off as a mesh network, maybe using unregulated spectrum on a local level. It will probably resemble BBS fidonet, but with more modern features. bandwidth and E2E latency will be terrible, but it will be free.

As long as there are skilled engineers who have the spirit of freedom, there will always be an 'open' network for humanity to communicate (with all the good and ills that comes with 'open').

Google is essentially hijacking the web and turning it into something that it can entirely control and dictate, since Google owns not only critical infrastructure (Chromium, the most used browser), but the most visited websites (Youtube, Search). That's a coup d'état, no more no less.

And the slippery slope is abrupt dude, we went from EME which was already spyware to WEI, and there will be a next step, since we would have already accepted Google's supremacy.

In which case the internet we all grew up creating will effectively turn into the "Ham radio" of digital computer communications and will be effectively bandwidth throttled the way amateur spectrum allocation is

Doesn't seem crazy that something like this would be the end result

If this is the future, I'm going to say "fuck the internet" and return to the soil.

We've allowed a lot of people to become really fucking lazy. That's the bottom line. Baby Boomers, some Millennials (not all), and a lot of Gen Z.

Generation X had no choice but to gain a strong knowledge of computers if they wanted to do anything on the Internet, because it was still difficult, it still required a little reading, and you couldn't just press the WPS button on your router to connect your new MacBook Pro.

Every single problem the web faces is that. Period.

A lot of people never had to learn jack shit, so they don't know jack shit. They can't tell the difference in a legitimate website versus one that isn't. They don't know how to read a web address. They can't figure out that irs.gov is legitimate and irs.4doad04ldud.com isn't. I have met people who are 50+ years old who have used Windows computers since they were 22 years old, but look absolutely goddamned dumbfounded when you tell them, "Just click on the Start button and go to Word."

Fuck.

Them.

Fuck every single one of them. We have tolerated lazy uninterested users for long enough. I'm not saying every computer user needs to be able to debug assembly code and fix their own driver issue by rewriting it from the ground up. I'm saying that as a society, we have progressed past the point where you can throw your hands up and say, "I'm JuSt NoT A CoMpUtEr PeRsOn!"

To quote Captain Jean-Luc Picard, "NOT GOOD ENOUGH! NOT GOOD ENOUGH, DAMMIT!"

And the entire industry across the entire planet and every single national, state, county, city, provencial, whatever government is going to have to get onboard, come together, and say, "Okay, here's a baseline set of knowledge about how computers and our communications systems work that every single human being needs to have."

You cannot "tech" your way out of this problem. Not without massive corporate and government overreach and invasion of people's privacy. Lazy shitty people are just going to have to be made to suffer until they stop being lazy and shitty. There are plenty of average IQ people who can grasp the basics of how their computer and the Internet work - but they're never made to. Well it's time to start making them.

The dumbing down of every single technological product and concept does our species no favors.