Submitted 1 year ago by lautan@lemmy.ca to technology@lemmy.world
https://httptoolkit.com/blog/apple-private-access-tokens-attestation/
I’m getting here too late for this to be visible, but fuck it.
The difference is Apple doesn’t pass any information on to the website. It just tells the website whether or not the device is Apple approved or not.
Googles shit is going pass actual information about the device to the site so they can restrict access based on any criteria.
It’s hardly OK for Apple to be doing even that either, you know. Who the fuck does Apple think it is, to be entitled to “attest” to a goddamn thing?!
Can you post any source at all that would back your claims? Or any technical details at all?
Neither the actual proposal github.com/RupertBenWiser/…/explainer.md#what-inf…, nor the article itself seem to show that there would be a difference when it comes to privacy.
The entire problem with this proposal is that it limits client choice, similar to how Google Play integrity API on Android restricts some apps from running on rooted/unlocked phones.
That same problem obviously also exists in Apple’s implementation.
Your comment was on the top for me, Lemmy’s default “hot” sorting brings fresh takes to the front, so don’t worry too much about your answers always getting buried.
Transmitting that info to Apple is still a problem. Why do you trust Apple, but not Google?
Google’s version will likely ask you first, and you’ll know which sites are asking for it. Apple’s won’t.
Big tech tries hard to act like the Internet Government, don’t they…
We did by giving them billions and billions of consumer dollars.
The danger would be important entities like governments and banks using attestation. Then you'd be limited to using only Chrome, Safari and Edge, and Firefox could kiss its ass goodbye.
Bank: my bank is too boomercore to ever implement something like this, we only recently got 2fa
Government: my government still makes me file my taxes on paper and mail it to them so I’m ok for now
Banks and governments could get trapped into this because a third party vendor implements a system for them that includes this.
Like Salesforce's "Lightning Experience sites" only supports the latest versions of iOS and Android, as well as only supporting chromium based browsers and Firefox.
A lot of banks and government services run on that platform, and not all of them are going to be smart enough to pay for a custom solution that increases device support.
My bank is welcome to implement features that prevent using Firefox. It’ll cost them when I move my deposits, but they’re welcome to do it.
People didn’t leave Wells Fargo and BoA en masse with all the illegal shit they did, why do you think this would have any real effect on them?
The EU wouldn’t really stand for that.
The EU lets them getnaeay with requiring device attestation for their mobile apps. It’s not exactly the same thing since system requirements for native apps are traditionally narrower than websites, but it’s similar.
Let's hope not.
In the UK at least, switching banks is super easy, I’ve done in twice in the last 2 months because they offered free cash to do so, there is enough competition that the banks have to make it easy to move or else they lose customers.
For government, generally most systems are built to be as accessible as they can be because there has been [gov.uk/…/accessibility-requirements-for-public-se… ](whole raft of legislation) written up to cover this.
I’m not saying it wouldn’t be a problem (power companies etc could prove to be sticky) but there are legal requirements that entities above a certain site have to meet.
Somehow, I am but surprised. Both, that Apple already did it and that there was no public outcry about it.
The solution would be not to visit those sites that require this, right?
Well it’s already integrated into cloudfare and fastly. So good luck with that.
Pretty much all major sites use one of those two as a CDN.
Ok, so I will not use them. This is acceptable to me
Wouldn’t cloudflare’s client (the website you’re trying to visit) be the one to implement this, while cloudflare simply does the verification?
Hard when those sites are things like your bank, your government official stuff pages, etc.
This attestation stuff is a “not such a bad idea in its basic principle” thing that will actually absolutely get abused everywhere in every way including being used to kill off browser competitors, enhance monopoly positions, etc.
It needs to be stopped now.
what good does it do? why should the server see or care about anything on this side? spit out the damn content
what worries me is that ‘web environment integrity’ is the perfect bullshit smarmy business school name for it
Getting a list together would be step 1
Would a list of “offenders” be necessary? I’d say a list of alternative sites that don’t implement this BS would be better.
your treatment on the web depends on whether Apple says your device, OS & browser configuration are legitimate & acceptable.
Well, fuck that.
It’s not a problem until more sites start REQUIRING it, and then it’s too late. Even if some Apple already provides it, it’s more dangerous as use grows
It makes it even more easy to adjust online prices for apple users, lol
is there any positive use case for it for the user at all?
No, its an alternate evil scheme to uniquely identify users and not bots. Replacing the phone number.
For sites that support it, you don’t have to fill out a captcha.
Instead it transmits a list of running processes (or other, formerly private info).
What I don’t understand is how does the attester check the device is not modified? Anything client side is just a matter of time until its get bypassed.
It needs integration with the TPM/secure element chip in the CPU and a device key issued by the manufacturer to sign an attestation that nothing in the software chain from kernel to browser has been modified .
These schemes tends to get regularly broken, just look at SGX
What does this mean? Do they now own the internet ? Can someone please TLDR it?
A very short TLDR would be:
Apple (in this case) decides if your device should be trusted as a human, or if it’s suspicious / a robot, which could break parts of the Internet for those not joining this “attestation”, or using software that doesn’t support it.
A more ELI5 version would be that Apple has implemented a controversial API (The Web Environment Integrity API) that indicates if a combination of OS + Browser + User behaviour is to be trusted as being human.
Attestation before used to mean “is this device who it says it is”, and one can check that in some ways as part of WebAuthN (aka “Passwordless login”), where it would be useful to know if an Android device a site knows you have (as you’ve logged in before) is that same device. It’s a system to trust devices. The WEI-API expands this to look at your OS, your browser and your environment, like installed applications.
Problem with this, is that the requirements don’t have to be public. Apple can decide what makes a “trustworthy device” and what can be considered “suspicious”.
Bad examples like these are to “fail” attestation if you have torrent clients installed, of if you’re connected via a VPN, or if you’re not using Bing + Edge on Windows.
Browsers and OS’es refusing to support attestation are likely to become a minority (most users use Chrome, and Google seems to be in favour). Should sites start blindly trusting this “attestation” - in replacement of captcha’s -, we could start seeing more privacy-prone combinations being locked out of these kind of sites.
Thanks mate. I’ll tell everyone to stop buying apple products but people are really ignorant and would not careless. Their $2000 phone is more imp. to showoff than fucking Internet.
including some of lemmy instances, time to delete my account.
kitonthenet@kbin.social 1 year ago
These schemes all have the same problem that reddit and Twitter have: they need me more than I need them. If your website or app or whatever won’t work if I’m not on the right device I won’t visit it, and that’s not a bad thing
Zoidberg@lemm.ee 1 year ago
It’s a bit more complicated than that, unfortunately.
What happens when Microsoft adds something to their web building tools that forces all visitors to websites using these tools to use IE? Or when your bank (or even worse, utilities) start requiring Windows and IE?
toddestan@lemmy.world 1 year ago
It’ll probably end up worse than that. Turn off secure boot and Windows may still run, but it will no longer verify and all these sites will now refuse to work on your computer. So if you like to run Linux, even dual booting or running Windows in a VM won’t be good enough anymore.
kitonthenet@kbin.social 1 year ago
I'd be very surprised for one thing, because IE is no longer a product Microsoft supports in any capacity. I'd also be confused as to which tools the web hosting market just shifted to that they're using Microsoft tools, there are monopolists out there I'm worried about but Microsoft isn't my main one right now
bob_wiley@lemmy.world 1 year ago
Thorny_Thicket@sopuli.xyz 1 year ago
If I as an adult still had my mom telling me that’s enough internet for today, and taking away my laptop, I’d hate it but it would objectively be good for me. This is kind of a similar thing. I don’t like that these companies fuck up services I like but there’s no denying that me leaving reddit for example was overall quite positive thing to happen.
kitonthenet@kbin.social 1 year ago
Yep, that’s the bargain I’m making. I’m way happier now that I’m not yelling at nerds on Reddit/Twitter/etc. The nerds on the fediverse are much less time consuming
deweydecibel@lemmy.world 1 year ago
This sentiment comes off a lot like “it won’t affect me, I don’t care”.
Like, it doesn’t really matter whether you decide not to use these websites anymore. Nobody should have to put up with this shit. That’s why we take a stand against it.
kitonthenet@kbin.social 1 year ago
Then you’ve severely misunderstood what I wrote
That is exactly what I’m advocating for
grue@lemmy.world 1 year ago
Exactly. There’s a good reason why we don’t, for example, allow people to sell themselves into slavery, even if they “consent” to it!
cy_narrator@discuss.tchncs.de 1 year ago
Till one day your government will require it.
kionite231@lemmy.ca 1 year ago
🇨🇳
woodgen@lemm.ee 1 year ago
I hope you will make the difference. Show em!
kitonthenet@kbin.social 1 year ago
I don't see why I should be the only one
dan1101@lemm.ee 1 year ago
If everyone who is informed about privacy and security boycotts I don’t think that will make much difference unfortunately. There are billions who don’t know or don’t care.
RobertOwnageJunior@lemmy.world 1 year ago
Dummy.