Hacker News Reader

Comment by ChrisMarshallNY | Hacker News Reader

That's a very well-written explanation!

I would hope that we see this kind of explanation more frequently.

So much better written than the articles that were at the top of HN originally. People somehow thought this would mean checking for ad block? The original proposal specifically called out that browser extensions are completely unrelated to WEI, which just calls into existing OS and TPM-based attestation APIs and makes the status of this attestation available to sites.

People think it's about checking for ad block because protecting ad revenue is the very first concern the proposal addresses. The obvious path is that Chrome implements WEI and disallows ad blocking, and then Google gradually starts pushing websites to favor approved browsers that don't allow ad blocking. Perhaps they pay out a bit extra for "authenticated" ad impressions made using an approved browser. Or they could start suspending AdSense accounts for "invalid traffic" (https://blog.google/products/ads-commerce/understanding-acco...) because a high percentage of visits have no WEI token or a token from an "unrecognized" browser. I'm sure you can imagine Google doing something like that: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

EFF clearly explains why the holdback mechanism doesn't make sense, and why the proposal authors' personal beliefs are not relevant. What matters is what capabilities this technology allows, and what Google's corporate motivations are.

> People somehow thought this would mean checking for ad block

This is an obvious consequence of this proposal, yes. Ad-block prevention isn't an explicit goal, just a very obvious consequence when you create a mechanism that whereby attesters (OS) inform the server about the presence or absence of software on your computer. It doesn't require a logical leap, it's a plainly obvious use case.

> Goals:

> Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device.

> People somehow thought this would mean checking for ad block?

No, the worry about adblock was that Google could now just remove the ability for that work in chrome and there would be nothing you could do, because your forked chromium wouldn't pass the attestation check (cause it would never be blessed by Google). This concern extends to other browsers as well. Because Google is making themselves the signing authority here, they can choose which browsers are allowed and which aren't, letting them force other browsers to add or drop certain features if they want to be granted attestation.

Not sure why you were downvoted. This is the exact scenario that will unfold in the mid term future.

Not to mention that chrome on android already does not have any access to extensions and thus adblocking. Isn't that awfully convenient? For GOOG that is.

Nope, not really. Still looks like the equivalent of anti-encryption people saying "think of the children". I still see no explanation on how WEI will magically change the behavior of website operators. They can already take steps to block unwanted clients, but no one is in any significant way which hinders the "open internet". WEI is meaningless unless Apple implements it. The only effect the current discussion will have on Apple is how they publicly frame their choice.

They already have implemented it. We and the eff for that matter made not a peep, nor mentioned it.

https://httptoolkit.com/blog/apple-private-access-tokens-att...

Maybe maybe it’s meaningless without Apple agreeing as things stand, because of iOS. But if the EU proposal about side loading forces Apple to allow Blink-Chrome instead of just WebKit-Chrome on iOS, then there’s not much holding Google back.

> I still see no explanation on how WEI will magically change the behavior of website operators

Google will change the behavior of website operators that use AdSense. They wouldn't want anyone to be artificially inflating their ad revenue with suspicious un-attested traffic: https://blog.google/products/ads-commerce/understanding-acco...

The missing explanation is to just assume websites become like smartphone apps in terms of restricting clients, for better or worse. This path has already been explored, so not much imagination is needed: https://stackoverflow.com/questions/27540545/how-to-prevent-...

Reply on news.ycombinator.com