Hacker News Reader

Comment by haswell | Hacker News Reader

If the window even applies here, it expanded the moment Google initiated all of this publicly.

We're in it now, and fully understanding the issue and the problems it purports to solve is incredibly important.

Dialogue is all we have, and to even build a solid argument against WEI, understanding the details matters.

It's worth understanding the problem it purports to solve in order to properly dismiss it. WEI positions itself in a way that sounds ambiguously like it might ever serve the user's purposes, and a clear framing of the problem statement would make it more obvious that it does not serve the user at all.

For instance, one of the framings of WEI is that it gives advertisers a way to verify the client so they don't "have" to do fingerprinting. Except WEI does nothing to take away fingerprinting, so advertisers will then have fingerprinting and WEI. (Even if it did simultaneously take away fingerprinting it would still not be OK, but the current framing is not even offering the user benefit it claims to offer.)

Before taking away fingerprinting there would need to be a sunset period to have everyone migrate over to the new API. Ripping it out before new APIs are available or doing it at the same time is irresponsible.

I'm not sure how that addresses the point you're responding to: regardless of the excuse, WEI with fingerprinting is bad, and WEI without fingerprinting is also bad, and fingerprinting without WEI is also bad

doing bad things (for example, any of the 3 above options) is more irresponsible than implementing bad things poorly

So how do you intend to prevent fraud and abuse? You need signals of some kind to know whether a visitor is likely to be malicious or not.

You don't have to worry about ad fraud if advertising goes away.

Let me ask you instead: "how you intend to prevent matrimonial fraud?"

…

You can not. Because that is not how world works - crime did happen, happens, and will happen. You can stop attempts or fight it by education or by arresting criminals but never eliminate or prevent it.

"You need signals of some kind to know whether a visitor is likely to be malicious or not."

Innkeeper in 13 century: "I need signals of some kind to know whether a visitor is likely to be malicious or not before he enters." - See how ridiculous it is?

You are being being wrong here - you don't have 'visitor' but 'client' and as far as I'm concerned you do not spy on every client to "know" if he "is likely to be malicious or not". You may be suspicious of client activities but that is what you can realistically do.

Also define "fraud and abuse" because this can mean many things which may have many solutions.

>Innkeeper in 13 century: "I need signals of some kind to know whether a visitor is likely to be malicious or not before he enters." - See how ridiculous it is?

That innkeeper would have used the signal of how the visitor looks. If a visitor was being malicious and got kicked out, that person could not just come right back in as the inkeeper would be able to tell that he was the same person as before.

Also your metaphor is not great because WEI can only happen after the first page load since it requires the site to use javascript to use the api.

>That innkeeper would have used the signal of how the visitor looks

Not like that ever backfired.

>inkeeper would be able to tell

assuming that he have photographic memory and visitor did not change his looks by any way (shaving, getting scar etc.).

if you have to refer to 'looks' you have IP - it has exactly same power as signal as looks.

>Also your metaphor is not great because WEI can only happen after the first page load since it requires the site to use javascript to use the api.

for user that is irrelevant point. As people do not care about how you run server - only if they can use the page.

To put simple - I run My browser of choice on my OS of choice with my stack as I wish (otherwise I wouldn't run Linux). The idea that server owner should get any say about this is simply intrusive.

an interesting question

maybe your wish is possible, maybe not at all!

in any case, WEI and fingerprinting are both still bad regardless of the answer anyone might provide

Agreed. If WEI means browsers can more aggressively restrict fingerprinting in all for it.

I don’t think there is any indication that this would be the automatic outcome.

There is zero connection between WEI existing and browsers being able to restrict fingerprinting.

There are various stakeholder interests which need to be balanced. As much as people like to invent nefarious motives, in reality there likely important players on the internet who have valid use cases for fingerprinting which cannot be broken carelessly. Efforts like WEI try to address their needs via alternative means. I agree that it's bot a guarantee, but it certainly seems like a possibility.

"There are various stakeholder interests which need to be balanced,"

said the giving-alcohol-and-cigarettes-to-children lobby,

"As much as people like to invent nefarious motives, in reality there are important players manufacturing alcohol and cigarettes who have valid use cases for children consuming them which cannot be broken carelessly."

Is there really much browsers can do to actually effectively restrict fingerprinting without going all out like Tor Browser? WEI may disincentivize websites to not use fingerprinting, but if they really wanted to, they could use it for de-anonymization purposes.

You can't "take away" fingerprinting, because it isn't a single API or even a single set of APIs. Fingerprinting is a set of techniques; you can nullify some of them, but there is nothing stopping companies from inventing new ones.

Despite what Google say, fingerprinting will never go away - any new feature in that space will just be in addition to existing and future fingerprinting techniques.

But the details aren't the issue. It's the entire idea of remote attestation that is repulsive and user-hostile.

Otherwise I agree that examining the details doesn't move the Overton window - the broad idea already did that.

Details aren't the issue and that's exactly my point.

There is no reason to discuss on average how many lightning rods we should place on each street and the necessary budget allocations and compromises that would need to be made and how this whole undertaking would be facilitated.

We have been doing just fine without these lightning rods on every street proposal Google made. We knew we could have it, we don't have it because we don't want it.

The problems it aims to solve seems like an issue for google or those that care if their ad is viewed by a human or not. Can someone give a counter argument of how this might benefit the users themselves?.

Chrome on android is completely unusable due to no adblocker, is this what WEI will do everywhere?

>Can someone give a counter argument of how this might benefit the users themselves?

Remote attestation might reduce the amount of cheaters in games and fraud in banks if implemented properly. So, through potential indirect means.

I don't think any of this is worth the loss of user freedom and functionality, though. So I will vehemently oppose WEI and similar to be used outside of internal facilities.

Anti-cheats are already remote attestation in theory for online games and they are unable to protect the process perfectly. They are unable to detect alterations to the process memory and be correct in their attestation at all times.

And cheating isn't a significant problem in in-browser games, it's not like anyone modified the browser source to create cheats for in-browser games. And for competitive online games, we have a great imperfect attempt at showing what remote attestation would look like. Anti cheat in games.

We have AAA titles that work flawlessly under Proton but you can't play them on Linux because anti-cheat needs to do DKOM on your Windows kernel before it lets you play.

I agree with the rest of your post though.

Reply on news.ycombinator.com