Apple has deployed a system called Private Access Tokens that allows web servers to verify if a device is legitimate before granting access. This works by having the browser request a signed token from Apple proving the device is approved. While this currently has limited impact due to Safari’s market share, there are concerns that attestation systems restrict competition, user control, and innovation by only approving certain devices and software. Attestation could lead to approved providers tightening rules over time, blocking modified operating systems and browsers. While proponents argue for holdbacks to limit blocking, business pressures may make that infeasible and Google’s existing attestation does not do holdbacks. Fundamentally, attestation is seen as anti-competitive by potentially blocking competition between browsers and operating systems on the web.

  • NaN@lemmy.blahaj.zone
    link
    fedilink
    arrow-up
    33
    ·
    edit-2
    1 year ago

    Google mentioned these in their explainer (they don’t like that they’re fully masked): https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#privacy-pass--private-access-tokens

    Cloudflare explains them more too: https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/

    They are currently going through an IETF standardization: https://datatracker.ietf.org/wg/privacypass/about/

    You can also read the architecture. In general I do trust Cloudflare more than Google. I have no doubt shitty sites won’t fall back to a captcha and will instead block access though, with either solution.

    • dan@upvote.au
      link
      fedilink
      arrow-up
      30
      ·
      1 year ago

      In general I do trust Cloudflare more than Google.

      A large portion of the internet runs through Cloudflare’s network though, so IMO they’re just as much of a risk as Google.

      • fonix232@kbin.social
        link
        fedilink
        arrow-up
        12
        ·
        1 year ago

        However unlike Google, CloudFlare doesn’t have a history of killing off products just as users begin to adapt to them.

        • Atemu@lemmy.ml
          link
          fedilink
          arrow-up
          18
          ·
          1 year ago

          CF has only been public for a few years. Give it a decade and I’m sure they’ll be just as evil as Google.

          • Big P@feddit.uk
            link
            fedilink
            arrow-up
            16
            ·
            1 year ago

            Public companies will always screw you in the end. It’s part of their fundemental design

        • pemmykins@beehaw.org
          link
          fedilink
          arrow-up
          18
          ·
          1 year ago

          That’s not why Google is harmful though - they’re harmful because almost all of their revenue comes from advertising - everything else they offer is just a funnel to gain data on the worlds population in order to better target advertising.

          As for cloudflare - they showed their true colours last year with kiwifarms. They’ll happily host the worst websites in the world as long as they don’t get bad press.

          • andrew@radiation.party
            link
            fedilink
            arrow-up
            19
            ·
            1 year ago

            Slight correction, generally cloudflare doesn’t host any sites (this is untrue in specific circumstances, but in your example they certainly didn’t host the site) - they just sit in front of existing sites and store some static assets, otherwise acting like a transparent reverse proxy.

        • dan@upvote.au
          link
          fedilink
          arrow-up
          12
          ·
          edit-2
          1 year ago

          The main risk with Cloudflare is that if they think your device is malicious, it gets very hard to browse the internet, as every site hosted behind Cloudflare starts showing CAPTCHAs or rate limiting you. This could get worse if new APIs that determine if you’re legit don’t like you for whatever reason.

        • itsAllDigital@feddit.de
          link
          fedilink
          arrow-up
          8
          ·
          1 year ago

          That still however doesn’t relieve them. Whether they’ve killed of less products, IMHO still leaves them at the position that they route MASSIVE amounts of the entire internet.

          One point of failure or control is still a big risk, no matter how you turn it