Hacker News Reader

Comment by jchw | Hacker News Reader

> We look forward to discussing the future of telco network security with our ecosystem and industry partners and standardization bodies. We will also continue to partner with academic institutions to solve complex problems in network security. We see tremendous opportunities to curb FBS threats, and we are excited to work with the broader industry to solve them.

I'll be honest. The stuff in this article is good, if a little underwhelming, but I feel a large amount of distrust for Google nowadays, to the point where what would've felt like unnecessary pessimism now feels only rational to me.

Ever since Google dropped WEI into our lives, I feel like they should not be allowed to be a part of any security efforts in any standards body or ecosystem. How long until carriers try to limit devices that don't support Google Play or Apple remote attestation of some kind?

I don't know what to think or do anymore.

View on HN

> Ever since Google dropped WEI into our lives, I feel like they should not be allowed to be a part of any security efforts in any standards body or ecosystem. How long until carriers try to limit devices that don't support Google Play or Apple remote attestation of some kind?

Wait, so no Google or Apple employees involved in any standards body security efforts. What about TPM? Better ban employees from Intel, AMD, Qualcomm, Microsoft...who's left?

I mean, that's a take, but it seems like really the take away is that we should be skeptical of company motivations and security issues in standards bodies should be dealt with transparently, which all seems like a good take?

Until some kind of regulatory action occurs, I especially do not believe Google should be allowed. Intel definitely has its misgivings and conflicts of interest, but Intel doesn't have the same conflicts of interest that Google has.

I truly believe Google is off on their own island of being impossible to trust in their current state.

Especially not in a world where W3C gleefully standardizes literal DRM.

How is it worse when Google wants to implement something that Apple already did? I mean it's bad but being number two to implement it seems like the regulators should look at Apple first, not Google.

>I mean it's bad but being number two to implement it

Number is irrelevant - power is.

>seems like the regulators should look at Apple first, not Google.

If some one person company proposed this instead, would you want regulators to look at them first?

To put it simply - Apple does not provide OS to smartphones and PCs, it manufactures them. So as long as they do not produce 50% of PCs or 50% of phones or have Microsoft agreeing with their proposal then they are lesser threat (for now).

It's like with Monopolies and Cartels - power over market should bring relative response from regulators over company - especially if that company tries to create proposal which invades users privacy.

I'm not sure if I agree that Google's future intent is the bigger threat versus Apple already using it.

>So as long as they do not produce 50% of PCs or 50% of phones

Apple's market share in the US smartphone market is at almost 58%.

>It's like with Monopolies and Cartels

Yes, and I'm not saying Google shouldn't be looked into if necessary, but Apple has a 100% monopoly on iPhones unlike Google on Android and PC where you can switch browser.

If Apple is stopped, there are no reasons to go after Google, as it would also be illegal for them to do the same. Two birds with one stone – and Apple definitely also needs to be stopped.

> Apple's market share in the US smartphone market is at almost 58%.

And less than 30% worldwide.

> and PC where you can switch browser.

Under condition that you are not using anything other than Windows/ChromeOS - then no matter how much you switch the browser the OS stack will still not be certified - like DRM always fails to work on my end.

>If Apple is stopped, there are no reasons to go after Google, as it would also be illegal for them to do the same.

You are missing the point for me - Apple is just somewhat big¹ hardware company with niche¹ system. If you want to fight them because they have enormous power on your market - power to you, but from global perspective "no reasons to go after Google" is clearly misguided.

¹from my country perspective

Yes, I see your point. Hope something is done.

> How is it worse when Google wants to implement something that Apple already did?

P.S.

It isn't worse - both are terrible and both should ultimately be scrapped. Just because one company invents invasive bs doesn't give rest right to continue with that.

Before someone says Apple has 50% of phones - no it does not. Based on worldwide data not US one.

> How is it worse when Google wants to implement something that Apple already did?

Intent.

How is Google's intent worse for an iPhone user? They can avoid Chrome, but not Apple's implementation. Anyways, both should be looked into.

You're so close. That's right, no one is left. That is why we need help with open source designs

The WEI discourse is just getting comical. it may be bad for the open internet, or for the browser ecosystem. but it's not a security flaw.

to say you don't trust google to be part of any security efforts because they tried to put security in a place you don't want it is silly. you're arguing the slippery slope fallacy here, there's no reason to think that carriers would even want any sort of device attestation, or be legally allowed to do that under the terms of their spectrum licenses.

Of course it's a security flaw, but it's a security flaw for the end user, not google. It's google's security, like them putting their own lock on your door that they can a remotely activate on a whim. This is what most humans would call a security flaw, but it's a non traditional one for sure.

I guess security is only ever defined with respect to specific security threats.

There are quite a few of those "dual use" features where you have a primary purpose of protecting some oligopolist's business model but the incidental side-effects range from beneficial to catastrophic in terms of security for users.

Take Apple's side-loading ban for instance. It makes obvious sense for Apple's own interests. Beyond this primary purpose, it protects people against getting tricked into installing malware but it also poses a threat to human rights and freedom of speech as it gives whoever is in power central control over the software people can use to protect themselves.

Google's WEI is another such dual use technology that can be portrayed in many different ways, because it really does have different consequences for different people at different times.

? I didn't say it's a security flaw. The problem is that it's a terrible, user-hostile, open-web-hostile approach to security that shouldn't have even been proposed.

>there's no reason to think that carriers would even want any sort of device attestation

With the bargaining power that Google has in the mobile space, I strongly suspect they could find a way to entice carriers into moving towards enforcing device attestation. And I don't just mean forcing devices to attest; I mean things like, Hmmm, are you sure you want these untrusted Android devices on your RCS services?

> or be legally allowed to do that under the terms of their spectrum licenses.

I don't really like relying on hoping the laws will help, but it would be nice to know for sure if they do. Unfortunately, I am assuming you aren't actually positive.

Google Fi definitely favors Google devices heavily and there is no supported way to use a non-data-only device without an Android phone with GMS.

> ? I didn't say it's a security flaw.

Nobody said you did. Normally, crummy security(security flaws) is what disqualifies someone from security and not functioning security. You're comment implied WEI would work as imagined and you remarked that should disqualify Google from security. That's a bit ass-backwards, disqualifying someone because they didn't introduce security flaws.

> The problem is that it's a terrible, user-hostile, open-web-hostile approach to security that shouldn't have even been proposed.

But it isn't a security flaw. And no, it isn't a terrible, user-hostile, open-web-hostile approach to security. It's just a gleam in someone's eye who's stated goal is to not create something which is a terrible, user-hostile, open-web-hostile security approach but some additional signal which websites can try to use to filter out malicious traffic. Why do WEI critics always come off as sounding like the "think of children" anti-encryption fear mongers? At least wait until it becomes something first.

> With the bargaining power that Google has in the mobile space, I strongly suspect they could find a way to entice carriers into moving towards enforcing device attestation. And I don't just mean forcing devices to attest; I mean things like, Hmmm, are you sure you want these untrusted Android devices on your RCS services?

With the bargaining power that Apple has in the mobile space, I strongly suspect carriers can tell Google to pound sand. Unless Google is implementing something Apple has already, I doubt that will happen.

At least wait until the bank robbers have spent their loot before calling the police, because they might be just about to bring it back.

I don't understand why you think the literal only way a security standard can be bad is if it has a literal security flaw. What Google is doing is bad for reasons other than security flaws, but it's no different from the other reasons why Google being involved in standards other than security standards is bad. It's just that in this case, their evil, user-hostile mechanism has absolutely no reasonable use case outside of security.

Yes, developing bad, user-hostile, open-ecosystem-hostile security standards should indeed bar you from security standards work even if the prison you've built for end users is maximally secure.

> disqualifying someone because they didn't introduce security flaws.

Actually they did introduce a giant security flaw: https://news.ycombinator.com/item?id=36985317

Because of this I propose that "the users should require that server attest it, environment and content with respectable attester before it provide any other data to the user - user should get signal if server operates on up-to date unmodified stack and did not modify server environment in any way to track, monitor, gather (steal) user's data, nor is compromised." How about that?

>"the the bargaining power that Apple has in the mobile space"

Like 30% (and loosing) of worldwide phones? Think globally not US. And we shouldn't forget that Apple may loose EU market altogether because of it inflexibility when comes to battery replaceability.

>Why do WEI critics always come off as sounding like the "think of children" anti-encryption fear mongers?

No we do not. In fact many just want opposite - for encryption not to be used as power over common people but by the people.

> "At least wait until it becomes something first."

As Google implements it before even finalizing proposal and banned all comments and pulls - I will not.

> It's just a gleam in someone's eye who's stated goal is to not create something which is a terrible, user-hostile, open-web-hostile security approach but some additional signal which websites can try to use to filter out malicious traffic.

To put it by analogy from Car owning company: "We propose that any package delivery must be delivered in secure and attested way - so we propose mechanism that will provide way for smaller companies fly drone before you get your package. We will not allow them to sell your photos - pinky promise."

This is more or less how I feel about Google promises.

If you propose something on global - you should take all the time to think about ways that it can be mismanaged before you even propose it, If you trivialize concerns then you are as guilty when they inevitably happen.

>some additional signal which websites can try to use to filter out malicious traffic.

"The solution to the surveillance economy seems to be more surveillance."

This is quite good quote - because if you think for second about this phrase it should give you good idea what You can get…

WEI will be the ālea of Internet.

Google is a large company. One part can do good while another part does bad. It's not as if anybody thinks Pichai is directing it all with any success :)

Google is a profit-seeking machine who has long shed any "startup" stage principles ("don't be evil" and such) as luxuries.

Even the parts that do good feed the parts that do bad.

Agreed

Companies have many incentives and they play out in different ways. It's possible to have that result in some things that you think are good and some which you don't. At a certain size, there is no longer a unified set of values holding everything together and inevitably, some values will clash with yours. Lumping everything into one pile is dramatic.

>Lumping everything into one pile is dramatic.

In the end there's a net result. Doesn't matter if it "put out a good backup app", if they also got to own the web or build Skynet.

>In the end there's a net result

There is, but the financial net result is only known with hindsight. Exactly which actions boost the net result in a particular time frame always remains uncertain.

Also, the people who work for corporations have their own goals and net results, such as promoting their own careers or self esteem.

Shareholders may wish for a single minded, deterministic, profit seeking machine but that is not a possibility. Capitalism just provides vague, incomplete and even contradictory incentives.

>There is, but the financial net result is only known with hindsight.

I mean a net result regarding the impact it has on society.

>Shareholders may wish for a single minded, deterministic, profit seeking machine but that is not a possibility.

Yes, but my point is not based on some total purity of absolute profit seeking.

It's enough that we can observe for 20 plus years now actions with harmful intentions and harmful effects, primarily motivated and explained by profit seeking.

It doesn't have to be Google's (or any companys or organizations) absolute and only priority, nor everybody has to be single-mindedly going for it all of the time, Google doesn't even have to be totally effective in this goal for them to perform profit-increase-oriented harmful actions.

I mean, it's such a pedantic point! What you wrote is common sense, and it wasn't contended. I didn't paint them as pure-profit-seeking-pure-evil-nothing-else.

Just as an actor that causes harm in pursuit of its profit-seeking.

Unless you believe Google is controlled on the micro-level by some all-knowing AI with the single goal of profit seeking, and it can ultimately align every one of their goals to profit, that is just an overly naive take. People/bureaucracy is faulty, even at being evil.

>Unless you believe Google is controlled on the micro-level by some all-knowing AI with the single goal of profit seeking, and it can ultimately align every one of their goals to profit, that is just an overly naive take.

Yes, because a company can be a negative actor driven by profit-seeking only if it is "controlled on the micro-level by some all-knowing AI with the single goal of profit seeking, and it can ultimately align every one of their goals to profit".

To think otherwise would be naive /s

Thanks for the nuance!

That's one way of looking at it. My way of looking at it lately is: Why would a trillion dollar company pay obscene salaries to work on this?

That's, of course, not the point. For example, I believe the Chromium team has done plenty of good, too, but the C-suite, directors and shareholders are at best, completely complicit in a lot of the sketchy, corrupt activity that Google is endeavoring in with standards, Android, etc.

So it's difficult to trust them with anything. There are plenty of great people at Google, but they're not able to stop the awful things Google does, so why does it matter?

I don't think the stuff in the article is really that great. Google is basically shoring up a few possible avenues of man in the middle attacks.

Meanwhile, the mobile ecosystem is still rife with many other avenues - your MVNO, fractured Ma Bell, Play Services still has outsized privileges on standard Android, most apps aren't E2EE (despite the article's bastardized use of the term), etc. It's just this boring corporate security narrative where we're supposed to continue ignoring the 800lb gorillas selling our personal information into countless surveillance databases and focus on how they're closing down possible independent attackers.

What would be newsworthy is if they were even talking about real security - libre baseband, mitigating protocol identifiers (eg IMEI) that allow for pervasive location tracking, etc.

> Ever since Google dropped WEI into our lives, I feel like they should not be allowed to be a part of any security efforts in any standards body or ecosystem.

Excluding Apple and Google, the remaining bodies are MS, Amazon and Facebook which presence is close to non-existent in the mobile OS market. Good luck with them?

Out of all the bad things Google has done, WEI was what made you feel that? I don't even think WEI is unanimously bad.

It feels like folks reacting to WEI are just riding a wave of publicity and outlash. There are many reasons that WEI sounds like a good idea, but a reasonable debate can't even occur in the current climate. I would like the ability to improve websites' trust in me, and use services that are free of bots, but apparently giving me the ability to do that might somehow endanger folks rights to not do that so I am not going to be allowed to? What's next, people will be outraged that I show my state issued id before entering age restricted stores?

I believe that the concern is that it will infringe on some people's ability to use their computers to interact with some websites (something which is vital to living in our modern society). My computers all run Linux and I use Firefox so this is a personal issue for a lot of people. As someone who is only able to use sites like Netflix on my computer through the continued generosity of a bunch of large corporations (honestly it's really good fortune) this makes me extremely uncomfortable. Especially since the whole point of EME was to prevent privacy and it hasn't done that (100% of Netflix content is trivially available to anyone via a multitude of pirate sites) so...

How can parties which have no power have any kind of dialogue with a megacorp with billions of dollars. From a thousand miles up the only level of dissatisfaction that is even noticeable is the kind where people throw their androids in a lake and switch to Apple and Bing.

Exactly zero folks are liable to notice that you have a subtle nuanced analysis regarding their strategic direction with a feature. It would be like you telling a star about how you feel about how they wore their hair at a show 3 weeks ago. Your opinion is either invisible or irrelevant.

> There are many reasons that WEI sounds like a good idea

I know I'm biased in my opinion on WEI, my initial reaction was extremely negative.

That said, I'm willing to be open minded here. As a user, how does WEI benefit me?

I can easily see how WEI benefit's advertising companies like Google and how it benefits advertisers that want to track their campaign's effectiveness. What I can't see is how it benefits a user of the web.

I don't care if I'm responding to a bot if the conversation is meaningful, nor do I care if a bot posted some content to whatever content feed I'm currently browsing because I like to see content and it doesn't matter if a bot or human posted it, to me.

What is the benefit in "improving websites' trust in me" to me as a user? As a web developer, I do not trust my users nor would I ever trust them. This is a core principal in application development.

You'll have to solve fewer captchas. You'll see less spam in website comments. Fewer websites will be behind a login wall.

> You'll see less spam in website comments.

The "give up your freedom to prevent crime" argument isn't new or compelling. I'd rather keep what little privacy I have and put up with spammers.

As for captchas and logins, I'm not sure that'll change much. Websites still want to spam us so they'll keep asking for our email addresses, and companies still have AI to train so they still have to force us to identify buses and crosswalks. I also don't care for the idea of participating in a protection racket. "Just give us all your data and we'll stop annoying you by demanding it" isn't much better than "just pay us and we'll stop trashing your property"

> You'll have to solve fewer captchas.

Alright, you got me. There is a tiny, minor, insignificant benefit. This is not worth giving up any control of my own PC.

> You'll see less spam in website comments.

Highly unlikely. This will be defeated by spammers just like every other attempt to stop them is.

> Fewer websites will be behind a login wall.

Not just highly unlikely, but absolutely not going to happen. No site that currently requires login will change to not require login. No site will give up that user data.

Put briefly, yes. And I do think WEI is unanimously bad. I am alarmed that anyone thinks this is a reasonable idea.

Reply on news.ycombinator.com