I’m getting here too late for this to be visible, but fuck it.
The difference is Apple doesn’t pass any information on to the website. It just tells the website whether or not it passes their integrity check. Your web environment gets the Apple stamp of approval or it doesn’t, that’s all the sites will know.
Googles shit is going pass actual information about the browser state, add-ons, and the device to the site so they can restrict access based on any criteria they choose. That creates endless more avenues for abuse by giving the websites the ability to judge you for themselves and micromanage how you are allowed to visit their site.
Apple’s is the equivalent of a metal detector before walking into a building. It will go off but it doesn’t violate your privacy or enable targeted screening by telling anyone what it detected.
Google’s is the equivalent of a strip search, where it will drop your clothes and pictures of your junk onto the property managers desk so they can decide if you’re worthy to enter. Maybe they don’t like your brand of underwear, or a tattoo you have, and refuse to let you in.
It’s hardly OK for Apple to be doing even that either, you know. Who the fuck does Apple think it is, to be entitled to “attest” to a goddamn thing?!
The notion that anyone can “attest” to users’ caputured-by-DRM status is fundamentally toxic to the Internet as a whole and must be resisted at all costs and by any means necessary, legal or illegal.
Your comment was on the top for me, Lemmy’s default “hot” sorting brings fresh takes to the front, so don’t worry too much about your answers always getting buried.
Can you post any source at all that would back your claims? Or any technical details at all?
Neither the actual proposal https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#what-information-is-in-the-signed-attestation, nor the article itself seem to show that there would be a difference when it comes to privacy.
The entire problem with this proposal is that it limits client choice, similar to how Google Play integrity API on Android restricts some apps from running on rooted/unlocked phones.
That same problem obviously also exists in Apple’s implementation.
Big tech tries hard to act like the Internet Government, don’t they… Who elected them?
Transmitting that info to Apple is still a problem. Why do you trust Apple, but not Google?
Google’s version will likely ask you first, and you’ll know which sites are asking for it. Apple’s won’t.
These schemes all have the same problem that reddit and Twitter have: they need me more than I need them. If your website or app or whatever won’t work if I’m not on the right device I won’t visit it, and that’s not a bad thing
It’s a bit more complicated than that, unfortunately.
What happens when Microsoft adds something to their web building tools that forces all visitors to websites using these tools to use IE? Or when your bank (or even worse, utilities) start requiring Windows and IE?
It’ll probably end up worse than that. Turn off secure boot and Windows may still run, but it will no longer verify and all these sites will now refuse to work on your computer. So if you like to run Linux, even dual booting or running Windows in a VM for those things that absolutely require Windows won’t be good enough anymore.
It’s not just that.
Apples implementation of this doesn’t tell the website anything about the device other than “Apples approves”.
Google’s implementation will give the website direct information about the browser and computer. Which permits them to get granular and targeted on restrictions.
Its a fixed identifier, it can be a replacement for amythimg to forcably identify users:
- super cookies
- gpu profiling
- unwanted cookies
- IP adress recording (increseingly unusable)
- phone numbers
- …
“Apples approves”
This reminds me: If you want to see what happens when a company implements this system where they approve your usage and then warps it into a punishment system later by revoking their approval when youve been naughty, see minecraft chat reporting.
If my utility company requires me to have a Windows PC to get gas or electricity, then they can supply me with a Windows PC just for that purpose. If they want money from customers they need to provide ways for those customers to pay without specialized hardware/software.
What are they going to do, tell some 90 year old lady who has never touched a computer in her life that she needs to get online with an approved device to keep her light on?
if my utility company requires me to have a Windows PC to get gas or electricity, then they can supply me with a Windows PC just for that purpose
They won’t. Then what’s your plan?
What are they going to do, tell some 90 year old lady who has never touched a computer in her life that she needs to get online with an approved device to keep her light on?
No, they’ll tell her to pay via check/mail as usual.
But that’s a ridiculous argument anyway, because if there’s anyone that’s going to own an unmodified, store bought, “approved” device, it’s a 90 year old.
What are they going to do, tell some 90 year old lady who has never touched a computer in her life that she needs to get online with an approved device to keep her light on?
Thats exactly what they will do
I’d be very surprised for one thing, because IE is no longer a product Microsoft supports in any capacity. I’d also be confused as to which tools the web hosting market just shifted to that they’re using Microsoft tools, there are monopolists out there I’m worried about but Microsoft isn’t my main one right now
Nice job sidestepping the actual fucking question.
If I as an adult still had my mom telling me that’s enough internet for today, and taking away my laptop, I’d hate it but it would objectively be good for me. This is kind of a similar thing. I don’t like that these companies fuck up services I like but there’s no denying that me leaving reddit for example was overall quite positive thing to happen.
Yep, that’s the bargain I’m making. I’m way happier now that I’m not yelling at nerds on Reddit/Twitter/etc. The nerds on the fediverse are much less time consuming
I think it also goes back to the fact that Twitter et al are meant to be addictive, the way I don’t like giving up Twitter is the same way I wouldn’t like giving up smoking, which both alarms me and makes me ok giving those things up
The nerds on the fediverse are much less time consuming
That’s because our Fight Club requires that the glasses stay ON.
Can totally relate.
I went back and visited leddit recently and it really does make me feel more angry/annoyed overall, it’s definitely changed but it’s also definitely not new either.
No doubt the lack of mod support is partly to blame
Till one day your government will require it.
🇨🇳
One side question, did you post it twice or is it a bug in Eternity Client for Lemmy?
https://old.reddit.com/r/u_cy_narrator/comments/169py2y/bug_or_duplicate/
I hope you will make the difference. Show em!
I don’t see why I should be the only one
If everyone who is informed about privacy and security boycotts I don’t think that will make much difference unfortunately. There are billions who don’t know or don’t care.
Dummy.
The danger would be important entities like governments and banks using attestation. Then you’d be limited to using only Chrome, Safari and Edge, and Firefox could kiss its ass goodbye.
Bank: my bank is too boomercore to ever implement something like this, we only recently got 2fa
Government: my government still makes me file my taxes on paper and mail it to them so I’m ok for now
Banks and governments could get trapped into this because a third party vendor implements a system for them that includes this.
Like Salesforce’s “Lightning Experience sites” only supports the latest versions of iOS and Android, as well as only supporting chromium based browsers and Firefox.
A lot of banks and government services run on that platform, and not all of them are going to be smart enough to pay for a custom solution that increases device support.
It’s less about what they implement, and more about what their users who have clout expect. My regional bank is far more responsive to customer feedback than, for example, Bank of America. As for governments there’s all sorts of bureaucracy I can push on with not a lot of resources. It’s not accessible to everyone but organizations don’t need all that much prodding to respond anyway
Salesforce dictates what they support now, not on what people want. If an entity implements it, they can use the put of the box functionality or pay to have it customized to increase accessibility, security and support.
That’s fine, I will continue to use websites that work for me and when they don’t I will complain
My bank is welcome to implement features that prevent using Firefox. It’ll cost them when I move my deposits, but they’re welcome to do it.
People didn’t leave Wells Fargo and BoA en masse with all the illegal shit they did, why do you think this would have any real effect on them?
The EU wouldn’t really stand for that.
The EU lets them getnaeay with requiring device attestation for their mobile apps. It’s not exactly the same thing since system requirements for native apps are traditionally narrower than websites, but it’s similar.
In the UK at least, switching banks is super easy, I’ve done in twice in the last 2 months because they offered free cash to do so, there is enough competition that the banks have to make it easy to move or else they lose customers.
For government, generally most systems are built to be as accessible as they can be because there has been [https://www.gov.uk/guidance/accessibility-requirements-for-public-sector-websites-and-apps ](whole raft of legislation) written up to cover this.
I’m not saying it wouldn’t be a problem (power companies etc could prove to be sticky) but there are legal requirements that entities above a certain site have to meet.
Somehow, I am not surprised. Both, that Apple already did it and that there was no public outcry about it.
your treatment on the web depends on whether Apple says your device, OS & browser configuration are legitimate & acceptable.
Well, fuck that.
It’s not a problem until more sites start REQUIRING it, and then it’s too late. Even if some Apple already provides it, it’s more dangerous as use grows
It makes it even more easy to adjust online prices for apple users, lol
What I don’t understand is how does the attester check the device is not modified? Anything client side is just a matter of time until its get bypassed.
It needs integration with the TPM/secure element chip in the CPU and a device key issued by the manufacturer to sign an attestation that nothing in the software chain from kernel to browser has been modified .
These schemes tends to get regularly broken, just look at SGX
What does this mean? Do they now own the internet ? Can someone please TLDR it?
Didn’t notice yet
The only thing I’ve seen it used for is skipping captchas on cloudflare.
How would I notice it, for example I noticed cloudflare was listed, and lemmy.world is currently using it until they can move off it I believe. Does that mean I could see it somewhere while accessing that instance?
If you go to a cloudflare hosted site and it thinks you might be a bot if your browser supports it it’ll skip the captcha. The point of it is that you don’t notice it. Here’s a blog article on it from them: https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/
including some of lemmy instances, time to delete my account.