Google's plans to introduce the Web Environment Integrity (WEI) API into Chrome faced strong backlash from web developers, sparking criticism for limiting user freedom and undermining core open‑web principles.
See also: Google implements anti-stalking measures for AirTag
The staff of Vivaldi, Brave and Firefox have taken a strong, opposing stance against Google's proposed standard, and some have even gone so far as to call it DRM (digital rights management) for websites.
What is the proposal of WEI?
Web Environment Integrity (WEI) is a new API proposal that introduces a site trust mechanism that allows websites to assess the authenticity of devices and network traffic on clients (browsers) and to block fake or insecure interactions.
For example, this mechanism can be used to detect whether a human or a bot is visiting a website, or whether a particular browser on a specific type of device is trustworthy.
Websites will use the API to request a token from a certified individual, which will be cryptographically signed to prevent tampering, helping the former verify that the client’s information is legitimate.
The supposed goal of the WEI proposal is to help websites verify the authenticity of the device and software stack from which they receive traffic and to protect users from fraud by preventing malicious online activities.
Examples of use cases include detecting fake engagement on social media, phishing campaigns, non-human traffic, massive account hijacking attempts, gaming fraud, device compromise, and password breaches.
Google states that this does not pose a risk to privacy protection, as it does not allow tracking users across different locations and will not interfere with browser functionality or plugins / extensions.
Proposal: Artificial intelligence will be our new doctor. Goodbye Dr Google!
Critique from browser vendors
The developer of the Vivaldi browser , J. Picalausa, called WEI “dangerous” in an article. He argues that if an entity has the power to decide which browsers are trustworthy, there is no guarantee that any particular browser will be trusted. Any new browser will not be trusted until it has proven itself to be trustworthy, in the judgment of the auditors. Picalausa also highlights the vagueness of Google’s proposal, which he says leaves significant room for potential abuse, such as collecting behavioral data from clients. Vivaldi’s post further explains that the choice not to implement WEI will be complicated, as Google can very easily abuse its dominant position in the advertising market to force its adoption by the majority of websites, rendering opposing browsers useless.
The Brave browser team , however, is not afraid of this scenario, as its co-founder and CEO, Brendan Eich, confirmed that they have no plans to bring WEI. Responding to a Twitter thread, Eich stated that WEI support will not be made available to Brave, just like many other privacy-intrusive mechanisms that Google inserts into the Chrome code, which Brave uses as a base.
Mozilla has yet to officially comment on WEI. However, Firefox engineer Brian Grinstead commented that Mozilla opposes the proposal as it goes against its principles and vision for the web. He stated that mechanisms that attempt to limit choice are harmful to the transparency of the web ecosystem and are not good for users. Furthermore, the use cases listed depend on the ability to “detect non-human movement,” which as described would likely hinder many existing uses of the web, such as assistive technologies, automated testing, and search engine archiving & spidering.
Google's proposal for the WEI API is still in an early development stage and may change form or be significantly modified if all stakeholders agree with its implementation. It will be interesting to see the reaction of anti-monopoly legislative mechanisms and competition principles to this proposal, if Google attempts to enforce it aggressively despite voices of concern and multiple objections against it.
Read also: Google Play: Tests feature that shows what an app looks like on different types of devices
source of information:bleepingcomputer.com
