Conversation

Replying to

What are they going to do on platforms without support for arbitrary application-defined DRM via attestation? They could use hardware key attestation on Android (SafetyNet attestation is what they used and is easily bypassed) and some half measure on iOS, but what about desktops?

1

Replying to

and

Thanks for sketching out some of your concerns in a bit more detail. Need to ponder. So is weak attestation bad, or all attestation b/c it ultimately leads to lack of user agency? Is the bigger criticism simply that ad-funded model is totally unworkable as a model?

1

Replying to

and

If the last, then good bye Internet. It own't be user funded, not at $320B/year globally growing to $1T/year. If you have a better way, lay it on us. In the meanwhile, we level the antifraud playing field vs. G and FB native stacks (low adfraud incidence) vs. programmatic (high).

1

Replying to

and

The painful reality seems there is no 'best' way. Appreciate fear that normalising strong attestation for ad-views may lead to mandatory rather than optional ad-view by industry even if not Brave. Also appreciate that without attestation fraud wins, content loses.

2

Replying to

and

No Best Way = Worse is Better. I object to double standards. Apps (including big ones) use safetynet and are not pilloried for "DRM" or accused of "enforced viewing". Use the same yardstick on us.

1

Replying to

and

I do call that DRM consistently. I'm using the same standards. I was very put off when I saw that Brave was doing this. Regardless, I suggested a stronger way of doing it without a hard dependency on a Google service to try to be helpful and was basically told to fuck off.

2

Replying to

github.com/brave/browser- is one of the places that this started and github.com/brave/browser- is another. Notice how in both cases I was trying to help and was told to fuck off in response. I even put in work to resolve an issue for other browsers, but you aren't welcome to use it.

1

2

1

Replying to

I talked about it on Twitter a while ago, which was followed with you folks spreading misinformation about Chromium and Android without Play Services. I took a deeper look into what Brave has been doing in particular with using SafetyNet attestation as a form of advertising DRM.

2

1

Replying to

You can whine all you want in my mentions about a couple tweets that I posted retracting my endorsement of Brave while saying I still considered it a better choice than Firefox. You did the opposite of changing my mind about not supporting it. I will actively fight you scumbags.

2

2

2

Replying to

and

Hmm - publicly calling out a project as nefarious absent any evidence / rationale, getting a strong response from project team, then dismissing it as 'whining' and doubling-down on 'scumbags' language all seems very bad faith tbh.

3

1

1

Replying to

and

I gave evidence and rationale. This conversation has been incredibly strong evidence. Calling out someone for being completely dishonest, misrepresenting my arguments and doubling down on ridiculous spin is absolutely called for and I wasn't the one showing up acting that way.

1:02 AM · Jul 26, 2019Twitter Web App

Replying to

and

Appreciated you elaborating on concerns, then asked for clarification of logical inconsistencies and don't see them resolved. Questions still have: * weak or all attestation bad? * 1 or all vendors bad for using attestation? * what model works to provide ad-fraud and privacy?

2

Replying to

and

Attestation is a useful feature. It can be used to build valuable security features. Strong attestation based on pairing / provisioning is very useful. I put enormous time into Auditor and AttestationServer to make it useful to users and organizations: attestation.app/about

1

1

1

Show replies