<story><title>Unpacking Google’s Web Environment Integrity specification</title><url>https://vivaldi.com/blog/googles-new-dangerous-web-environment-integrity-spec/</url></story><parent_chain><item><author>lern_too_spel</author><text>Not the same thing. Attestation doesn&amp;#x27;t mean you can&amp;#x27;t run software you want on your own phone, which Android allows despite having build attestation APIs.</text></item><item><author>dcposch</author><text>And speaking of user-hostile, locked-down phones...&lt;p&gt;a galactic irony that Ben Wiser, the Googler who posted this proposal, has a blog where his &lt;i&gt;most recent post&lt;/i&gt; is a rant about how he&amp;#x27;s being unfairly restricted and can&amp;#x27;t freely run the software he wants on his own device.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;benwiser.com&amp;#x2F;blog&amp;#x2F;I-just-spent-%C2%A3700-to-have-my-own-app-on-my-iPhone.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;benwiser.com&amp;#x2F;blog&amp;#x2F;I-just-spent-%C2%A3700-to-have-my-...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;RupertBenWiser&amp;#x2F;Web-Environment-Integrity&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;RupertBenWiser&amp;#x2F;Web-Environment-Integrity&lt;/a&gt;</text></item><item><author>rcxdude</author><text>This is especially rich coming from google&amp;#x27;s, who&amp;#x27;s &amp;#x27;safetynet&amp;#x27; for android results in a significant reduction in security (contrary to its stated purpose): it locks out 3rd-party up-to-date and secure ROMs while allowing horrificly insecure manufacturer-provided ROMs to still pass, because to disable those would cause a massive user outcry. So it functions as a vendor lock-in but no meaningful increase in security for the average user, while preventing more advanced users from improving their security without needing to buy more hardware. This needs to be called out more to push back against the claim that this kind of attestation somehow has a legitimate benefit for the users.</text></item></parent_chain><comment><author>tehbeard</author><text>&amp;gt; Attestation doesn&amp;#x27;t mean you can&amp;#x27;t run software you want on your own phone,&lt;p&gt;I couldn&amp;#x27;t run my bank&amp;#x27;s app on an up to date and security patched lineageOS ROM Thanks to safetynet, even trying the hack around approaches.&lt;p&gt;They&amp;#x27;d happily accept the out of date, CVE riddled official ROM however as it had the &amp;quot;popes blessing&amp;quot; from Google.</text></comment>
<story><title>Unpacking Google’s Web Environment Integrity specification</title><url>https://vivaldi.com/blog/googles-new-dangerous-web-environment-integrity-spec/</url></story><parent_chain><item><author>lern_too_spel</author><text>Not the same thing. Attestation doesn&amp;#x27;t mean you can&amp;#x27;t run software you want on your own phone, which Android allows despite having build attestation APIs.</text></item><item><author>dcposch</author><text>And speaking of user-hostile, locked-down phones...&lt;p&gt;a galactic irony that Ben Wiser, the Googler who posted this proposal, has a blog where his &lt;i&gt;most recent post&lt;/i&gt; is a rant about how he&amp;#x27;s being unfairly restricted and can&amp;#x27;t freely run the software he wants on his own device.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;benwiser.com&amp;#x2F;blog&amp;#x2F;I-just-spent-%C2%A3700-to-have-my-own-app-on-my-iPhone.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;benwiser.com&amp;#x2F;blog&amp;#x2F;I-just-spent-%C2%A3700-to-have-my-...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;RupertBenWiser&amp;#x2F;Web-Environment-Integrity&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;RupertBenWiser&amp;#x2F;Web-Environment-Integrity&lt;/a&gt;</text></item><item><author>rcxdude</author><text>This is especially rich coming from google&amp;#x27;s, who&amp;#x27;s &amp;#x27;safetynet&amp;#x27; for android results in a significant reduction in security (contrary to its stated purpose): it locks out 3rd-party up-to-date and secure ROMs while allowing horrificly insecure manufacturer-provided ROMs to still pass, because to disable those would cause a massive user outcry. So it functions as a vendor lock-in but no meaningful increase in security for the average user, while preventing more advanced users from improving their security without needing to buy more hardware. This needs to be called out more to push back against the claim that this kind of attestation somehow has a legitimate benefit for the users.</text></item></parent_chain><comment><author>simbolit</author><text>Not the same thing.
Still close enough to trigger irony detectors.</text></comment>