rule - eviltoast

🆘

  • kitedemon@lemmy.blahaj.zone
    link
    fedilink
    arrow-up
    91
    ·
    1 year ago

    From my understanding, it allows a website to check if you’re running a Chromium browser, and block your access to the site or to features of the site if you aren’t

    • Johanno@feddit.de
      link
      fedilink
      arrow-up
      53
      ·
      1 year ago

      Well then I am a chromium browser. At least as long you need to think that.

      What technology they are using I can’t fake on a Firefox?

      • Dangdoggo@kbin.social
        link
        fedilink
        arrow-up
        74
        ·
        1 year ago

        It’s the API itself, it’s a little more complicated than just checking if you have a chromium browser. What it’s looking for is special tokens generated by google within chromium browsers. Google is selling this idea as a way to help verify identity of the end user and thus block bots. That’s concerning, because it suggests that google will have some verification method likely involving ID and generate a unique token with that info associated with it. This is a real concern for web privacy for like a million reasons, obviously, and ideally should not be adopted by anyone. If other tech gatekeepers adopt it (and they would love to) it will block giant swathes of the internet from people refusing to use the tech and further googles monopoly over general consumer browser use. Now, could the token be fudged? Possibly. But it will take time to figure out.

        • Bizarroland@kbin.social
          link
          fedilink
          arrow-up
          83
          ·
          1 year ago

          And what’s really fucking infuriating about this is that it honestly has nothing to do with making the internet a better place to be or improving the safety of the internet or protecting children or anything like that.

          It’s about ads.

          They’re literally trying to fuck the entire internet in broad daylight so that they have a way to guarantee to their advertisers that they are targeting you with the ads the advertisers want you to see.

        • pinkdrunkenelephants@lemmy.cafe
          link
          fedilink
          English
          arrow-up
          5
          ·
          1 year ago

          🤔 So what happens if you look up porn on a chromium browser and then try to run for office years later? Couldn’t they in principle blackmail whoever they wanted?

        • aluminiumsandworm@kbin.social
          link
          fedilink
          arrow-up
          15
          ·
          1 year ago

          god that’ll make it impossible to do a bunch of frontend work for anything but their browser. which is another reason they want to do it, i’m sure

          • unalivejoy@lemm.ee
            link
            fedilink
            English
            arrow-up
            5
            ·
            1 year ago

            They deprecated it as in it always is set to the same value regardless of the chrome version.

      • theneverfox@pawb.social
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        … Oh. Sorry friend, they’re using TEE, trusted execution environment, aka the place where a key is put by the manufacturer and not available to the user without an exploit or taking apart the processor. Faking it isn’t going to be like changing the user agent

        Fun how companies came up with a way to run code on our hardware at home without our ability to modify it

          • theneverfox@pawb.social
            link
            fedilink
            English
            arrow-up
            3
            ·
            1 year ago

            Yeah… That’s about where I’m at. I figure I’ll keep an old computer set up to deal with things I have to use, but the corporate Internet is really starting to suck. When Reddit went down, I started the long and painful process of finding a better way… It’s going to involve quite a lot of custom solutions, but at least it starts off crappy and quickly improves instead of the opposite

    • datelmd5sum@lemmy.world
      link
      fedilink
      arrow-up
      27
      ·
      1 year ago

      Bing for enterprise is already blocking browsers that aren’t Edge. Clicking “Edge” from the list of browser identities in Firefox seems to go around the block.

      • atocci@kbin.social
        link
        fedilink
        arrow-up
        45
        ·
        1 year ago

        I can already picture Google down-ranking search results for any website that doesn’t implement it because obviously “if they aren’t using the integrity API we can’t guarantee they’re safe for our users”

          • SatanicNotMessianic@lemmy.ml
            link
            fedilink
            arrow-up
            22
            ·
            1 year ago

            This is the process Cory Doctorow termed “enshittification.” Services start out by prioritizing functionality for the users, even running at a loss to do so. This is one reason why new companies have a massive burn rate compared to their income.

            The second step is they stop prioritizing users and start prioritizing “partners.” Those could be news sources, sellers, whatever. User functionality is compromised to optimize the “partner” experience.

            Finally, they start to fuck over partners too, in order to shovel as much money as possible into the company’s accounts. Facebook did it with news sites - especially video. Twitter is doing a speed run on this. Google is accused of being well on its way with search, and I have no idea about their other services.

            So, yes, Google may fuck up search just like Facebook fucked up their feed and Twitter is fucking up absolutely everything.

            • _dev_null@lemmy.zxcvn.xyz
              link
              fedilink
              arrow-up
              7
              ·
              1 year ago

              Google may fuck up search

              They’ve already fucked it up. I’ve moved on to ddg, which is something I thought I would ever do five years ago. If the ddg integration with bing goes south, then I’ll start looking into things like kagi.

          • atocci@kbin.social
            link
            fedilink
            arrow-up
            9
            ·
            1 year ago

            To people who know what’s going on sure, but for most users, if its not on the first page of Google it doesn’t exist.

      • Dangdoggo@kbin.social
        link
        fedilink
        arrow-up
        22
        ·
        1 year ago

        The ‘average’ website wouldn’t but many of the social giants are desperately looking for a way to limit bot use. So Google gives them what they want and simultaneously gets to be the most reliable advertiser, ensuring impressions are viewed by not just a human but the right human.

        • wildginger@lemmy.myserv.one
          link
          fedilink
          arrow-up
          7
          ·
          1 year ago

          How does this limit bot use? Is there something anti bot about chromium? Or does the api do more beyond checking for chromium compatible browsers

          • Dangdoggo@kbin.social
            link
            fedilink
            arrow-up
            13
            ·
            edit-2
            1 year ago

            Because websites will check if you have a Web Integrity token being sent along by the browser and if it cannot find one registrations and login will be closed to your instance.

            Edit: And to clarify, you will not get that token unless you verify your identity within the associated google account. Hence why only Chromium browsers will support this. But it isn’t about the browser. It’s about the token.

            • wildginger@lemmy.myserv.one
              link
              fedilink
              arrow-up
              6
              ·
              1 year ago

              But that token is just provided by the browser, isnt it? Can bots not run within an instance of a chromium browser? I dont get how this stops a bot account.

              • Dangdoggo@kbin.social
                link
                fedilink
                arrow-up
                7
                ·
                1 year ago

                Yeah sorry I just clarified. Read my comment higher up in the thread for more details. The token is generated upon verification of user identity.

      • takeda@szmer.info
        link
        fedilink
        arrow-up
        18
        ·
        edit-2
        1 year ago

        This goes with other changes they did to chromium. Google claims it is to prevent bots, but it really is a crackdown on ads blocking and any other “tampering” with their websites.

        If you care about keeping web free, you should stop using chrome and its derivatives and switch to Firefox. They are believing that Firefox user base is low and websites can simply exclude FF and force it to implement it as well.

    • PixxlMan@lemmy.world
      link
      fedilink
      arrow-up
      7
      ·
      1 year ago

      It’s not about whether it’s a chromium browser or not. It’s about whether a browser is “trusted” and installed from a “trusted” source, like the windows store… Basically gatekeeping. Still, Firefox and any browser could still be approved.

      • Kühe sind toll@feddit.de
        link
        fedilink
        arrow-up
        13
        ·
        1 year ago

        This would be an insane damage to the Linux community since there are many different ways to install programms(including browsers).

        • PixxlMan@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          Absolutely! I would wager a guess that something like this would require support on a package manager level, meaning that the biggest like Ubuntu or what not could have access to a functioning “trusted” browser. But good luck on a niche distro, or if you want to compile it yourself, or if you want to use certain extensions or…

        • PixxlMan@lemmy.world
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          According to Google - probably source code that can’t block ads and that is known to not block trackers… basically.