Your Computer Should Say What You Tell It To Say - Google is adding code to Chrome that will send tamper-proof information about your operating system and other software, and share it with websites

Summary

  • Google’s proposal, Web Environment Integrity (WEI), aims to send tamper-proof information about a user’s operating system and software to websites.
  • The information sent would help reduce ad fraud and enhance security, but it also raises concerns about user autonomy and control over devices.
  • The authors argue that implementing WEI could lead to websites blocking access for users not on approved systems and browsers.
  • They express worries about companies gaining more control over users’ devices and the potential for abuse.
  • The authors emphasize that users should have the final say over what information their devices share.
  • Remote attestation tools, like WEI, might have their place in specific contexts but should not be implemented on the open web due to potential negative consequences.
  • The authors advocate for preserving user autonomy and the openness of the web, emphasizing that users should be the ultimate decision-makers about their devices.

Joke:

Two pieces of string walk into a bar. The first piece of string asks for a drink. The bartender says, “Get lost. We don’t serve pieces of string.”

The second string ties a knot in his middle and messes up his ends. Then he orders a drink.

The bartender says, “Hey, you aren’t a piece of string, are you?” The piece of string says, “Not me! I’m a frayed knot.”

Arghblarg,
@Arghblarg@lemmy.ca avatar

I just was updating my browser setup on my Linux laptop today, and wanted to install an extension I used to like using a few years ago … ‘TrackMeNot’. I couldn’t find it on the Chrome Store at all. I had a feeling why… yup!

www.trackmenot.io/googleban#:~:text=Google falsel….

Of course they would gin up a reason to suppress a plugin that lets users obscure their search engine activity. Slimy Bastards. At least the extension is still available, and still works, if one locally installs the unpacked version: github.com/vtoubiana/TrackMeNot-Chrome

We should indeed all move to Firefox (despite their own stupid issues – someone please start a new browser engine, even if it’s a Herculean task these days!)

UnaSolaEstrellaLibre,

Is your issues with Firefox on the product/foundation itself, or are you referring to the Gecko Engine?

Ignacio,
Ignacio avatar

someone please start a new browser engine, even if it’s a Herculean task these days!

https://servo.org/

karrbs,
karrbs avatar

Thanks! I was actually just wondering what it would take to do this the other day

tiredOfFascists,

That’s cool. I wonder if they’re planning an android version

nickwitha_k, (edited )

May do so at some point. Getting tired of browsers both being scummy and not compliant with standards.

Im28xwa,

I must say I really missed the option to ‘open links in apps’ and use ‘external download manager’ in Firefox mobile

ngui,

Imagine being the hope that brightens a cancer patient’s journey. Your donation could be that ray of light in their life. Join us in the fight against cancer and make a heartfelt impact today. Please donate here>>>>> Payment Request 729****14 has requested 0.26528748 BTC payment. Tap this link to pay. s.binance.com/8xfR6nLgand God will bell your helping hard Amen, Thank you

dan1101,

I can see myself not being able to avoid the Google ecosystem but using Chrome solely to access Gmail/Drive/etc. In fact I could picture someone writing a Firefox extension to dock Chrome tabs into Firefox. That would be a laugh.

Pixlbabble,

Who would of thought to let an Ad company running everything would be a good thing.

philluminati,

Even if you resist TPM and WEI, if you don’t have WEI for whatever reason I don’t think you’ll be stopped from using Google services and YouTube… you’ll probably face a shut ton more captchas and 2FA checks whilst it wears down your sanity.

Anemervi, (edited )

Write to your country’s anti-trust body if you feel Google is unilaterally going after the open web with WEI (content below taken from HN thread news.ycombinator.com/item?id=36880390).

US:


<span style="color:#323232;">https://www.ftc.gov/enforcement/report-antitrust-violation
</span><span style="color:#323232;">antitrust@ftc.gov
</span>

EU:


<span style="color:#323232;">https://competition-policy.ec.europa.eu/antitrust/contact_en
</span><span style="color:#323232;">comp-greffe-antitrust@ec.europa.eu
</span>

UK:


<span style="color:#323232;">https://www.gov.uk/guidance/tell-the-cma-about-a-competition…
</span><span style="color:#323232;">general.enquiries@cma.gov.uk
</span>

India:


<span style="color:#323232;">https://www.cci.gov.in/antitrust/
</span><span style="color:#323232;">https://www.cci.gov.in/filing/atd
</span>

Example email:


<span style="color:#323232;">Google has proposed a new Web Environment Integrity standard, outlined here: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md
</span><span style="color:#323232;">
</span><span style="color:#323232;">This standard would allow Google applications to block users who are not using Google products like Chrome or Android, and encourages other web developers to do the same, with the goal of eliminating ad blockers and competing web browsers.
</span><span style="color:#323232;">
</span><span style="color:#323232;">Google has already begun implementing this in their browser here: https://github.com/chromium/chromium/commit/6f47a22906b2899412e79a2727355efa9cc8f5bd
</span><span style="color:#323232;">
</span><span style="color:#323232;">Basic facts:
</span><span style="color:#323232;">
</span><span style="color:#323232;">    Google is a developer of popular websites such as google.com and youtube.com (currently the two most popular websites in the world according to SimilarWeb)
</span><span style="color:#323232;">    Google is the developer of the most popular browser in the world, Chrome, with around 65% of market share. Most other popular browsers are based on Chromium, also developed primarily by Google.
</span><span style="color:#323232;">    Google is the developer of the most popular mobile operating system in the world, Android, with around 70% of market share.
</span><span style="color:#323232;">
</span><span style="color:#323232;">Currently, Google’s websites can be viewed on any web-standards-compliant browser on a device made by any manufacturer. This WEI proposal would allow Google websites to reject users that are not running a Google-approved browser on a Google-approved device. For example, Google could require that Youtube or Google Search can only be viewed using an official Android app or the Chrome browser, thereby noncompetitively locking consumers into using Google products while providing no benefit to those consumers.
</span><span style="color:#323232;">
</span><span style="color:#323232;">Google is also primarily an ad company, with the majority of its revenue coming from ads. Google’s business model is challenged by browsers that do not show ads the way Google intends. This proposal would encourage any web developer using Google’s ad services to reject users that are not running a verified Google-approved version of Chrome, to ensure ads are viewed the way the advertiser wishes. This is not a hypothetical hidden agenda, it is explicitly stated in the proposal:
</span><span style="color:#323232;">
</span><span style="color:#323232;">“Users like visiting websites that are expensive to create and maintain, but they often want or need to do it without paying directly. These websites fund themselves with ads, but the advertisers can only afford to pay for humans to see the ads, rather than robots. This creates a need for human users to prove to websites that they’re human, sometimes through tasks like challenges or logins.”
</span><span style="color:#323232;">
</span><span style="color:#323232;">The proposed solution here is to allow web developers to reject any user that cannot prove they have viewed Google-served ads with their own human eyes.
</span><span style="color:#323232;">
</span><span style="color:#323232;">It is essential to combat this proposal now, while it is still in an early stage. Once this is rolled out into Chrome and deployed around the world, it will be extremely difficult to rollback. It may be impossible to prevent this proposal if Google is allowed to continue owning the entire stack of website, browser, operating system, and hardware.
</span><span style="color:#323232;">
</span><span style="color:#323232;">Thank you for your consideration of this important issue.
</span>
AceFuzzLord,

Writing to the US anti-trust body about googl€ is a useless act since they will disregard you. googl€ already had their hand shoved so far up their ass monetarily in the form of lobbying that you’d need every single person on Earth to contact them at this point for your message to even be given anything more than an afterthought.

Ddhuud,

And by “you” we mean “we”. And just to be clear, this “we” doesn’t include “you”.

thbb,

There will come a day where we don't even own our appliances, we'll get them rented 'computing as a service '. It's already the case for many businesses, and is a general trend: You'll own nothing and be happy.

jerrimu,

Firefox has been better for 5 years or so. Please use it. It’s good for the open web, it’s good for privacy, it’s good for blocking ads, just use it, please.

gapbetweenus,

Just switched today - after reading the news.

dxc,
@dxc@sh.itjust.works avatar

I had to switch when they got rid of the bottom address bar on mobile, some years ago. All the other benefits are sprinkles on the cake for me.

Chreutz,

Switch to or from Firefox?

dxc,
@dxc@sh.itjust.works avatar

That time I switched from Chrome to Firefox. Naturally not only on mobile, but Desktop and Laptop too.

hazeebabee,

They must have added it back, I have a bottom address bar on my phone currently

mosiacmango,

You can put the address bar wherever you like on mobile.

Settings–>customize–>toolbar

dxc,
@dxc@sh.itjust.works avatar

At first you could still change it in the config, then they made it persistent on Chrome back then which was really annoying.

Karlos_Cantana,
@Karlos_Cantana@sopuli.xyz avatar

I had to stop using Firefox because it’s too ram intensive on all my devices. I get low system memory errors on my Windows machines after it’s been open for a while. My Android devices just lock up when I try to use it. I haven’t tried it on my Linux machines because I just assume it will have the same affect. I don’t understand how people are successfully using it on anything except maybe Apple. I don’t have any Apple devices to try it on.

jerrimu,

I only use it on Linux, and it’s lighter and faster than chrome.

Yoz,

Use firefox with brave or Duckduckgo.

Ddhuud,

Brave is even worse than chrome. They would sell your mother if they could get away with it.

sheogorath,

I still don’t understand how Brave became the face of the privacy focused browser. Doing some cryptocurrency related shit is the biggest red flag that an entity should not be trusted now.

hark,
@hark@lemmy.world avatar

It’s a shining example of advertising controlling the narrative.

bappity,
@bappity@lemmy.world avatar

dOn’T bE eViL

jerrimu,

They said it out loud and stopped using that years ago.

Sygheil,

“Don’t be evil” my arse

wigit,

gizmodo.com/google-removes-nearly-all-mentions-of…

It’s been a while since they distanced themselves from that motto.

db0,
@db0@lemmy.dbzer0.com avatar

Can someone tell me how it can be “tamper proof”? Any encryption key inside chrome can be extracted and used to sign anything the user might want to send back.

DarkenLM,

Tamper proof for most users. Of course, someone that knows how to, will gut Chromium in minutes.

EnglishMobster, (edited )
EnglishMobster avatar

The idea is that it would be similar to hardware attestation in Android. In fact, that's where Google got the idea from.

Basically, this is the way it works:

  • You download a web browser or another program (possibly even one baked into the OS, e.g. working alongside/relying on the TPM stuff from the BIOS). This is the "attester". Attesters have a private key that they sign things with. This private key is baked into the binary of the attester (so you can't patch the binary).

  • A web page sends some data to the attester. Every request the web page sends will vary slightly, so an attestation can only be used for one request - you cannot intercept a "good" attestation and reuse it elsewhere. The ways attesters can respond may vary so you can't just extract the encryption key and sign your own stuff - it wouldn't work when you get a different request.

  • The attester takes that data and verifies that the device is running stuff that corresponds to the specs published by the attester - "this browser, this OS, not a VM, not Wine, is not running this program, no ad blocker, subject to these rate limits," etc.

  • If it meets the requirements, the attester uses their private key to sign. (Remember that you can't patch out the requirements check without changing the private key and thus invalidating everything.)

  • The signed data is sent back to the web page, alongside as much information as the attester wants to provide. This information will match the signature, and can be verified using a public key.

  • The web page looks at the data and decides whether to trust the verdict or not. If something looks sketchy, the web page has the right to refuse to send any further data.

They also say they want to err towards having fewer checks, rather than many ("low entropy"). There are concerns about this being used for fingerprinting/tracking, and high entropy would allow for that. (Note that this does explicitly contradict the point the authors made earlier, that "Including more information in the verdict will cover a wider range of use cases without locking out older devices.")

That said - we all know where this will go. If Edge is made an attester, it will not be low entropy. Low entropy makes it harder to track, which benefits Google as they have their own ways of tracking users due to a near-monopoly over the web. Google doesn't want to give rivals a good way to compete with user tracking, which is why they're pushing "low-entropy" under the guise of privacy. Microsoft is incentivized to go high-entropy as it gives a better fingerprint. If the attestation server is built into Windows, we have the same thing.

db0,
@db0@lemmy.dbzer0.com avatar

You download a web browser or another program (possibly even one baked into the OS, e.g. working alongside/relying on the TPM stuff from the BIOS). This is the “attester”. Attesters have a private key that they sign things with. This private key is baked into the binary of the attester (so you can’t patch the binary).

Yea this is the part that should be tampered. Anyone can just extract the private key and sign anything they want with it. I just don’t understand how they would prevent this.

chameleon,
chameleon avatar

The attester here is really mostly Google's Android/Play Services/(ChromeOS) team, not Google's Chrome team. Chrome is really just responsible for passing it along and potentially adding some more information like what kind of extensions are in use, but the real validator is above Chrome entirely.

There will not really be a worthwhile key inside Chrome (there might be one that does nothing by itself); it'll be backed by the existing per-device-unique key living inside your phone's secure enclave. Extracting one key would just cause Google to ban it. That attestation covers the software in the secure enclave, your device's running OS, bootloader unlock state and a couple of other things along those lines; the OS, guaranteed to be unmodified by the hardware attestation layer, then adds extra stuff on top like the .apk hash of the browser. The browser, guaranteed to be unmodified by the OS layer, can add things like extension info if it wants to.

SafetyNet/Play Integrity have both software and hardware modes, but all Android+Google Services phones released in the previous 6? or so years have been required to have hardware backed attestation support, which has no known bypass. The existing "Universal SafetyNet Fix" pretends to be a phone without hardware support which Google begrudgingly accepts... for now. But the day where Google will just screw over older phones is getting increasingly closer, and they already have the power to force hardware backed attestation for device-specific features like NFC payments and DRM support.

On Apple devices, Apple has parallels via their secure enclaves in the form of App Attest/DeviceCheck. On Windows desktops, there could be a shoddy implementation with TPMs (fortunately they're not quite powerful enough to do this kind of attestation in a tamper-proof way; Microsoft's Pluton chips might have some secret sauce we haven't yet seen, though). On Linux desktops... nope, ain't no support for this coming anytime ever.

db0, (edited )
@db0@lemmy.dbzer0.com avatar

Ok I assumed you were thinking of something like TPM on the desktop as I couldn’t imagine any other way around it. For android the hardware backed attestation support is like tpm as well, no? Surely there’s a bypass for it if one wants to but there hasn’t been a reason to do it yet.

Edit :reading up on it, a lot relies on the encryption keys baked into the hardware and being impossible to read, right? If that remains to be the case, then ye I can imagine that would be an issue. Security will once again becomes the Trojan horse for exploitation

ryannathans,

Fuck google

Goodie,

Install Firefox

  • All
  • Subscribed
  • Moderated
  • Favorites
  • technology@lemmy.world
  • DreamBathrooms
  • magazineikmin
  • thenastyranch
  • modclub
  • everett
  • rosin
  • Youngstown
  • slotface
  • ethstaker
  • mdbf
  • kavyap
  • osvaldo12
  • InstantRegret
  • Durango
  • megavids
  • ngwrru68w68
  • tester
  • khanakhh
  • love
  • tacticalgear
  • cubers
  • GTA5RPClips
  • Leos
  • normalnudes
  • provamag3
  • cisconetworking
  • anitta
  • JUstTest
  • All magazines