Web Environment Integrity

File:Web Environment Integrity attestation - How it works.svg showing WEI attestation]]

The draft proposed an API for websites to get a digitally signed token that contains the certifier's name and whether or not they deem the web client to be authentic. The stated goal was for sites to be able to restrict access to human users instead of automated programs and "allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device". Access to this API would not be allowed in non-secure (HTTP) contexts.{{Cite web |title=Web-Environment-Integrity/explainer.md at main · RupertBenWiser/Web-Environment-Integrity |url=https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md |access-date=2023-07-26 |website=GitHub |language=en}}

The proposal first showed up as a commit to Chromium in April before being announced by its developers, Google engineers, in May. It received a few concerned comments from those who followed the browser's rendering engine's development. After discussion at W3C in late April, its working draft specification was published as part of the process to develop standards for the web on July 21, 2023. As a result, users flooded the proposal's GitHub repository with critical comments and flaming of the proposal's authors. As a result, the Google engineers limited comment to those who have contributed to the repository and added a code of conduct. On the same day, Chromium's preliminary code to implement the standard was enabled.

On November 2, 2023, Google abandoned the proposal, removed the prototype implementation from Chromium, and proposed a replacement API named "Android WebView Media Integrity API" limited to WebViews on Android. Google plans to start testing the new API with partners in early 2024.

The proposal received widespread criticism for limiting general purpose computing, with some comparing WEI to digital rights management (DRM).{{Cite web |last=Amadeo |first=Ron |date=2023-07-24 |title=Google's nightmare "Web Integrity API" wants a DRM gatekeeper for the web |url=https://arstechnica.com/gadgets/2023/07/googles-web-integrity-api-sounds-like-drm-for-the-web/ |access-date=2023-07-26 |website=Ars Technica |language=en-us}} Others have accused the standard of being evidence of Google abusing Chrome's near-monopoly of browser share.{{Cite web |last=Claburn |first=Thomas |date=2023-07-25 |title=Google's next big idea for browser security looks like another freedom grab to some |url=https://www.theregister.com/2023/07/25/google_web_environment_integrity/ |access-date=2023-08-19 |website=The Register |language=en}} Some have issued official statements on the matter in 2023:

• On July 25, Mozilla opposed it, stating "Any browser, server, or publisher that implements common standards is automatically part of the Web{{nbsp}}... Mechanisms that attempt to restrict these choices are harmful to the openness of the Web ecosystem and are not good for users."{{Cite web |title=Request for Position: Web Environment Integrity API · Issue #852 · mozilla/standards-positions |url=https://github.com/mozilla/standards-positions/issues/852 |access-date=2023-07-26 |website=GitHub |language=en}}
• On July 27, Vivaldi opposed it as "simply dangerous" and feared that attestation providers would not be trustworthy.{{Cite web |date=2023-07-25 |title=Unpacking Google's new "dangerous" Web-Environment-Integrity specification |url=https://vivaldi.com/blog/googles-new-dangerous-web-environment-integrity-spec/ |access-date=2023-07-26 |website=Vivaldi Browser |language=en}}
• On July 29, the Free Software Foundation opposed it as "an all-out attack on the free Internet" and claimed it would significantly limit the browsers that could be used.{{Cite web |first=Greg|last=Farough|date=2023-07-28 |title="Web Environment Integrity" is an all-out attack on the free Internet |url=https://www.fsf.org/blogs/community/web-environment-integrity-is-an-all-out-attack-on-the-free-internet |website=Free Software Foundation |access-date=2023-07-28 |language=en }}
• On August 1, Brave Software announced they will not include WEI in their web browser.{{Citation |last=Snyder |first=Peter |title="Web Environment Integrity": Locking Down the Web |date=2023-08-01 |url=https://brave.com/web-standards-at-brave/9-web-environment-integrity/ |access-date=2023-08-29 |language=en |mode=cs1}}
• On August 7, the Electronic Frontier Foundation opposed it as "a bad idea that Google should not pursue" and opposed its proposal of selecting a "small percentage" of random users to simulate behavior without WEI in order to prevent websites from blocking unattested users. The EFF claimed that "[m]any websites will consider that 'small percentage' of users an acceptable price to pay" and feared Google would set the percentage extremely low to combat ad fraud.{{Cite web |last1=Doctorow |first1=Cory |last2=Hoffman-Andrews |first2=Jacob |date=2023-08-07 |title=Your Computer Should Say What You Tell It To Say |url=https://www.eff.org/deeplinks/2023/08/your-computer-should-say-what-you-tell-it-say-1 |access-date=2023-08-07 |website=www.eff.org}}
• On August 11, the World Wide Web Consortium refrained from taking a stance as it was "not being worked on in W3C, nor has there been any submission [for W3C] review".{{Cite web |date=2023-08-11|url=https://www.w3.org/blog/2023/web-environment-integrity-has-no-standing-at-w3c/|title=Web Environment Integrity has no standing at W3C; understanding new W3C work|access-date=2023-08-11|website=www.w3.org}}

• {{pslink|iOS 16|Private Access Tokens}}
• Remote attestation

{{Reflist}}

• {{GitHub|RupertBenWiser/Web-Environment-Integrity}}
• [https://chromestatus.com/feature/5796524191121408 Web environment integrity API - Chrome Platform Status]

Category:Google Chrome

Category:Application programming interfaces