Request for Mozilla Position on an Emerging Web Specification Specification Title: Web Environment Integrity API Specification or proposal URL (if available): https://rupertbenwiser.github.io/Web-E...
I believe there’s a misunderstanding somewhere. I wasn’t suggesting anything; I was explaining how Web Environment Integrity could be altered in the future to kill extensions.
The current form of WEI does not have the ability to enforce anything. It isn’t itself DRM, and it can’t prevent extensions from running on pages. What it can do and the only thing it does, is tell websites about the browser environment.
Right now, the only thing it tells websites is the name of the browser. A website having the browser name can’t directly enforce page integrity. It’s already possible to find out the browser name through the user agent or by fingerprinting it with JavaScript.
If WEI is approved and implemented, that opens up the possibility for future additions to the specification. Those changes could require that the browser sends more info to websites. I gave the example of a change that would require WEI tells the website that the browser has an extension which could modify the page contents.
A website having that information would turn WEI into DRM. It gives the website the choice to refuse service to any browser that is running an extension that could change what the user sees.
I hope that was more clear. I don’t expect Google to make changes that immediately block extensions, and then be kind enough to allow some of them back. I suspect they would make changes that don’t prevent extensions, and then revise them to prevent certain types of extensions.
I think the concern I have is in what they said they will do. That is quite disturbing, and unless they are lying, that is where their intention is. Combined with web manifest v3, it’s clear they are quite motivated and they have a long term plan here. They’re dropping it piece by piece perhaps to remove opposition to it. Rather than stab someone to death, it’ll be death by papercuts. My view is we should take the paper off them now based on what we know, rather than waiting until they kill someone.
My concerns is beyond extensions, it’s when it goes towards browsers, and operating systems. My concerns is with the focus on attestation, is this is going to have the potential to tie in to TPM and could be potentially used for fingerprinting based on hardware regardless of what you try to do. There is a number of things in motion that independently seem benign but when combined together, are absolutely disturbing. Giving google control over what is and isn’t approved is dangerous. They simply cannot be trusted.
I believe there’s a misunderstanding somewhere. I wasn’t suggesting anything; I was explaining how Web Environment Integrity could be altered in the future to kill extensions.
The current form of WEI does not have the ability to enforce anything. It isn’t itself DRM, and it can’t prevent extensions from running on pages. What it can do and the only thing it does, is tell websites about the browser environment.
Right now, the only thing it tells websites is the name of the browser. A website having the browser name can’t directly enforce page integrity. It’s already possible to find out the browser name through the user agent or by fingerprinting it with JavaScript.
If WEI is approved and implemented, that opens up the possibility for future additions to the specification. Those changes could require that the browser sends more info to websites. I gave the example of a change that would require WEI tells the website that the browser has an extension which could modify the page contents.
A website having that information would turn WEI into DRM. It gives the website the choice to refuse service to any browser that is running an extension that could change what the user sees.
I hope that was more clear. I don’t expect Google to make changes that immediately block extensions, and then be kind enough to allow some of them back. I suspect they would make changes that don’t prevent extensions, and then revise them to prevent certain types of extensions.
I think most of what you have said is reasonable.
I think the concern I have is in what they said they will do. That is quite disturbing, and unless they are lying, that is where their intention is. Combined with web manifest v3, it’s clear they are quite motivated and they have a long term plan here. They’re dropping it piece by piece perhaps to remove opposition to it. Rather than stab someone to death, it’ll be death by papercuts. My view is we should take the paper off them now based on what we know, rather than waiting until they kill someone.
My concerns is beyond extensions, it’s when it goes towards browsers, and operating systems. My concerns is with the focus on attestation, is this is going to have the potential to tie in to TPM and could be potentially used for fingerprinting based on hardware regardless of what you try to do. There is a number of things in motion that independently seem benign but when combined together, are absolutely disturbing. Giving google control over what is and isn’t approved is dangerous. They simply cannot be trusted.