Wouldn’t cloudflare’s client (the website you’re trying to visit) be the one to implement this, while cloudflare simply does the verification?
Comment on Apple already shipped attestation on the web, and we barely noticed
Earthwormjim91@lemmy.world 9 months agoWell it’s already integrated into cloudfare and fastly. So good luck with that.
Pretty much all major sites use one of those two as a CDN.
bobs_monkey@lemm.ee 9 months ago
Earthwormjim91@lemmy.world 9 months ago
No it would be cloudfare. That’s their whole business.
So, for example, right now if you visit a website using cloudfare as their CDN, and your browser looks “suspicious”, cloudfare will grab you and redirect you to a verification page to put a captcha in to verify that you’re human before they will direct you back to the website you’re trying to go to. That’s why people use cloudfare in the first place instead of trying to implement some verification themselves. It’s easier and cheaper to outsource to a specialist.
Attestation would just be a “fast pass” for users. If your browser looks “suspicious” then you would be redirected to cloudfare for verification. Instead of a captcha though, it would automatically negotiate with your browser that would present a token generated on device to cloudfare. Cloudfare would reach out to the attestor for that browser with that token to validate it. For safari it would be Apple, for edge it would be Microsoft, for other chromium browsers it would be Google. The attestor would look at the token and be able to say “yes this is a valid, unmodified version of macOS/Windows/ChromeOS/etc and likely to be a normal human” and you would be directed back to the website you want to go to instead of having to put a captcha in.
The danger is when these companies start to control attestation. If you have a modified OS? Sorry we don’t know if they’re human. And you’ll have to enter a captcha. Potentially, if your phone/machine is not the latest version? Sorry don’t know, enter a captcha. Using lineage instead of a licensed version of Android (like Samsungs skin, etc), sorry not validated, enter a captcha.
If attestation becomes mainstream, then it will be the default because it’s cheaper for the CDNs and everyone to do. But it puts the power in the hands of like 3 companies for attestation. And it’s very very likely they will start limiting attestation as a “feature”. Have a galaxy phone? Well if you haven’t upgraded in a few years and are no longer in recurrent supported devices list, sorry no attestation. And they only offer like 3-4 years of official support. So if you don’t want to enter a captcha every time you change webpages, better upgrade homie.
So naturally it will push your average consumer to just upgrading a perfectly fine device instead of keeping it. And it will discourage a ton of FOSS stuff because that will all be “unvalidated modifications” or won’t implement it. If Google implements it, that will be the nail because chrome has like a 70% market share and pretty much everyone will develop for that. So they’ll all develop with Google’s attestation in mind. If you’re using Firefox which won’t implement it, you’ll be entering a captcha every time. And that will push people over to the big companies.
Attestation is a MUCH bigger thing than people think. You don’t need to worry about every website implementing it. You only need to worry about like 3. Cloudfare and Fastly are two huge ones, which have already implemented it on an as available basis. Right now it’s just Safari but they have it available if Google and Microsoft implement it.
Google themselves are the third one since the way operate their own CDN for themselves and clients. If they implement attestation there will be immediately a huge chunk of the web using it. Like 70%+. Cloudfare has 20%+ of the market and Fastly is like 18%. Google makes up another huge chunk but I couldn’t find any figures.
That would be such a huge immediate usage that it would very rapidly become the default and would lock people into only the big companies.
kitonthenet@kbin.social 9 months ago
Ok, so I will not use them. This is acceptable to me
Earthwormjim91@lemmy.world 9 months ago
You’re using two right now lol.
Both Kbin and Lemmy world use Cloudfare as their CDN.
elbarto777@lemmy.world 9 months ago
If an instance enforces this, welp, I’ll use a different one.
Earthwormjim91@lemmy.world 9 months ago
It wouldn’t be an instance. It would be their CDN. And your browser.
And any instance of significant size is going to have a CDN to help deal with the DDoS attacks and bots. Hell I would bet that outside of very carefully curated instances, all fediverse instances will start using CDNs here soon just because of bots.
And chances are they will use cloudfare or Fastly.
But there’s nothing to “enforce”. It’s not a “you must be attested or you can’t access” it will be “if you’re not attested you will have a captcha shown for most things”.
Cloudfare already does this. If your browser looks suspicious, and the website you’re visiting using cloudfare as a CDN, you’ll be redirected to cloudfare to enter a captcha before they’ll let you into the site.
Attestation removes that captcha part using a token generated by your device and validated by the maker of the browser you’re using. So you’d never even see the redirect at all, it would just take a second or two longer to connect.
People using heavily modified machines or browsers wouldn’t be attested and would have to enter a captcha. That’s about it.
kitonthenet@kbin.social 9 months ago
I don’t have any problem accessing them, which was my point
herrvogel@lemmy.world 9 months ago
If you’re gonna make a conscious effort to not use cloudflare and fastly you might as well quit the internet altogether. You use those things all the time, mostly without even realizing it.
kitonthenet@kbin.social 9 months ago
I realize exactly how much I use them, reread what I have written.
elbarto777@lemmy.world 9 months ago
Right. It’s sort of like a paywall site. I simply find what I need elsewhere.