News for hackers. Stuff that matters.

A comment on Google employee responds to negative feedbacks on WEI. Parent comment

Re:Google employee responds to negative feedbacks on WEI by danShumway on Wednesday July 26, 2023 @05:40PM (#36885463)
This too. Maybe Google is willing to say something like "okay, for the duration of today, no WEI for you"; but unless they're doing something a lot more clever than the spec suggests, the "fallback" could very well be "retry the request until it succeeds and sends an attestation token."

Google would need to make holdbacks persistent enough that you couldn't retry them and get a different result. Even if they do, there are other problems, but... I mean, randomly failing requests is definitely not enough to guarantee that attestation would be optional.

[ Parent | on HN ]
Re:Google employee responds to negative feedbacks on WEI by pwnna on Wednesday July 26, 2023 @09:09PM (#36887535)
How would you even differentiate between retries? If you isolate it by domain, the website can redirect you 10 times, each collecting an attestation token. They could perform statistical analysis with cookies. Websites could even force logged in users to conform to a particular browser (banking apps already do this). It's difficult for me to understand how the authors can miss these implications. They even said that with holdbacks the websites can still perform statistical analysis. Statistical analysis is not just a tool for aggregate data. It can be applied to a single client with enough other identifiers.
[ Parent | on HN ]