WEI is for controlling what software runs in the stack, from the bootloader upwards. Traditional secure boot gives assurances up to the kernel. WEI will extend it up to the browser. So more layers of the stack are secured from unauthorized modifications.

You should not use the word "secure", it only checks the integrity, it doesn't guarantee any security, same as on Android. Same for "authorized" which is a bit misleading because only manufacturers can authorize modifications, not users.

The same goes for the word "trusted" as it's often used, e.g. "trusted computing" and the like.

Who's doing the trusting? Not the users.

Trusted is a warm and fuzzy sounding word. But always remember that in terms of security, trust is at best a necessary evil. Trust makes you vulnerable to abuse of that trust.

"Trusted" is not equal to "trustworthy".

Because it's not just the ability of tracking in question but the ability to display the ads as well.

It's been my worry that at some point Google will force DRM on YouTube and I won't be able to backup interesting channels, but I didn't expect Google will put DRM on majority of websites. Last week Google granted itself rights to scrape all the internet for its AI, but doesn't us to do it.

https://www.theverge.com/2023/7/5/23784257/google-ai-bard-pr...

The genius marketing move behind Google nowadays is convincing people that indexing and scraping are two different things and they are the only entity allowed to do it.

because it’s not about fingerprinting or even identity, it’s about forcing the browser to not run code like adblock or code that scrapes their treasured data they amassed for AI use

Google knows well enough that their solution does not attest humans - it attests machines which may or may not be used by humans.

The web is already full of vietnamese click farms of physical android devices with real accounts, their narrative is about misdirection

Exactly, anybody who think this will solve any issue with bots needs to take a hard look on Android and how absolutely nothing changed with the play integrity api, the click farms are just as big as before.

It's effective against thirdparty roms and competitors though.

Because it means that browsers can try to implement features that resist fingerprinting without hurting legitimate use cases of the web.

My guess is that they want to stop bots from creating Google accounts once and for all. I don’t see them putting DRM on YouTube. That would break every app everywhere, and many of them can never be updated. Most could never be updated to this scheme.

I remember when it was common to release third-party Twitter clients and bots were considered first-class citizens.

Large companies are far less uptight about breaking ecosystems that you might think. I say this as a former VB6 developer.

Chrome wants to get rid of fingerprinting, and has for many years (see the entire Privacy Sandbox effort). But they cannot do it unilaterally, they need to identify the legit use cases and design + implement new privacy-preserving technologies to meet those use cases. (Yes, yes, we all know Apple and Firefox have been able to such things unilaterally. But as we've seen by the different reception from Apple having shipped remote integrity attestations in prod for a year to Chrome just proposing it, the rules aren't the same for all browsers.)

Fraud prevention/anti-abuse is both an extensive use case for fingerprinting and the most obviously legitimate one. If we demand that browsers close off all the fingerprinting loopholes (it's a great goal!) but don't allow a replacement, the web will be mostly dead as a platform in 10 years. All economic activity will move to native apps on walled garden platforms that are able to provide effective anti-fraud mechanisms.

WEI is about installing some (closed source) spyware on your computer so that Google knows you're using the "right kind" of client.

Because it's about control, not safety. Or it's about safety, but not for the user, but for whomever publishes content, or software.

Reading through these insighful responses (many thanks) I am inclined to believe that when the WEI references "abuse" and "fraud" what the authors may be referring to is ad fraud and even possible fraud by Google toward its customers, i.e., advertisers. The generality and lack of any detail to support these "justifications" may be intential. The company probably does not want advertisers to know the full extent of the ad fraud problems. An online advertising empire could be a business (=racket) built on sand but the less advertisers understand, the less likely they will be to distrust Google. If there is competition as "Big Tech" assures us time and again, then perhaps the company stands to lose customers to Apple.