Request for Mozilla Position on an Emerging Web Specification Specification Title: Web Environment Integrity API Specification or proposal URL (if available): https://rupertbenwiser.github.io/Web-E...
Google wants to add a feature to the browser where a website can (in a fairly confident and secure way) ask about key facts about the browser environment in the name of security. The kinds of details may be like: What is the browser in use? Has the browser been altered? Are certain plugins active? What kind of OS is in use?
The exact details aren’t really defined yet, but the idea is to be able to provide confidence via answers to these types of questions to the website so they can make decisions based upon these details.
People are (very much rightly) strongly against this since it will only really result in locking down web functionality to environments in the name of security, and there will be a lot of collateral damage in the process while helping browser monopolization.
Using this, websites could lock their use to certain browsers (much more than what’s already possible). Websites could prevent access if certain plugins are enabled (think privacy or adblocking plugins). Websites could prevent access to linux users because “they’re probably hackers”.
Ultimately, this represents a big change into the insight & power a website has in regards to the user browser environment, and is a big risk to the open web, hence why Mozilla are against it.
Google wants to add a feature to the browser where a website can (in a fairly confident and secure way) ask about key facts about the browser environment in the name of security. The kinds of details may be like: What is the browser in use? Has the browser been altered? Are certain plugins active? What kind of OS is in use?
The exact details aren’t really defined yet, but the idea is to be able to provide confidence via answers to these types of questions to the website so they can make decisions based upon these details.
People are (very much rightly) strongly against this since it will only really result in locking down web functionality to environments in the name of security, and there will be a lot of collateral damage in the process while helping browser monopolization.
Using this, websites could lock their use to certain browsers (much more than what’s already possible). Websites could prevent access if certain plugins are enabled (think privacy or adblocking plugins). Websites could prevent access to linux users because “they’re probably hackers”.
Ultimately, this represents a big change into the insight & power a website has in regards to the user browser environment, and is a big risk to the open web, hence why Mozilla are against it.