Google's Web Integrity API Options

[Christian J]

Sounds like another fishy idea from Google, the ads must be served at any cost:
https://arstechnica.com/gadgets/2023/07/goo...rm-for-the-web/

[pandy]

I don't get how DRM comes into this. Or is it another DRM than the one that protects digital proptery, like e-books?

[Christian J]

I haven't read the proposal, but according to the article it seems to be DRM for browsers:

"The goal of the project is to learn more about the person on the other side of the web browser, ensuring they aren't a robot and that the browser hasn't been modified or tampered with in any unapproved ways. The intro says this data would be useful to advertisers to better count ad impressions, stop social network bots, enforce intellectual property rights, stop cheating in web games, and help financial transactions be more secure.
...
Google's plan is that, during a webpage transaction, the web server could require you to pass an "environment attestation" test before you get any data."

Sounds a bit like what Cloudflare is currently doing (often blocking Tor Browser exit nodes as a result), but worse.

"The authors "strongly feel" the API shouldn't be used to uniquely fingerprint people, but they also want "some indicator enabling rate limiting against a physical device." In the "non-goals" section, the project says it doesn't want to "interfere with browser functionality, including plugins and extensions." That's a veiled reference to not killing ad-blockers, even though the project mentions better advertising support as some of its goals."

The article also links to this feedback thread: https://github.com/RupertBenWiser/Web-Envir...es?q=is%3Aissue

[pandy]

Yeah, but DRM is for protecting content. But when I think about it I guess that works. The site is DRM protected and the handshake we give them also gives them our identity...

What they wrote about an API that lets apps find out if a phone is rooted so the app can refuse to run on such phones isn't great either. I've always wanted to root my phone, but since all instructions I find are written by script kiddies judging from the language I don't understand them and haven't dared to try. I would have consider to pay someone to do it though. But if I risk that for example Bank ID won't run it's not such a good idea.

I think Win95 was a great OS and I also liked the web a lot better back then! 👿

[Christian J]

Yeah, but DRM is for protecting content. But when I think about it I guess that works. The site is DRM protected and the handshake we give them also gives them our identity.

My understanding is that the browser is the software they want to "protect". So if you modify your browser too much (like tweaking about:config in Firefox, if that will even be possible?), websites will refuse to serve it content.

This will also force other browser vendors to implement Google's DRM in their browsers, or they won't work on the Big Tech sites anymore.

But if I risk that for example Bank ID won't run it's not such a good idea.

That may or may not be FUD (maybe the BankID website has more information?). I would be more worried about bricking the phone, so try it on an older phone instead of your primary one.

[pandy]

OK. I just skimmed the text.

I've never had a working old phone. Well, I have one, but it's so old so I don't know what I would be able to do with it. More than possibly phone.

[Christian J]

Google gets its way, bakes a user-tracking ad platform directly into Chrome
https://arstechnica.com/gadgets/2023/09/goo...ches-in-chrome/

Google Chrome pushes ahead with targeted ads based on your browser history
https://www.theregister.com/2023/09/06/goog...y_popup_chrome/

[pandy]

Nice. I remember when Chrome was new. I of course wanted to try it. As soon as I had installed it both my harddrives started to work like crazy and didn't stop until I uninstalled it. Coincidence? I think not. I haven't had it on a computer since.

"Do no evil" - right. 🤣

[pandy]

BTW there is no way to remove Chrome from an Android phone, not without leet skillz anyway. There's only a disable button. But who knows if that really disable it and all its components?