undefined | Better HN

0 pointsdevsda2y ago0 comments

> If most users of a service agrees to, for example, run an attestable environment to access a service

With Chrome's near monopoly in browsers, most users will run an attestable environment when chrome ships it without ever knowing and agreeing to doing so.

Even if Google manages to "collect" consent, this has so much potential to adversely impact everyone(including businesses) except Google in the long term that it should not be allowed.

0 comments

judge20202y ago

If the customer is already running in an attestable environment, why would they disagree with attesting to that environment?

> this has so much potential to adversely impact everyone(including businesses) except Google in the long term

How so? It prescribes mechanisms to ensure websites don’t exclude certain browsers/OSes

> To protect against both risks, we are evaluating whether attestation signals must sometimes be held back for a meaningful number of requests over a significant amount of time (in other words, on a small percentage of (client, site) pairs, platforms would simulate clients that do not support this capability). Such a holdback would encourage web developers to use these signals for aggregate analysis and opportunistic reduction of friction, as opposed to a quasi-allowlist: A holdback would effectively prevent the attestation from being used for gating feature access in real time, because otherwise the website risks users in the holdback population being rejected.

devsdaOP2y ago

> If the customer is already running in an attestable environment, why would they disagree with attesting to that environment?

There are countless modern PCs that have secureboot enabled by default. Does that mean all their users endorse and agree with secure boot based attestation knowingly?

My point is defaults cannot and should not automatically be treated as implicit consent/knowledge.

Attestation will be enabled by default when Chrome ships WIE and the "majority" condition you mentioned will most certainly be true from day one. That doesn't necessarily mean that every single user of chrome is onboard and happy with WIE.

j / k navigate · click thread line to collapse