this post was submitted on 09 Aug 2023
786 points (96.9% liked)

Technology

73095 readers
3618 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
L4s@hackingne.ws
786
Google's Web DRM is Worse than I Thought... (www.youtube.com)
submitted 2 years ago by Remontoire@lemmy.world to c/technology@lemmy.world
94 comments fedilink hide all child comments
 

This video as a text article: https://blog.nicco.love/google-drms-the-web/

you are viewing a single comment's thread
view the rest of the comments
[โ€“] SparkyLight@lemmy.world 20 points 2 years ago (1 children)

i don't quite get why can't the attester just.. lie.. about who he is like if I'm using firefox on linux, why cant my linux attester claim to be actually windows attester and say I'm using chrome?

[โ€“] chaospatterns@lemmy.world 18 points 2 years ago

Attestation depends on a few things:

  1. The website has to choose to trust a given attestation provider. If Open Source Browser Attestation Provider X is known for freely handing out attestations then websites will just ignore them
  2. The browser's self-attestation. This is tricky part to implement. I haven't looked at the WEI spec to see how this works, but ultimately it depends on code running on your machine identifying when it's been modified. In theory, you can modify the browser however you want, but it's likely that this code will be thoroughly obfuscated and regularly changing to make it hard to reverse engineer. In addition, there are CPU level systems like Intel SGX that provide secure enclaves to run code and a remote entity can verify that the code that ran in SGX was the same code that the remote entity intended to run.

If you're on iOS or Android, there's already strong OS level protections that a browser attestation can plugin to (like SafetyNet.)