Yesterday I saw a meme on reddit about browsers and I did not see even one person mentioning this WEI shit. Everyone was praising Chrome. We are truly fucked.
this post was submitted on 13 Aug 2023
325 points (93.8% liked)
Technology
58143 readers
5397 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
So reddit is definetly being astrosurfed hard isnt it?
Always has been
"Turns around and disarms astronaut"
It's because people that are about FOSS, freedom and privacy have moved to lemmy already
I imagine some will change their minds as soon as ad blocking starts to fail.
One thing I don't understand about all of this WEI: can't we just use a user agent switcher / spoofer to 'look' like chrome or any other browser and OS to counter this?
This isn't about a user agent. In basic terms there is supposed to be some kind of software that attests that the browser is actually what it claims to be. On the other side, a server can trust this "attester" or not. So even if you wrote software that always attests what the browser claims to be, Netflix for example could say "nah, I don't trust you bro".
On Android this attestation would be done by the Google play services (afaik). On desktop, the OSs would need to implement this attestation.
Please someone correct me if I'm wrong on this.
While I haven't seen data to back this up, another Lemmy user called out that Intel chips may have support for running secure code the user cannot modify. The results are signed by an encryption key on the motherboard/CPU that cannot be extracted to fake the signature.
So let's say Chrome asks this hardware module to hash the executable code and some state for itself currently in RAM and sign it with Intel's private key on the motherboard/CPU. The "some state" portion ensures the hash is always unique. Maybe it is just a timestamp. Regardless, this helps the attestation server know Chrome has not been modified because the hash is unique and cannot simply be captured in flight once and then replayed/faked over and over like a user-agent string.
Here is an alternative Piped link(s): https://piped.video/watch?v=5joNRJ3C5ho
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source, check me out at GitHub.
I have finally made the full conversion away from Google. Email, browser, search all out of their hands. The one that took the longest to happen was the browser. Firefox finally is working great for me now.
Email is tough one for me. Any recommendations? I tried Proton but their mobile app is (was?) disaster, and only limited to one logged in account at once which is a deal breaker for me.
Posteo or Runbox are good libre options. You have to rent however
zoho mail is what I use.
apple might oppose this to some point, they're often not in line with google.
Apple only opposes Google when new browser capabilites like PWAs, Bluetooth API, NFC API,... might be a threat to the Appstore monopoly on iOS.
I think they are very much onboard with this since it you could potentially make live hell for Hackintosh and Jailbreak users.
i wouldn't be so sure about it. apple strongarmed google with jpgxl support and the european union pryed open their eco system, at least for eu citizens. apple currently positioning themselves on the side of privacy advocates would lose this standing (and many customers who switched to iphone because of it). i know, they could sugarcoat this, but i have a little hope left that they will draw a line on at least the most user hostile stuff.
Apple loves control; the only reason I can think of that would make them oppose Google's Web Integrity proposal is that they don't think it goes far enough.