zlacker

>>KoftaB+(OP)
Since this is here and there is a point made about discussing the technical merits of [0]... can someone explain to me how the WEI stuff isn't easily "faked" by scrapers and the like?

I could see this being used in a similar way to user agents (sometimes helpful when working on bugs and fixing them on minor platforms!), but I'm really struggling to see the overall value-add here.

I get the politics aspect of it (I think...), but what's the new technical thing being added here?

[0]: https://github.com/RupertBenWiser/Web-Environment-Integrity/...

>>rtpg+Jj
I believe the idea is that an independent third party will cryptographically sign something to attest that the client is legit.

So you can't fake that unless you have the third party's private key.

If course the question is then, how does the attestation third party ensure you are sending it real information? I've not bothered to read the proposal because I don't care, but I suspect it will require client-side plugins/libraries etc snooping on what is going on kinda like an antivirus thing snoops on things going on.

>>mattlo+lm
> how does the attestation third party ensure you are sending it real information?

The WEI standard does not prescribe this, as far as I can tell. One way to do this would be to use something like Secure Boot (broadly speaking), which can make "independent" measurements of what is being executed and sign that with a private key that never leaves (something like) a TPM.