←back to thread

Unpacking Google’s Web Environment Integrity specification

(vivaldi.com)
756 points dagurp | 5 comments | 26 Jul 23 11:30 UTC | HN request time: 1.212s | source
Show context
bee_rider ◴[26 Jul 23 18:31 UTC] No.36882605[source]▶
As noted in the article, Google comes up with a scheme like this every couple months. They also can’t seem to identify good sites anymore, based on their search results.

So… fuck it. Let them DRM their part of the internet. It is mostly shit nowadays anyway. They can index Reddit, X, and a bunch of sites that are GPT SEO trash.

We’re never getting 201X internet back anyway, so let Google and friends do their thing and everybody who doesn’t want anything to do with it can go back to the 200X internet. It was kind of disorganized but it it better than fighting them on DRM over an over again.

replies(2): >>36882868 #>>36882902 #
pptr ◴[26 Jul 23 18:49 UTC] No.36882902[source]▶
If you can identify bots more accurately, you get less "GPT SEO trash".
replies(3): >>36883165 #>>36883343 #>>36883353 #
1. webstrand ◴[26 Jul 23 19:16 UTC] No.36883353[source]▶
This proposal does not affect bots producing web content, only (potentially) bots browsing web content.
replies(1): >>36883692 #
2. pptr ◴[26 Jul 23 19:40 UTC] No.36883692[source]▶
It does affect bots creating social media content.
replies(1): >>36885365 #
3. hellojesus ◴[26 Jul 23 21:31 UTC] No.36885365[source]▶
Not necessarily. Even with WEI, spammers could farm legit tokens and then set up their own api that hands one out to their bot when one is necessary.
replies(1): >>36887467 #
4. pptr ◴[27 Jul 23 01:02 UTC] No.36887467{3}[source]▶
My understanding is that you can't reuse tokens, because the system uses challenge response.
replies(1): >>36888424 #
5. hellojesus ◴[27 Jul 23 03:07 UTC] No.36888424{4}[source]▶
But can you get a token and then not send it and save it for later? That's more what I was thinking. Not replay attacks but gathering a bunch of tokens thst are valid but never submitted to the origin, and then provide them via api requests to those that need one to use unauthorized devices with that origin.