Web Environment Integrity

Web Environment Integrity (WEI) is a controversial API proposal currently being developed for Google Chrome.[1] As of August 2023, a Web Environment Integrity prototype exists in Chromium,[2] but has not shipped in any browser.[3]

Proposal
Sequence diagram showing WEI attestation

The draft proposes an API for websites to get a digitally signed token that contains the certifier's name and whether or not they deem the web client to be authentic. The stated goal is for sites to be able to restrict access to human users instead of automated programs and "allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device". Access to this API will not be allowed in non-secure (HTTP) contexts.[4]

History

On April 25, 2023, Google engineers, Ben Wiser, Borbala Benko, Philipp Pfeiffenberger and Sergey Kataev created a GitHub repository explaining the details of the proposal.[5] The proposal was flamed by GitHub users, with numerous comments, issues and pull requests voicing strong opposition to the existence of the standard and arguing for its deletion.

On July 21, 2023, Wiser and fellow Google engineer Yoav Weiss added a code of conduct to the explanation repository[6] and locked it from receiving new comments, issues or pull requests. On the same day, preliminary code was added to Chromium to implement the standard. This also received a large amount of highly negative comments.[2]

Reception

The proposal has been widely criticized for limiting general purpose computing, with some comparing WEI to digital rights management (DRM).[7][8] Others have accused the standard of being evidence of Google abusing Chrome's near-monopoly of browser share.[9] Some have issued official statements on the matter in 2023:

  • On July 25, Mozilla opposed it, stating "Any browser, server, or publisher that implements common standards is automatically part of the Web ... Mechanisms that attempt to restrict these choices are harmful to the openness of the Web ecosystem and are not good for users."[10]
  • On July 27, Vivaldi opposed it as "simply dangerous" and feared that attestation providers would not be trustworthy.[11]
  • On July 29, the Free Software Foundation opposed it as "an all-out attack on the free Internet" and claimed it would significantly limit the browsers that could be used.[12]
  • On August 1, Brave Software announced they will not include WEI in their web browser.[13]
  • On August 7, the Electronic Frontier Foundation opposed it as "a bad idea that Google should not pursue" and opposed its proposal of selecting a "small percentage" of random users to simulate behavior without WEI in order to prevent websites from blocking unattested users. The EFF claimed that "[m]any websites will consider that 'small percentage' of users an acceptable price to pay" and feared Google would set the percentage extremely low to combat ad fraud.[14]
  • On August 11, the World Wide Web Consortium refrained from taking a stance as it was "not being worked on in W3C, nor has there been any submission [for W3C] review".[15]

See also

References
  1. Amadeo, Ron (August 3, 2023). "Google's nightmare "Web Integrity API" wants a DRM gatekeeper for the web". Ars Technica. Retrieved August 3, 2023.
  2. "[wei] Ensure Origin Trial enables full feature · chromium/chromium@6f47a22". GitHub. Retrieved August 19, 2023.
  3. "Feature: Web environment integrity API". Chrome Platform Status. May 9, 2023. Retrieved August 23, 2023.
  4. "Web-Environment-Integrity/explainer.md at main · RupertBenWiser/Web-Environment-Integrity". GitHub. Retrieved July 26, 2023.
  5. Wiser, Ben (August 18, 2023), Web Environment Integrity API, retrieved August 19, 2023
  6. "Create CODE_OF_CONDUCT.md · RupertBenWiser/Web-Environment-Integrity@7998217". GitHub. Retrieved August 19, 2023.
  7. Amadeo, Ron (July 24, 2023). "Google's nightmare "Web Integrity API" wants a DRM gatekeeper for the web". Ars Technica. Retrieved July 26, 2023.
  8. Claburn, Thomas. "Google Web Environment Integrity draft draws developer rage". The Register. Retrieved July 26, 2023.
  9. Claburn, Thomas. "Google Web Environment Integrity draft draws developer rage". www.theregister.com. Retrieved August 19, 2023.
  10. "Request for Position: Web Environment Integrity API · Issue #852 · mozilla/standards-positions". GitHub. Retrieved July 26, 2023.
  11. "Unpacking Google's new "dangerous" Web-Environment-Integrity specification". Vivaldi Browser. July 25, 2023. Retrieved July 26, 2023.
  12. Farough, Greg (July 28, 2023). ""Web Environment Integrity" is an all-out attack on the free Internet". Free Software Foundation. Retrieved July 28, 2023.
  13. Snyder, Peter (August 1, 2023). "Web Environment Integrity": Locking Down the Web. Retrieved August 29, 2023.
  14. Doctorow, Cory; Hoffman-Andrews, Jacob (August 7, 2023). "Your Computer Should Say What You Tell It To Say". www.eff.org. Retrieved August 7, 2023.
  15. "Web Environment Integrity has no standing at W3C; understanding new W3C work". www.w3.org. August 11, 2023. Retrieved August 11, 2023.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.