Re:“Web Environment Integrity” is an all-out attack on the f...
by CharlesW on Friday July 28, 2023 @05:29PM
(#36913618)
> Sounds an awful lot like WAI to me, but at least it's called a "Privacy Access Tokens" so it surely must be good...?
Google's PR strategy is to say "no need to worry, it's just like this Apple thing". But as Google themselves note in their explainer¹, they're quite different, and Google considers PAT insufficient for the kind of enforcement they intend to do.
For example, PAT is ultimately just "not a bot" attestation and so doesn't involve the exchange of device and browser environment data. In contrast, WEI needs that data to enable the kind of "DRM for the web" use cases we're reading about.
Google's PR strategy is to say "no need to worry, it's just like this Apple thing". But as Google themselves note in their explainer¹, they're quite different, and Google considers PAT insufficient for the kind of enforcement they intend to do.
For example, PAT is ultimately just "not a bot" attestation and so doesn't involve the exchange of device and browser environment data. In contrast, WEI needs that data to enable the kind of "DRM for the web" use cases we're reading about.
https://github.com/RupertBenWiser/Web-Environment-Integrity/...