Hacker News Reader

Comment by pluc | Hacker News Reader

They're hijacking your internet. I'm not on social media and let me tell you the rest of the web still exists. Its pace is much slower, but it's there.

View on HN

Imagine a couple of years from now, you're working on some stuff for a client. Client sends you a link, but you can't open the link with your non-chromium browser of choice - it's been built on tech provided by google, and google says: You can only use chrome to view this site.

You try to download chrome, but since you once used some ad-block plugin, you've been banned from using all alphabet products. Google has also decided that in order to use chrome, you need to have a valid user account to login with.

Clients says screw this, I'm gonna find someone else.

(switch out client with friends, family, or whatever - one web for you, one web for the rest).

I think we can all think of potential futures. I don't see why this one is particularly likely. Google has open sourced the guts of its browser so others can make non-Google controlled browsers, and they fund one of the two only real competitors to their browser.

> you can't open the link with your non-chromium browser of choice - it's been built on tech provided by google, and google says: You can only use chrome to view this site.

That part is particularly likely because that's literally what Web Environment Integrity does.

Can you speak plainly? I don't think that is literally what it is. That might be a side-effect, but I'd need to see some evidence of that being the case.

WEI is a way to cryptographically prove to a remote website that you're really browsing it with an unmodified build of Chrome. Google hasn't said out loud yet that it's going to be used to block other browsers, but what else is there to use it for?

I don't think that's what it does. Where did you read that?

https://vivaldi.com/blog/googles-new-dangerous-web-environme... says:

> It would provide websites with an API telling them whether the browser and the platform it is running on that is currently in use is trusted by an authoritative third party (called an attester).

And https://www.xda-developers.com/google-web-environment-integr... says:

> The proposal threatens the free and open internet in a number of ways, but one of the biggest revolves around the fact that should there be a central server that attests to whether a browser can be trusted or not, it means that anything non-standard will not be trusted. In other words, new browsers would not be trusted, and legacy software would no longer be able to access much of the internet after a certain length of time. Given that it verifies the integrity of the browser, it could also technically block certain extensions (such as Adblock) if Google were to go down that route.

I understand what it could be used for - DNS and PKI as centralised structures could also be used to block things. Parler was kicked off all cloud platforms for political reasons.

But that doesn't mean that its sole purpose is to verify that you're using an official Chrome build.

DNS and PKI have a lot of other purposes, though. What other purposes for WEI can you think of?

I'm curious, what do you think it does?

https://en.wikipedia.org/wiki/Web_Environment_Integrity

The use it to validate if the browser you are using is one of their signed binaries.

Of course the original intention was to detect fraudulent ad clicks, but the reality will that you will be met by captchas every step of the way if you dare to compile your own binary.

that's what it does, it's called attestation.

It's being used to be able to tell bots from humans. A human will be required to run a browser with proper attestation that they're a human. It can be used for good (prevent bots from accessing the site) and bad (prevent humans from using anything but chrome).

How does that relate to this statement:

> WEI is a way to cryptographically prove to a remote website that you're really browsing it with an unmodified build of Chrome

What you're saying (and what I read) appears much more general than that. It could be used to block anything but official builds of Chrome, but that doesn't mean that's what it's for.

That's essentially what I said.

It's like a knife, it has lots of uses, one of them is to kill people.

The thread makes this clear. I'm arguing that "You can only use chrome to view this site." is not the only use. You seem to be agreeing, but adversarially.

well I guess fuck me for attempting to explain, no good deed goes unpunished.

adversarial indeed.

People can fork Google Chrome, yet none has done this so far. Not counting pretty GUI or some integrated extensions as a fork really. Google Chromium is genius marketing idea, hats off to the people who invented it, they convinced even programmers that there is some mythical "independent" Chromium project and anyone can fork it. Well, theoretically it is possible, but practically - not so much. The strategy is so successful that not even anti-monopoly departments aren't that interested in it.

Given Edge, Brave, Opera, Silk, Arc, Vivaldi, etc[0], are all built on Chromium, are you sure?

[0] https://en.wikipedia.org/wiki/Chromium_(web_browser)#Active

They are built on Chrome. Chromium is a shim, a pseudo-independent Chrome copy with some small changes, to pretend that there is no Chrome monopoly.

Can you cite how you know this?

Easy check - does Chromium project makes independent decisions and diverges from the decisions Chrome makes? Meaning, is it a true fork (disregarding who was first/original for a second) or not? So far it seems that everything Google pushes happens both in Chrome and Chromium. I mean significant decisions, like protocol support, rendering, etc. Sure, they cut out their spyware from it, just to please anti-monopoly organizations, but that's about all. Chromium is a puppet entity, existing only for Google's sake.

This is what is happening with my "Android for Work" profile. Since it's all Microsoft and "segregated", Outlook (for work) refuses to open links because I don't have Edge installed, even though I have Chrome and Firefox.

This is already happening with lots of small business websites -- they are only on Facebook, so you can't eg. look at the menu without a Facebook account.

Or company help desks, at this point after twitter changes its licensing lots of companies quit it, it was the only social media account I still used for chat-like help. Most now offer Facebook but under no circumstance am I going to create another account. Now I'm stuck with calling and waiting in line since they also stopped doing email (only callback service, which rarely works).

None of this seems very likely.

I send them instructions how to SFTP files to me if it's important enough they will do it. I've managed to get lawyers to use SFTP albeit with a GUI [0a]. If anyone wants to test it out, put "ohblog.net" in the host field, then something like mysql [0b] in the username, leave the password blank and upload silly things into the /pub in the directory. AdminHands is a decent SFTP app for cell phones. If that isn't an option they can mail them to me. If they are important and time sensitive then FedEx have door-to-door courier options.

Nowadays it is super simple to use GPG with email using Thunderbird, barely an inconvenience. [1] In my opinion everyone should set this up even if they do not plan to use it in the event something sensitive needs to be discussed and one does not trust platforms like Signal or WhatsApp which I do not. GPG is email provider agnostic. Mozilla are working on Thunderbird for phones. [2]

[0a] - https://winscp.net/

[0b] - https://ohblog.net/sftp_accounts_with_null_passwords.txt

[1] - https://www.zdnet.com/article/how-to-encrypt-email-in-thunde...

[2] - https://blog.thunderbird.net/2022/06/faq-thunderbird-mobile-...

If it's important enough they will do it

Notably, this also requires that you are important enough. To some people, like the hypothetical client, you are not.

I agree. For me personally that is a signal to cut ties with a business or organization. It's a red flag when orgs use crappy web portals that demand illogical or ill conceived compliance. I find those "turn key" solutions or platforms like Facebook to be full of dystopian and incompetent practices that are best to distance ones self from. Some may not find that an option but I can only hope that more people push back aggressively on malevolent patterns.

For now - but with changes like WEI (attestation) you may find that you have little choice to be part of "the rest of the web" unless you use an Approved Browser to do only Approved Things.

I'm not into social media either. But unless you want to live like a hermit, you don't have much choice nowadays but to visit these sites from time to time.

1. I can't use anything else other than WhatsApp for messaging with families and friends. Thank God my kids' school still uses good-old email for communications.

2. Almost all the useful video tutorials/mini-documentaries/science-shorts are on Youtube and nowhere else.

3. Family and friends always send me links to videos and posts on Facebook, Twitter and Tiktok. I don't usually click when it's just some meme or for laughs but sometimes it a post that matters to me/them enough to click on it.

I am almost sure there are alternatives. I mean, there are still programmers who exclusively learn from books, writings, and documentations ... right?

Yeah. Same here, mostly self-hosted. Running VPNs everywhere. Internet is still good transport layer.

Old web I care is still there too, but I mirror everything I feel I will need in the future. Just in case.

Then you are slow to see the change. Communities are slowly going behind signup walls.

Gotta read the article. It's more than social media tracking us.

Reply on news.ycombinator.com