Comment by shiomiru | Hacker News Reader

Comment by shiomiru | Hacker News Reader

By the way, a very similar API has apparently been implemented in Safari since 2022. Seems like better marketing does wonders, as I haven't seen any discussion of this.

https://blog.cloudflare.com/eliminating-captchas-on-iphones-...

Some interesting bits:

> [...] We don’t actually need or want the underlying data that’s being collected for this process, we just want to verify if a visitor is faking their device or user agent. [...]

> [...] In the example above, a visitor opens the Safari browser on their iPhone and tries to visit example.com.

> * Since Example uses Cloudflare to host their Origin, Cloudflare will ask the browser for a token.

> * Safari supports PATs, so it will make an API call to Apple’s Attester, asking them to attest.

> * The Apple attester will check various device components, confirm they are valid, and then make an API call to the Cloudflare Issuer (since Cloudflare acting as an Origin chooses to use the Cloudflare Issuer).

> * The Cloudflare Issuer generates a token, sends it to the browser, which in turn sends it to the origin.

> * Cloudflare then receives the token, and uses it to determine that we don’t need to show this user a CAPTCHA. [...]

Sounds an awful lot like WAI to me, but at least it's called a "Privacy Access Tokens" so it surely must be good...?

EDIT: turns out there was an HN thread about this a few days ago, I just missed it: https://news.ycombinator.com/item?id=36862494

> Sounds an awful lot like WAI to me, but at least it's called a "Privacy Access Tokens" so it surely must be good...?

Google's PR strategy is to say "no need to worry, it's just like this Apple thing". But as Google themselves note in their explainer¹, they're quite different, and Google considers PAT insufficient for the kind of enforcement they intend to do.

For example, PAT is ultimately just "not a bot" attestation and so doesn't involve the exchange of device and browser environment data. In contrast, WEI needs that data to enable the kind of "DRM for the web" use cases we're reading about.

https://github.com/RupertBenWiser/Web-Environment-Integrity/...

> we just want to verify if a visitor is faking their device or user agent

What does it mean to fake a device or user agent? Their intent is probably devices and user agents who say they’re one thing but are actually another. But browsers have been lying about who they are for decades. And what’s the difference between a fake device/UA and an unusual device/UA? Probably none, as far as they’re concerned.

I read about this last year in the original Cloudflare post. Cloudflare is a darling but I thought this one was dangerous for the web too.

I think the difference is that PAT allows ad blockers but WEI won't.

Does the PAT implementation still require that the page content is being rendered live to a human user, or not exported or something?

(I know web APIs can't directly prevent those things, but they might be able to let a site determine whether a user is doing something to prevent CSS or Javascript tricks from preventing them.)

PAT and WEI can allow and disallow whatever the hell they want, there's nothing preventing WEI from allowing ad blockers just like there's nothing preventing PATs from disallowing them. They are exactly the same technology (remote attestation, entirely outside of the user's control).

Reply on news.ycombinator.com