1 yr. ago • 100%

Apple already shipped attestation on the web, and we barely noticed

httptoolkit.com Apple already shipped attestation on the web, and we barely noticed

There's been a lot of concern recently about the Web Environment Integrity proposal, developed by a selection of authors from Google, and…

Apple has deployed a system called Private Access Tokens that allows web servers to verify if a device is legitimate before granting access. This works by having the browser request a signed token from Apple proving the device is approved. While this currently has limited impact due to Safari's market share, there are concerns that attestation systems restrict competition, user control, and innovation by only approving certain devices and software. Attestation could lead to approved providers tightening rules over time, blocking modified operating systems and browsers. While proponents argue for holdbacks to limit blocking, business pressures may make that infeasible and Google's existing attestation does not do holdbacks. Fundamentally, attestation is seen as anti-competitive by potentially blocking competition between browsers and operating systems on the web.

74 comments

"Sorry, your device appears to be running Linux, please only use approved Apple or Windows devices to log in, with our required surveillance system pro installed. Thanks."

199
- Unfair. Google, Amazon and Facebook devices will also be allowed.
  
  43
- Should you chose not to continue, you agree to kick yourself in the balls.
  
  20
- Companies can already do that
  
  14
  
  Yeah, but so far you can just spoof your user agent. Not sure how easy cracking private access tokens will be. I assume they'll be pretty proactive about keeping it locked down.
  
  8
  
  Google already does that with Android and SafetyNet
  
  4
  
  "Can" and "have a reason" are different things. With attestation they actually have a reason.
  
  4
If a website doesn't want me to see their shit, then I guess i won't see their shit. I already have some sites that don't work because of my aggressive use of lists on my pihole, in addition to the usual browser plugins. If a site doesn't work now, I just move on. I don't give a shit about any site enough to put up with this type of bullshit.

87
- What if it's your bank's website? Or email provider? Or literally anything else you actually have to choose and can't pick? "It's okay because I don't think it affects me / I can ignore it" is always a bad reason to allow a bad thing happen.
  
  57
  
  What if it’s your bank’s website?
  
  Use the phone app or, oh I don't know, fucking go in?
  
  Or email provider?
  
  Change your email provider? Run your own email like people should?
  
  Or literally anything else you actually have to choose and can’t pick? “It’s okay because I don’t think it affects me / I can ignore it” is always a bad reason to allow a bad thing happen.
  
  When the fuck did I say that? I said I'm not going to deal with it. I won't. I'll work around it, or change the company I'm using. That is what you need to do to stop this type of shit.
  
  EDIT: Holy crap some people are stupid. Register a domain <whatever>.com. You don't even need to host a website. Now configure the register to point to your mail server. I've done this for decades, across different carriers. And I haven't lost my email.
  
  Or don't do any of that and happily bend over and take whatever Apple or Google force on you. You do you.
  
  19
  
  We're not allowing it. We don't have a choice.
  
  7
- We need to fight against this and stop this from happening before it's too late.
  
  24
  
  Seriously—the consequences are going to be very extreme very quickly if we don’t actively fight against this
  
  11
  
  Fight how?
  
  6
- If a website doesn't want me to see their shit, then I guess i won't see their shit
  
  That's how I react to Twitter and Facebook requiring login to even view most things.
  
  Whatever you're showing isn't important enough to be worth me making an account.
  
  19
- To see how your approach works, try using the Internet with Javascript turned off for reading text. You will realize you can't organize your life nowadays without bowing to what websites do technically.
  
  12
  
  You can't use websites when you disable a major piece of functionality? Shocker
  
  7
- I had to stop using my car insurance app because it started requiring location information to open.
  
  11
Expect corporations to be lazy. Just look at how every website handles cookies now. They could do it smartly, limit their cookie exposure, or only send the messages to IPs in the EU. But they just put an "accept all cookies or get out" OK box on your screen. And that's what they're going to do once attestation gets popular.

Sites will just require an attestation token and likely only accept ones from Safari and Chromium browsers since those are the ones pushing it. That will effectively make Firefox, Opera and other browsers incompatible with those websites. And once it catches on or becomes law somewhere, it'll be the entire internet. It's an extremely anticompetitive measure and it's internet-wide DRM. Fuck. that.

60
- But they just put an "accept all cookies or get out" OK box on your screen.
  
  Which doesn’t comply with GDPR
  
  24
  
  Which only affects companies doing business in the EU. Granted, that's most of the big players.
  
  Very grateful for the EU to unfuck most of the world from a lot of American regulatory capture.
  
  18
- Opera is chromium based though.
  
  You dont even need this DRM bullshit to become law. Chrome will simply put a warning before entering websites without it that goes "this website doesnt use name of a technology the user doesnt understand and therefore might be dangerous". Thats it. Every and all websites will immediatly implement this DRM bullshit or die.
  
  7
Google mentioned these in their explainer (they don’t like that they’re fully masked): https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#privacy-pass--private-access-tokens

Cloudflare explains them more too: https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/

They are currently going through an IETF standardization: https://datatracker.ietf.org/wg/privacypass/about/

You can also read the architecture. In general I do trust Cloudflare more than Google. I have no doubt shitty sites won’t fall back to a captcha and will instead block access though, with either solution.

33
- In general I do trust Cloudflare more than Google.
  
  A large portion of the internet runs through Cloudflare's network though, so IMO they're just as much of a risk as Google.
  
  29
  
  However unlike Google, CloudFlare doesn't have a history of killing off products just as users begin to adapt to them.
  
  13
I'm with you there, but that seems like a reason to fight

This would very likely be added to cloudflare by default (it would lower their costs), and that would put a solid chunk of the Internet behind the blackwall

23
Back to the days of using a different web browser for each website. I remember the acid test, IE 5.5, etc. Not fun as a user or web developer.

20
- if you use Safari or Firefox as your main browser it's already been this way for a while. websites are only tested against Chrome and often times when something doesn't work switching browsers temporarily alleviates the issue. it's a sad state of affairs in browser land.
  
  4
Actually I like this.

All those people who've been trying to keep corporate technologies "open" were, in fact, working for the corporations to make people come to them. Most unknowingly, maybe. It's just, well, litany of Gendlin case. You rely on corporate power, even if you are trying to hide it and talk about "open Web".

The most important thing is that we take ideologically corporate technology where it's not needed (there's been plenty of hypertext systems in history, some kinda successful, and all that JS and AJAX stuff and various frameworks on top are so complex not because of any usefulness, but because of the corporate goal of backward compatibility, lumping everything together and even intentional complexity to cut off competition, and a single space).

We'd be just fine with a bunch of incompatible between themselves Hypercard-like things working over network. That's what I think.

I really dislike Apple for what they've been in my somehow conscious years (born 1996), but things like Hypercard and Hotline (or KDX) from their older time seem to be just the right way to use personal computers.

Any single space with propaganda of "fragmentation being bad" is either not immune to what has happened to the Web, or already compromised.

6
Damn, didn’t know that, thanks for sharing!

5

You've viewed 74 comments.