this post was submitted on 21 Jul 2023
2334 points (99.3% liked)
Privacy
32120 readers
933 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Can someone give me an easy to understand example of what they are proposing? Assume that I don’t allow them to install any software/tool that helps them track me/my device.
I saw this comment and found it helpful but its still not clear to me
It's basically how widevine works. The hardware "secure" boots the OS, and the OS only loads signed code. And there is a chain of custody all the way to the hardware, so the software that communicates with the server can attest that it is the same as what they expect.
The simple explanation is that they wish to further erode property ownership by the proletariat by locking down operating systems such that they can't do as their owners wish, but only what the corporation wants.
Basically, it would allow websites to only serve users who comply with website requirements (i.e., no extensions, no ad blockers, only Chrome-based, whatever) whatever these requirements are.
You (your browser) go to a website, example.com, which requires attestation. So you must go to an attestation server and attest your device/browser combo (by telling the attestation server whatever information it requires). If the attestation server thinks you are trustworthy, it gives you an integrity token that you pass to example.com, and then you can see example.com. The website knows which attestation server issued your integrity token, so you can't create your own.
So no extra software means no attestation server would attest you; means you can't see example.com. End of story. It's the same as the current "your browser is not supported" window, only you can't get around it by changing the user agent.
As usual with these initiatives, bullshit is spread across different specs - this spec by itself implies that any number of attestation servers can exist, and they can check whatever they want, and no browser should be excluded, etc., etc., but practical implementation would probably check installed extensions, etc.
Wouldn't spoofing work? Like, if the browser just sends "yes, no extensions, adblock, blah blah" then how would the attestation server know if that's true? Or does it require signed binaries, or some special hardware?
That is conveniently left out of the speck. Attestation server may require signed binary on a client system, it may require whatever it wants really, because why not? It's a website who decides to trust attestation server or not.
Depends on if they used cryptographic signatures. Those would be impossible to spoof because any change in the client would change the hash completely.
Google silently shipping signed chrome executables soon...
And then people wonder why non chromium browsers are important
Chromium is cancer.
Nah, chromium by itself is okay. Its just google, microshit and everyone else using the chromium source to ship as much telemetry, ads, data as possible.
I'm pretty sure Chromium is still phoning home just as it used to for almost a decade. It's a piece of Google's garbage.
Haha
This in a world where people have barely figured out that TLS1.0 isn’t really TLS at all.
A complex product the consumer doesn’t
understand and doesn’t help is doomed to failure.
Imagine an ad driven site reducing its visitor count so it can sell its ads for less to fewer people?
while people with no adblocker at all are rejected, resulting in irate Facebook posts, people with trusted adblockers continue on as before.
This is great! HAHAHA.
I imagine the user experience would be just that "our site only works with Chrome".
And then Google could close the loop with requiring such requirements for Google Ads integration.
Here is the thing—say you do that. Then your advertisers call you and complain they can’t see their ads from their iPhone….and drop their ad campaign.