Hello guys and gals, it's me Mutahar again! This time we take a look at "Web Environment Integrity", a new mechanism to prove trust on the Internet. While th...
…with Apple and Microsoft, Mutahar’s turn to take a look at “Web Environment Integrity”
Yesterday I saw a meme on reddit about browsers and I did not see even one person mentioning this WEI shit. Everyone was praising Chrome. We are truly fucked.
One thing I don’t understand about all of this WEI: can’t we just use a user agent switcher / spoofer to ‘look’ like chrome or any other browser and OS to counter this?
This isn’t about a user agent. In basic terms there is supposed to be some kind of software that attests that the browser is actually what it claims to be. On the other side, a server can trust this “attester” or not. So even if you wrote software that always attests what the browser claims to be, Netflix for example could say “nah, I don’t trust you bro”.
On Android this attestation would be done by the Google play services (afaik). On desktop, the OSs would need to implement this attestation.
While I haven’t seen data to back this up, another Lemmy user called out that Intel chips may have support for running secure code the user cannot modify. The results are signed by an encryption key on the motherboard/CPU that cannot be extracted to fake the signature.
So let’s say Chrome asks this hardware module to hash the executable code and some state for itself currently in RAM and sign it with Intel’s private key on the motherboard/CPU. The “some state” portion ensures the hash is always unique. Maybe it is just a timestamp. Regardless, this helps the attestation server know Chrome has not been modified because the hash is unique and cannot simply be captured in flight once and then replayed/faked over and over like a user-agent string.
Yesterday I saw a meme on reddit about browsers and I did not see even one person mentioning this WEI shit. Everyone was praising Chrome. We are truly fucked.
So reddit is definetly being astrosurfed hard isnt it?
Always has been
“Turns around and disarms astronaut”
It’s because people that are about FOSS, freedom and privacy have moved to lemmy already
I imagine some will change their minds as soon as ad blocking starts to fail.
One thing I don’t understand about all of this WEI: can’t we just use a user agent switcher / spoofer to ‘look’ like chrome or any other browser and OS to counter this?
This isn’t about a user agent. In basic terms there is supposed to be some kind of software that attests that the browser is actually what it claims to be. On the other side, a server can trust this “attester” or not. So even if you wrote software that always attests what the browser claims to be, Netflix for example could say “nah, I don’t trust you bro”.
On Android this attestation would be done by the Google play services (afaik). On desktop, the OSs would need to implement this attestation.
Please someone correct me if I’m wrong on this.
While I haven’t seen data to back this up, another Lemmy user called out that Intel chips may have support for running secure code the user cannot modify. The results are signed by an encryption key on the motherboard/CPU that cannot be extracted to fake the signature.
So let’s say Chrome asks this hardware module to hash the executable code and some state for itself currently in RAM and sign it with Intel’s private key on the motherboard/CPU. The “some state” portion ensures the hash is always unique. Maybe it is just a timestamp. Regardless, this helps the attestation server know Chrome has not been modified because the hash is unique and cannot simply be captured in flight once and then replayed/faked over and over like a user-agent string.