Business Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web - It's just a "proposal," but it's also being prototyped inside Chrome right now.

  • 🏰 The Fediverse is up. If you know, you know.
  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account
Article Link
Archive Link

Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web
It's just a "proposal," but it's also being prototyped inside Chrome right now.
Ron Amadeo - Monday at undefined
1690391785092.png

Google's newest proposed web standard is... DRM? Over the weekend the Internet got wind of this proposal for a "Web Environment Integrity API. " The explainer is authored by four Googlers, including at least one person on Chrome's "Privacy Sandbox" team, which is responding to the death of tracking cookies by building a user-tracking ad platform right into the browser.

The intro to the Web Integrity API starts out: "Users often depend on websites trusting the client environment they run in. This trust may assume that the client environment is honest about certain aspects of itself, keeps user data and intellectual property secure, and is transparent about whether or not a human is using it."

The goal of the project is to learn more about the person on the other side of the web browser, ensuring they aren't a robot and that the browser hasn't been modified or tampered with in any unapproved ways. The intro says this data would be useful to advertisers to better count ad impressions, stop social network bots, enforce intellectual property rights, stop cheating in web games, and help financial transactions be more secure.

Perhaps the most telling line of the explainer is that it "takes inspiration from existing native attestation signals such as [Apple's] App Attest and the [Android] Play Integrity API." Play Integrity (formerly called "SafetyNet") is an Android API that lets apps find out if your device has been rooted. Root access allows you full control over the device that you purchased, and a lot of app developers don't like that. So if you root an Android phone and get flagged by the Android Integrity API, several types of apps will just refuse to run. You'll generally be locked out of banking apps, Google Wallet, online games, Snapchat, and some media apps like Netflix. You could be using root access to cheat at games or phish banking data, but you could also just want root to customize your device, remove crapware, or have a viable backup system. Play Integrity doesn't care and will lock you out of those apps either way. Google wants the same thing for the web.

Google's plan is that, during a webpage transaction, the web server could require you to pass an "environment attestation" test before you get any data. At this point your browser would contact a "third-party" attestation server, and you would need to pass some kind of test. If you passed, you would get a signed "IntegrityToken" that verifies your environment is unmodified and points to the content you wanted unlocked. You bring this back to the web server, and if the server trusts the attestation company, you get the content unlocked and finally get a response with the data you wanted.

1690391760475.png

Google's diagram of the Web Integrity API.

Google likes to describe its APIs in a generic sense, but in reality, most of the actors in this play would probably be Google. Google may or may not be supplying the website, Chrome would be the browser, and the attestation server would definitely be from Google.
Google's document pinky-promises the company doesn't want to use this for anything evil. The authors "strongly feel" the API shouldn't be used to uniquely fingerprint people, but they also want "some indicator enabling rate limiting against a physical device." In the "non-goals" section, the project says it doesn't want to "interfere with browser functionality, including plugins and extensions." That's a veiled reference to not killing ad-blockers, even though the project mentions better advertising support as some of its goals. Chrome already has a "kill ad blockers" plan anyway (or at least "watered-down ad blockers" plan). It's called Manifest V3, which will change the way critical extension APIs work so they can't modify webpage content as effectively. Google also says it doesn't want to "exclude other vendors" from its DRM scheme.

Google hasn't done much in the way of public promotion of this idea yet, and even the documentation is only hosted on an employee's personal GitHub account, rather than an official Google repo. The earliest proposal we can find is from April 2022. Over the weekend, an updated spec was published, and the proposal got picked up by HackerNews and device-repair YouTuber Louis Rossmann. This caused the Internet to descend upon the repo's GitHub issues forum and start absolutely cooking Google in the replies.

Issue #134 calls the idea "absolutely unethical and against the open web." Issue #113 say they "can't believe this is even proposed." Issue #127 adds: "Have you ever stopped to consider that you're the bad guys?" Another user posted a screed entirely in hexadecimal that, when translated, starts with "Death to Fascists" and wishes explosive diarrhea on everyone involved. So reception so far has been... mixed.

Exactly how the rest of the world feels about this is not necessarily relevant, though. Google owns the world's most popular web browser, the world's largest advertising network, the world's biggest search engine, the world's most popular operating system, and some of the world's most popular websites. So really, Google can do whatever it wants. Other projects like Chrome's "Privacy Sandbox" ad platform and the adblock-limiting manifest V3 have been universally panned, but Google has kept right on trucking with the projects. There have been some small project tweaks and delays, but Google keeps marching forward.

For now this is only a "proposal" API, but in May Google published an "intent to prototype" notice, meaning it's building the feature into Chrome right now for testing. There's a page for feature-development tracking on chromestatus.com. We've asked Google for a comment and will update this page if it sends anything.
 
Last edited by a moderator:
Click to expand...
And the locking-down of the internet into carefully controlled, corporate walled gardens continues. It's difficult to express how much this development threatens the continued functioning of what remains of the free internet. With Chromium's market share, Google can very realistically force almost all major websites to implement this nonsense, leaving anyone running other browsers locked out of essential technological infrastructure for banking, email, etc.

TOR, in particular, will absolutely be the first thing blacklisted. You can be assured that your browser will become increasingly linked to your real identity. It's a stone's throw from the widespread adoption of this scheme to Chinese-style internet accounts linked to your government ID becoming a universal prerequisite for using any online services. The corporations will be the ones to make it, but you can be damned sure Uncle Sam is creaming his pants at the prospect.

Realistically, I think legacy hardware is the best defense against this. We might have a couple years until the world totally weans itself off of weird enterprise builds of XP.

For as much as Kiwi Farms is an extremely niche site, Null was prescient in seeing the need for a parallel, decentralized internet. I wish that folks who care about this stuff would focus their efforts on building up the necessary infrastructure instead of making shitty Youtube and Twitter knockoffs.
 
The big tech march to niggercattleize the web continues. Since mozilla had some total dolt run the company into the ground and at this point is fully supported financially by google to prevent the chromium monopoly from ending up in an antitrust suit, its only a matter of time until the proper big tech walled garden is created. With microsoft on their own march to gain total control over hardware (TPM 2.0, Pluton) its only a matter of time until everything becomes locked down, obviously the tech literate would be able to bypass this but ask the masses to do the same, the fact that most people on PC dont know that ads can be blocked is shocking, having to nigger rig your browser (or entire comp) would be impossible to ask, and so long as facetuberedtwit work no one will ask a thing, that and besides the point I doubt any real alternatives that are not specific to politics or warez will take off (take a gander at alt tech for an example, for another example the farms is the only real use ive had for tor). Look at the death of the chans, tumblr, and alternative search engines, the prevalence of smart phones further compounds this problem due to how dumbed down and already locked down phones are.

With several states in the US putting in pornsite ID requirements its only a matter of time until something like that finds its way to the feds, and from there mandatory ID to use the internet at all, anonymity and the uncontrolled flow of information will die if is to occur and the internet will offically become the same as the modern media monopoly, a niggercattle plantation where a slurry of manufactured consensus is forcefed to the cattle.
 
Chrome is shit anyway, I haven't used it in years. I have faith in the FOSS/privacy sperglord communities to find a way around any dumb shit Google pulls. every time Google fires a shot, it peaks more nerds, and the army grows. maybe I'm being optimistic here, but these guys are already becoming the spearhead of resistance against the corporate tech hegemony as the situation worsens. issues like the cuckening of Mozilla have been addressed by third-party privacy-focused forks like LibreWolf which maintain browser functionality and essential features like tracker and ad blocking against the creep of degeneracy. not all projects are successful (Pale Moon browser lmao), but so far, there's enough of a demand for anti-globohomo workarounds that the development of these tools stays active and effective. let's not forget that the conceit of companies like Google is peaking a percentage of their own employees, who come to the community with substantial knowledge of how the enemy's weapons are made.

Pinochle Sunrise said:
We might have a couple years until the world totally weans itself off of weird enterprise builds of XP.
Click to expand...

1690403072049.png
 
I think people are forgetting that Tor was made by the US government. The reason why Tor is publicly available is that the US government realized that if only they had anonymous web browsing, everybody would be able to instantly tell what the feds were doing online by just looking for anon connections.

Feds want to run their gayops, so I think we are still a ways off from something like this from being implemented.
 
Sexy Potoo said:
I think people are forgetting that Tor was made by the US government. The reason why Tor is publicly available is that the US government realized that if only they had anonymous web browsing, everybody would be able to instantly tell what the feds were doing online by just looking for anon connections.

Feds want to run their gayops, so I think we are still a ways off from something like this from being implemented.
Click to expand...

this, and, pre-empting the organic development of a "darkweb" by offering a solution based on government-developed tech means they can surveil, monitor, and exercise a degree of control that would be more difficult to obtain if it sprouted up out of their hands. it seems people forget that one of the first notorious darkweb sites, Silk Road, was a very effective honeypot that snared tons of people despite its supposedly anonymous service. I don't think that was just due to poor opsec on the users' parts.
 
You must log in or register to reply here.
Back
Top Bottom