zlacker

>>dagurp+(OP)
How exactly is WEI any worse than say a peep-hole on a door? At the end of the day bots are a huge problem and it's only getting worse. What's the alternative solution? You need to know who you're dealing with, both in life and clearly on the web.

I'm probably alone in this, but WEI is a good thing. Anyone who's run a site knows the headache around bots. Sites that don't care about bots can simply not use WEI. Of course, we know they will use it, because bots are a headache. Millions of engineer hours are wasted yearly on bot nonsense.

With the improvements in AI this was inevitable anyway. Anyone who thinks otherwise is delusional. Reap what you sow and what not.

edit: removing ssl comparison since it's not really my point to begin with

>>endisn+bz1
TLS* does not allow websites to restrict users from using the tech stack (hardware, OS, browser) that they want to use. This does.

>>rezona+Zz1
Fundamentally both give a 3rd party the authority to verify the legitimacy of something, and similarly both can be avoided if you're willing to not participate.

>>endisn+aA1
I think you're mistaken about what TLS does. It doesn't give a third party any authority to verify anything. It provides integrity and confidentiality to both parties to an HTTP exchange, nothing more.

A TLS client does not contain any trusted private key. You can write one yourself by reading the RFCs. The same is not true for WEI.

>>lxgr+FA1
TLS used to also guarantee that you were talking to the correct entity, that's what EV certificates are for. So there was a verification step that ensured that you were indeed the business/organization you were claiming to be.

The EV certs still exists, but the browsers don't really differenciate between DV and EV certs anymore.

>>roblab+uC1
Ah, yes, in that sense I can see the parallel (in that being reachable in modern browsers is contingent on being able to obtain a TLS certificate). I remember similar concerns being raised about browsers discouraging HTTP.

But TLS certificates solve a much narrower problem than WEI ("are you communicating with the site you think you are") and are widely and cheaply available from multiple organizationally independent certificate authorities.

In particular, TLS certificates don't try to make an assertion about the website visited, i.e. "this site is operated by honest people, not scammers". WEI does, with the assertion being something like "this browser will not allow injecting scripts or blocking elements".