←back to thread

Unpacking Google’s Web Environment Integrity specification

(vivaldi.com)
756 points dagurp | 6 comments | 26 Jul 23 11:30 UTC | HN request time: 0s | source | bottom
Show context
MarkusWandel ◴[26 Jul 23 18:14 UTC] No.36882312[source]▶
"This website is not compatible with your device"

I can see this show up on Youtube (why not - under Google's control, and they want you to watch the ads on their official browser) and on banking apps. Initially. In the longer run, it either withers and dies, or it leads to antitrust action. I really can't see another way.

replies(4): >>36882372 #>>36882811 #>>36883168 #>>36883205 #
yonatan8070 ◴[26 Jul 23 18:43 UTC] No.36882811[source]▶
This will probably be implemented by every streaming service very quickly to try to prevent piracy (which won't work), and will only end up harming people who just want to watch on more freedom-respecting browsers or operating systems
replies(3): >>36883040 #>>36883592 #>>36884853 #
snvzz ◴[26 Jul 23 19:33 UTC] No.36883592[source]▶
It's already not possible to login to Twitch on Linux.

It rejects Firefox and Chrome outright. The solution is to use either browser on Wine, then copy the session cookies over.

replies(5): >>36883707 #>>36884066 #>>36885800 #>>36886870 #>>36888275 #
1. Buttons840 ◴[26 Jul 23 19:40 UTC] No.36883707[source]▶
I think you're wrong because I stream on Twitch using Linux.
replies(2): >>36884518 #>>36884658 #
2. snvzz ◴[26 Jul 23 20:31 UTC] No.36884518[source]▶
When did you last login to the website? Sessions last months, if not years.

I recommend not logging out, as you'd then be affected by this.

replies(3): >>36887487 #>>36889879 #>>36891985 #
3. drdaeman ◴[26 Jul 23 20:39 UTC] No.36884658[source]▶
I was surprised and skeptical, but he seems to be right.

I've opened a brand new Firefox instance and got "Your browser is not currently supported. Please use a recommended browser or learn more here." (linking to https://help.twitch.tv/s/article/supported-browsers?language...) on the login screen.

The login made a zero-payload POST to https://passport.twitch.tv/integrity and it responded with 400 and a JSON body {"error_code": 5025, "error_description": "integrity failed", "error": "Oops! We encountered an unexpected error. Please try again.", ...}.

It seems that this is not about GNU/Linux, though, as it happens at random (searches for `twitch "integrity failed"` produce results from all sort of platforms and browsers). Must be that some pointy haired boss had some important ideas about security.

I was able to log in from a Firefox on a different GNU/Linux system, so it's not like those are always blocked. I suspect there's some User-Agent whitelist or similar kind of nonsense (but looking at the console logs and bunch of WebGL errors it certainly tries to fingerprint the system), but I'm too lazy to investigate this any further.

4. jcranmer ◴[27 Jul 23 01:03 UTC] No.36887487[source]▶
I just logged in less than a minute ago, using Firefox on Linux. No issues whatsoever.
5. nmeagent ◴[27 Jul 23 06:50 UTC] No.36889879[source]▶
I just logged into Twitch with a fresh session in Firefox on a Linux system as well. No problems.
6. folmar ◴[27 Jul 23 11:33 UTC] No.36891985[source]▶
Logged in right now just fine. Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0