DRM at Google, newest proposed web standard
DRM at Google.
The Internet got wind of this proposal for a “Web Environment Integrity API. The explainer is authored by four Googlers.
To see important ads, turn off your ad blocker! Article continued below:Including at least one person on Chrome’s “Privacy Sandbox” team, which is responding to the death of tracking cookies by building a user-tracking ad platform right into the browser.
The intro to the Web Integrity API starts out:
“Users often depend on websites trusting the client environment they run in. This trust may assume that the client environment is honest about certain aspects of itself, keeps user data and intellectual property secure, and is transparent about whether or not a human is using it.”
DRM at Google, project.
The goal of the project is to learn more about the person on the other side of the web browser, ensuring they aren’t a robot and that the browser hasn’t been modified or tampered with in any unapproved ways.
The intro says this data would be useful to advertisers to better count ad impressions, stop social network bots, enforce intellectual property rights, stop cheating in web games, and help financial transactions be more secure.
Perhaps the most telling line of the explainer is that it “takes inspiration from existing native attestation signals such as [Apple’s] App Attest and the [Android] Play Integrity API.”
Play Integrity (formerly called “SafetyNet”) is an Android API that lets apps find out if your device has been rooted. Root access allows you full control over the device that you purchased, and a lot of app developers don’t like that.
So if you root an Android phone and get flagged by the Android Integrity API, several types of apps will just refuse to run.
You’ll generally be locked out of banking apps, Google Wallet, online games, Snapchat, and some media apps like Netflix.
You could be using root access to cheat at games or phish banking data, but you could also just want root to customize your device, remove crapware, or have a viable backup system. Play Integrity doesn’t care and will lock you out of those apps either way.
DRM at Google and web.
Google wants the same thing for the web.
Google’s plan is that, during a webpage transaction, the web server could require you to pass an “environment attestation” test before you get any data.
At this point your browser would contact a “third-party” attestation server, and you would need to pass some kind of test.
If you passed, you would get a signed “IntegrityToken” that verifies your environment is unmodified and points to the content you wanted unlocked.
You bring this back to the web server, and if the server trusts the attestation company, you get the content unlocked and finally get a response with the data you wanted.
Google likes to describe its APIs in a generic sense, but in reality, most of the actors in this play would probably be Google.
Google may or may not be supplying the website, Chrome would be the browser, and the attestation server would definitely be from Google.
DRM at Google, document.
Google’s document pinky-promises the company doesn’t want to use this for anything evil.
The authors “strongly feel” the API shouldn’t be used to uniquely fingerprint people, but they also want “some indicator enabling rate limiting against a physical device.”
In the “non-goals” section, the project says it doesn’t want to “interfere with browser functionality, including plugins and extensions.”
That’s a veiled reference to not killing ad-blockers, even though the project mentions better advertising support as some of its goals. Chrome already has a “kill ad blockers” plan anyway (or at least “watered-down ad blockers” plan).
It’s called Manifest V3, which will change the way critical extension APIs work so they can’t modify webpage content as effectively. Google also says it doesn’t want to “exclude other vendors” from its DRM scheme.
Google hasn’t done much in the way of public promotion of this idea yet, and even the documentation is only hosted on an employee’s personal GitHub account, rather than an official Google repo.
Exactly how the rest of the world feels about this is not necessarily relevant, though.
Google owns the world’s most popular web browser, the world’s largest advertising network, the world’s biggest search engine, the world’s most popular operating system, and some of the world’s most popular websites.
All The Best!
