>You can choose not to send this to the remote server, but you lose the ability to send an altered or randomized description of your device and its software if you think that's best for you.
The EFF is being misleading here by conflating the attestation taken and fingerprintable information like a user agent. An attestation taken does not contain information about the device that can be used to identify since the data the site gets is low entropy. WEI doesn't stop you from changing your user agent, nor does it prevent you from using your privacy web extentions.
>But, despite their valiant attempts to cast these benefits as accruing to device owners, these are really designed to benefit the owners of commercial services; the benefit to users comes from the assumption that commercial operators will use the additional profits from remote attestation to make their services better for their users.
End users are not the only stake holders in the web. I would say most changes to the web are for people who develop sites and end users benefit from sites using those features.
>Putting handcuffs on every shopper who enters a store would doubtless reduce shoplifting, and stores with less shoplifting might lower their prices, benefitting all of their customers. But ultimately, shoplifting is the store’s problem, not the shoppers’, and it’s not fair for the store to make everyone else bear the cost of resolving its difficulties.
This metaphor isn't the same since WEI is transparent to users. Physical handcuffs would be very intrusive, but that isn't what is happening here. Shop lifting affects the profitablity of the store. A better metaphor would be a bouncer for a club. Technically a club could have a set of rules of entering and customers could promise that they follow them. Unfortunately, people lie and just trusting them isn't good enough so clubs end up adding bouncers even though they don't directly make the experience for customers better.
>The problem is, there are lots of websites that would really, really like the power to dictate what browser and operating system people can use
This claim needs a citation of where user agent based blocking isn't enough. People spoofing their user agent won't make much of a difference to support costs of the site.
>The web is the last major open platform left on the internet - the last platform where anyone can make a browser or a website and participate, without having to ask permission or meet someone else’s specifications.
WEI doesn't prevent you from participating in the web or needing to meet someone else's specification. You can even make an attestation service for your own browser.
>We sympathize with businesses whose revenues might be impacted by ad-fraud, game companies that struggle with cheaters, and services that struggle with bots. But addressing these problems can’t come before the right of technology users to choose how their computers work, or what those computers tell others about them, because the right to control one’s own devices is a building block of all civil rights in the digital world..
To prevent ad fraud either you need to increase the fingerprintablity of users on the web, violating people's privacy, or implemented a form of remote attestation, which protects people's privacy.
If EFF cares no much about privacy on the web they should be in favor of this proposal.
I disagree that beivg a to lie about what your device is running in a building block of all civil rights because the physical analog, fraud, is illegal, and the world seems better without people commuting fraud to one another.
> An attestation taken does not contain information about the device that can be used to identify since the data the site gets is low entropy.
Citation needed, how does WEI make it _impossible_ for attesters to return higher entropy information? Pinkie promises are insufficient.
> WEI doesn't stop you from changing your user agent
False, this is an explicit design goal: "Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device."
> nor does it prevent you from using your privacy web extentions
Not an explicit goal, but a very obvious next step with strong economic incentives.
> Physical handcuffs would be very intrusive, but that isn't what is happening here.
Seeing a message that says "Sorry, this website is only accessible by browsers that support WEI" is very intrusive.
> WEI doesn't prevent you from participating in the web or needing to meet someone else's specification. You can even make an attestation service for your own browser.
Categorically false, no website is going to trust your attestation service. This is equivalent to saying "Just create your own CA".
> I disagree that beivg a to lie about what your device is running in a building block of all civil rights because the physical analog, fraud, is illegal, and the world seems better without people commuting fraud to one another.
No, the physical analog is "lying", which isn't illegal in most situations, and required in some - such as when a stalker asks you where you live.
>how does WEI make it _impossible_ for attesters to return higher entropy information?
It isn't impossible, but doing so would violate users privacy which isn't the goal of the proposal. You don't need WEI to violate people's privacy.
>False, this is an explicit design goal: "Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device."
That statement means that the site would learn that for example the server can trust that the user is using Chrome on windows. A feature of Chrome is that it's possible to spoof your user agent.
>Seeing a message that says "Sorry, this website is only accessible by browsers that support WEI" is very intrusive.
This can apply to anyone API. It's happened for WebGPU. It's blocking users is not a goal of the API.
>no website is going to trust your attestation service. This is equivalent to saying "Just create your own CA".
It is possible to create your own CA. How do you think things like Lets Encrypt came into existence. Trust is hard to earn. That doesn't mean that it is impossible to get people to trust you.
>No, the physical analog is "lying", which isn't illegal in most situations
I agree, but WEI is meant to be used in situations where lying should be illegal.
> but WEI is meant to be used in situations where lying should be illegal.
But here I once again have to point out that in practice this will look very different.
The practical effect is that if someone installs LineageOS or even AOSP to get rid of Google spyware and preinstalled bloatware, then these attestation checks will fail and that user will not be able to use apps that are necessary in practice.
The question is whether this is really a "side effect" or just the actual goal.
The actual goal is probably that Google and others prevent ad-blocking. WEI itself is not meant as a fingerprint, but with unblockable ads comes unblockable tracking (not that I personally care about tracking). Like, look at YouTube on iPhones, they blocked background playback in the app and even got Apple to block it in Safari in iOS update 10.
They don't need WEI to keep the vast majority of users away from obscure alternative OSes, but as a side effect those would be impacted.
> WEI doesn't prevent you from participating in the web or needing to meet someone else's specification. You can even make an attestation service for your own browser.
As always, Google will do its best to ensure it PRACTICALLY does, while denying it at the same time by pointing out that "you can make your own Google".
> because the physical analog, fraud, is illegal,
I don't know about the US, but in Poland abusive and anticompetitive clauses are not enforceable. Lying about the device seems to be the digital equivalent.
I can even agree here, however the question is - does this justify the entire mechanism when it's known it can be used for other purposes which are not as non-controversial as your examples.
>To prevent ad fraud either you need to increase the fingerprintablity of users on the web, violating people's privacy, or implemented a form of remote attestation, which protects people's privacy.
>If EFF cares no much about privacy on the web they should be in favor of this proposal.
Privacy on the web by implementing remote attestation across the web will inevitably in practice reduce digital rights and user control/freedom. The EFF also cares a lot about this, so it makes sense that they would be against the proposal. Both of these goals could be achieved by websites providing the same behavior regardless of the client browser/software that is requesting pages. The reason we have to lie is because user-hostile businesses/sites don't want to adhere to this (advertising, DRM). (ignoring useful things like providing a mobile version of a site)
To note, fingerprinting is always going to be technically possible (especially given the larger and larger feature scope that businesses have wanted to impose upon the web since its inception), WEI is just an attempt to stop ad-driven sites from trying to do it.
> If EFF cares no much about privacy on the web they should be in favor of this proposal.
Not true at all in the slightest, even with the sorry explanation Google employees tried to conjure.
> To prevent ad fraud either you need to increase the fingerprintablity of users on the web, violating people's privacy, or implemented a form of remote attestation, which protects people's privacy.
Not true either, you don't have to do any of that. And why exactly should the client be responsible for ad fraud? These suckers, advertisers, try to track me without consent for years and abuse every legal gray area there is. Boot me from a service if you don't like my client for all I care, just be transparent about it.
> You can even make an attestation service for your own browser.
I don't want that. I do indeed vet clients connecting to my service to defend against attacks, but WEI comes with a cost I would never be willing to pay.
your business model involves selling ads. but its being undermined by fraud. you should be able to _change the internet_ so the business model makes sense again.
Yes, because ads are beneficial to the web. So is account security, spam detection, anticheat, etc. The current implementation of the web is not set in stone and we should take steps to improve it.
>We should not destroy the entire internet to protect/increase adtech profits.
Yeah, ideally businesses wouldn't be built on this model (free service funded by ads at the expense of privacy and now user control). Then we might not have had to worry about widespread fingerprinting AND we can maintain user control too.
>There does not exist a website that is better WITH ads.
Ads can fund the development of the site, the services of the site, and the content on the site. The amount of additional value that the site is able to provide users is much more than the value that gets taken away by including ads. I haven't even mentioned how the ability of users to advertise things on the web is also very useful.
>Ads are beneficial to adtech and companies with ad spend.
The EFF is being misleading here by conflating the attestation taken and fingerprintable information like a user agent. An attestation taken does not contain information about the device that can be used to identify since the data the site gets is low entropy. WEI doesn't stop you from changing your user agent, nor does it prevent you from using your privacy web extentions.
>But, despite their valiant attempts to cast these benefits as accruing to device owners, these are really designed to benefit the owners of commercial services; the benefit to users comes from the assumption that commercial operators will use the additional profits from remote attestation to make their services better for their users.
End users are not the only stake holders in the web. I would say most changes to the web are for people who develop sites and end users benefit from sites using those features.
>Putting handcuffs on every shopper who enters a store would doubtless reduce shoplifting, and stores with less shoplifting might lower their prices, benefitting all of their customers. But ultimately, shoplifting is the store’s problem, not the shoppers’, and it’s not fair for the store to make everyone else bear the cost of resolving its difficulties.
This metaphor isn't the same since WEI is transparent to users. Physical handcuffs would be very intrusive, but that isn't what is happening here. Shop lifting affects the profitablity of the store. A better metaphor would be a bouncer for a club. Technically a club could have a set of rules of entering and customers could promise that they follow them. Unfortunately, people lie and just trusting them isn't good enough so clubs end up adding bouncers even though they don't directly make the experience for customers better.
>The problem is, there are lots of websites that would really, really like the power to dictate what browser and operating system people can use
This claim needs a citation of where user agent based blocking isn't enough. People spoofing their user agent won't make much of a difference to support costs of the site.
>The web is the last major open platform left on the internet - the last platform where anyone can make a browser or a website and participate, without having to ask permission or meet someone else’s specifications.
WEI doesn't prevent you from participating in the web or needing to meet someone else's specification. You can even make an attestation service for your own browser.
>We sympathize with businesses whose revenues might be impacted by ad-fraud, game companies that struggle with cheaters, and services that struggle with bots. But addressing these problems can’t come before the right of technology users to choose how their computers work, or what those computers tell others about them, because the right to control one’s own devices is a building block of all civil rights in the digital world..
To prevent ad fraud either you need to increase the fingerprintablity of users on the web, violating people's privacy, or implemented a form of remote attestation, which protects people's privacy.
If EFF cares no much about privacy on the web they should be in favor of this proposal.
I disagree that beivg a to lie about what your device is running in a building block of all civil rights because the physical analog, fraud, is illegal, and the world seems better without people commuting fraud to one another.