unpacking Google's new dangerous web
environment Integrity specification now
we did go over this a little bit earlier
uh it's really hard to talk about this
topic without getting too political so
we're gonna do our best here to thread
the needle here why Vivaldi browser
thinks Google's new proposal the web
environment Integrity Way spec is short
uh is is a major threat to the open web
it should be pushed back okay well let's
help it push it back Let's do let's do
some pushing back Google seems to love
creating specifications that are
terrible for the open web and it feels
like they find a way to create a new one
every few months this time we have come
across some controversy caused by the
new web environment Integrity spec that
Google seems to be working on at this
time I could not find any official
message from Google about the spec so it
is possible that is just the work of
some misguided engineer at the company
that has no backing from higher up but
it seems to be but it seems to be work
that has gone on for more than a year
and the resulting spec is so toxic to
the open web that at this point Google
needs to at least get give some
explanation as how it could go so far
that is a seething review for those that
don't know hopefully uh oh good okay
it's gonna go over it I'd love to hear
what they have to say Okay uh the second
question which is described right here
which by the way uh I'm gonna go over
one quick little part of this one one
really small one
which is this right here is that uh they
want you they want to be able to verify
users or users and their first line kind
of gives away the game right away which
is users like visiting websites that are
expensive to create and maintain but
they often want or need to do it without
directly paying so if you want to know
what Google's kind of up to this is a
very good first statement and then the
second statement which is actually even
more scary is this one right here which
is users sometimes get tricked into
installing malicious software that limit
imitates software like their banking
apps to steal those uh to steal from
those users the bank's internet
interface could protect users if it
could establish that the request it's
getting actually come from the banks or
trustworthy software meaning that Google
wants to exist somewhere in the middle
of you and the internet right that's
truly what it is saying more than just
the browser but even deeper on a request
level right so just so you know
there we go
welcome to Costco I forgot to turn off
uh alerts hold on we'll we'll get to you
I just forgot to turn off alert let's
finish this and I'll say thank you yep
men in the middle attack is now a
feature all right
it's called the web environment
Integrity the idea of it is simple let's
see is as simple as it is dangerous it
would provide websites with an API
telling them whether the browser and the
platform it is running on that is
currently in use is trusted by an
authoritative third party called an
attester the details are nebulous about
the goal seems to be uh to prevent fake
interactions with websites of all kinds
while this seems like a noble motivation
we can all agree this seems good and the
use cases listed seem very reasonable
the solution proposed is absolutely
terrible and has been equated with DRM
for for websites with all that it
implies it is also interesting to note
that the first use case listed is about
ensuring that interactions with ads are
genuine
we let we looked at it while this is not
problematic on the surface it certainly
hints at the idea that Google is willing
to use any means of bolstering its
advertising platform regardless of the
potential harm to its users
yes is the answer despite the next uh
despite the text mentioning the
incredible risk of excluding vendors
read the other browsers it only makes a
lukewarm attempt at addressing the issue
and ends up without any real uh solution
so what's the issue simply if an entity
has the power of deciding which browsers
are trusted and which are not there is
no guarantee that they will trust any
given browser any new browser would by
default not be trusted until they have
somewhat demonstrated that they are
trustworthy to the discretion of the
attesters in other words
who gets the own the browser eyeballs
Google does Google gets to be the you
know I'm sure there will be a foundation
you know there's some you know because
we can all agree that foundations never
are linked to any really terrible
Behavior or any things that are pushed
back by uh by corporations yeah it's
it's certified it's it's yucky right
anyone else also anyone stuck running on
a legacy software where their spec is
not supported would eventually be
excluded from the web to make matters
worse the primary example given of the
attester is Google Play on Android this
means Google decides which browser is
trustworthy on its own platform I do not
see how they can be expected to be
impartial yeah
how could Google be impartial on Windows
they would probably defer to Microsoft
via the Windows store and on Mac they
would defer to Apple so we can expect at
least that at least Edge and Safari are
going to be trusted any other browser
will be left uh to the good graces of
those companies
I wonder if those companies then have to
agree to something like there's going to
be some uni company
right the Ultimate Software Gateway
company right that has to exist at the
top of all this the ultimate Gateway
Foundation right of course you can Note
One glaring Omission in the previous
paragraph what of Linux well that is a
big question will Linux be completely
excluded from browsing the web or the
Kanata or or will canonical become the
decider by virtue of controlling the
snaps package repository but who knows
it's not looking good for Linux
this alone would be bad enough but it
gets worse the spec hints heavily that
one aim is to ensure that real people
are interacting with the websites it
does not clarify in any way how it aims
to do that so we are left with some big
questions about how it will achieve this
will behavioral data be used to see if
the user behaves like a huge in a
human-like fashion that's actually that
I actually never even thought about that
that's actually kind of scary you know
that's kind of scary I I don't know
about this
I you know I never really thought about
the attestations in that kind of sense
right
um will it be uh let's see this will
this data be presented to the testers
will accessibility tools that rely on
automating inputs to the browser uh
cause cause it to become untrusted will
it affect extensions the spec does
currently specify a carve out for
browser modifications and extensions but
those can make automating interactions
with a website trivial so either the
spec is useless or restrictions will
eventually be applied there too it would
otherwise be trivial for an attacker to
bypass the whole thing yep
can we just refuse to implement it
unfortunately it's not that simple this
time any browser choosing not to
implement this would not be a trust
would not be trusted in any website
choosing to use this API could therefore
reject users from those browsers Google
also has ways to drive adoptions uh by
websites themselves first they can
easily make all their properties depend
on using these features and not being
able to use Google websites is a death
sentence for most browsers already
furthermore they could try to mandate
that sites that use Google ads use this
API as well which makes sense since the
first goal is to prevent fake ad clicks
that would quickly ensure that any
browser not supporting the API would be
doomed
yep there is hope uh there is an
overwhelming likelihood that EU law will
not allow a few companies to have a huge
amount of power in deciding which
browsers are allowed and which are not
there is uh no doubt that a testers
would be under a huge amount of pressure
to be fair as possible unfortunately
legislation and judicial judicial
machineries tends to be slow and there's
no saying how much damage will be done
while governments and judges are
examining this if this is allowed to
move forward it will be a hard time for
the open web and might affect smaller
vendors significantly it has been long
known that Google's dominance on the web
browser Market gives them a potential of
becoming an extental threat to the web
with every bad idea they have brought to
the table like Flock topic and client
hints they've come closer to realizing
that potential though it is kind of
terrifying that so few companies truly
own the access to the web
you know what I mean
the problem is you know in America we
have like the whole like uh what's
called Monopoly effect
but I guess in some sense maybe you
could call this like some sort of
corporate version of racketeering right
you can't you can't like landlords can't
agree to all race prices it's
racketeering so in some sense by having
three companies control access to the
internet one could argue maybe it's
racketeering maybe there is laws and
which are currently in place obviously
this is like a not a uh
like right there's a whole new world
right how do you you could never make a
law that could have foresaw this from
happening maybe uh but it's curious uh
web environment Integrity is more of the
same but also A Step Above the Rest in
the threat it represents especially
since it can be used to encourage
Microsoft and Apple to cooperate with
Google to restrict competition both in
browser space and the operating system
space exactly this is like truly like
it's it's racketeering really it is
imperative that they uh be called out on
this and prevented from moving forward
while our vigilance allows us to notice
and push back against all these attempts
to undermine the web the only long-term
solution is to get Google to be on an
even playing field legislation helps us
there but it all uh but so see but so
does reducing their market share
similarly our voice grows in strength
for every Valdez Vivaldi user allowing
us to become more effective in these
discussions we hope that users of the
web realize this and choose their
browsers consequently uh
consequently
uh the fight for the web to remain open
is going to be a long one and there is
much at stake I mean obviously they have
a uh they they obviously have a dog in
the fight right they clearly don't want
to be just shut out right and they run
the risk of being able to be shut out
right
that's kind of it is in itself pretty
terrifying
I think the advice is really good which
is you gotta quit giving Google views
you know what I mean your girlfriend
uses velvetalde and won't uh won't let
me hear the end of it really I didn't
did you do you have like some chat AI
program on your arch install like how
does that work
can she pause your music and your
YouTube ads because you're using
valdaldi the the Vivaldi I know see the
problem is is just stop using Google
right like how do you even do that
got him
um I think someone that's uh one thing
that really was interesting is when uh
when third-party sites start using this
such as imagine cloudflare
how many companies use cloudflare as
like an in-between to prevent ddosing
and stuff like that
right you could imagine a world where
it's not just Google doing it but once
Google sets it in motion and then
cloudflare requires it
the whole internet becomes shut down
yeah you know I don't like this I don't
know the problem is I don't know how how
do you how do you how do you change this
honestly how do you change this I use
Firefox I how do you change this how do
you cause a real change in the market I
feel personally I just feel like
powerless in this situation other than I
can say what's happening and maybe you
guys can can tweet about it Adam you can
right like what do you do I don't know
the name
is the primogene