> How does this affect browser modifications and extensions?
> Web Environment Integrity attests the legitimacy of the underlying hardware and software stack, it does not restrict the indicated application’s functionality: E.g. if the browser allows extensions, the user may use extensions; if a browser is modified, the modified browser can still request Web Environment Integrity attestation.
Then what's the point? I can make modified bot browser that commits ad fraud as long as I don't use a rooted Android phone?
I don't believe they're being honest with how this will be used. We need to legally regulate remote attestation.
> As new browsers are introduced, they would need to demonstrate to attesters (a relatively small group) that they pass the bar, but they wouldn't need to convince all the websites in the world.
It speaks for itself. Horrid.
Another use case is multiparty computation. Three people wish to compare some values without a risk that anyone will see the combined data. TC can do this with tractable compute overhead, unlike purely cryptographic techniques.
Observe what this means for P2P applications. A major difficulty in building them is that peers can't trust each other, so you have to rely on complex and unintuitive algorithms (e.g. block chains) or duplication of work (e.g. SETI@Home) or benign dictators (e.g. Tor) to try and stop cheating. With TC peers can attest to each other and form a network with known behavior, meaning devs can add features rather than spend all their time designing around complicated attacks.
These uses require you have a computer that you do trust which can audit the remote server before uploading data to it. But you can compile and/or run that program on your laptop or smartphone, the verification process is easy.
But exactly because TC is general it doesn't distinguish based on who owns the machine. It doesn't see your PC as morally superior to a remote server, they're all just computers. So yes, in theory a remote server could demand you run something locally and then do a HW remote attestation for it. In practice though this never happens anymore outside of games consoles (as far as I'm aware), because most consumer devices don't have the right hardware for it, and even if they did you can't do much hardware interaction inside attested code.
The issue client-side is that if a single vendor or TPM design is compromised, threat actors have ample motive, resources and ability to exploit this compromised hardware, whilst everyone else has few choices, such as dumping at great expensve some more e-waste. And critically, you as a user are blocked by your acceptance of TPM attestation technology from discovering attacks and auditing your own system security, as you ceded control of your own systems. Instead, your systems are controlled by a few technology companies that have a proven terrible track record of fulfilling their alleged intent of keeping your systems and data secure. And why should they care if it doesn't lead to a higher profit at the end of the year?
[1] https://github.com/binarly-io/SupplyChainAttacks/blob/main/M...
[2] https://github.com/binarly-io/SupplyChainAttacks/blob/main/M...
[3] https://github.com/binarly-io/SupplyChainAttacks/blob/main/L...
[4] >>30565985
In the past the main adversarial pressure has been exploiting security vulnerabilities ("jailbreaking"), but the software industry is getting its act together re that.
Getting browsers to adopt and implement Web Environment Integrity is Step 1.
Step 2 is where all Google web sites start requiring Web Environment Integrity to be used or they lock you out of the site.
Step 3 is where all websites serving Google ads require Web Environment Integrity to be used.
Step 4 Profit!
This is the beginning of the further DRM-ification and enshittification of the Web.
Yeah, this just incentivizes spammers to copy the parts of Chromium that do the attestation (or whatever browser has source available), and use that to pretend they're Chromium. There will always be workarounds. This seems to kill innovation and allow spammers to flourish.
I suppose I can understand an argument that they want to prevent scraping, but this is absolutely not going to stop that.
Trusted computing is often used such that one might think, it implies the user can trust something (his computer). But it is the other way around. A service provider can trust a machine - that a user bought -- to not do what the user wants. That is misleading at best.
I'd go a step further. We need to ban it. It should be illegal to sell devices to consumers that already contain private keys, unless all of said keys are provided to the consumer at the time of purchase.
It happens one step at a time:
https://gabrielsieben.tech/2022/07/29/remote-assertion-is-co...
I see no solution beyond the deglobalization of the entire tech stack (down to the very OSes) and multiple sources of trust in the form of multiple nation states. Maybe my government will make an official Linux distro and make it mandatory, so we can escape this coming shit.
1. Clients verifying cloud VMs. The "user" in this case is not the same person as "his" in "his computer".
2. Games consoles being verified by PS/Xbox online services. In this case the users are in effect verifying each other, because part of why they need such tough security is to stop online gaming being wrecked by cheaters.
At a stretch you could talk about credit card chips and the ATM network as (3) but that's far enough away from general computing that it doesn't really count.
In both cases these are firmly pro-consumer use cases. Unless you want to pirate or cheat in gaming of course, but there's plenty of users who don't want to subsidize your fun with their own suffering, so they're happy to rely on TC to stop that. It's a big part of why console gaming dominates PC gaming. It's wrong for the FSF to imply all those people are brainwashed dupes because they have a different value system to Richard Stallman.
Isn't that exactly the case, because the idea of using TC in every PC produced a huge backlash?
The reasons it hasn't taken off in desktop PCs are rather complicated and mostly due to patchy hardware support for the use cases that most matter there. It's much harder to implement in a diverse hardware ecosystem because for devs to rely on a new hardware feature that isn't just performance requires a very wide installed base. Intel and AMD never agreed on the right way to do it, and getting device vendors on board was too difficult outside vertically integrated ecosystems like consoles.
So computers, phones, and game consoles cannot have remote attestation but home security systems, ATMs, e-Readers, medical devices, water/electricity usage meters can do remote attestation.