In a move that has sparked controversy and raised concerns in the tech community, Google has introduced a new proposal called the Web Integrity API. This API aims to enhance "trust and security" in the client environment by providing websites with a token that offers evidence about the client code's surroundings. While this may initially seem like a positive step towards fraud detection and ensuring the authenticity of devices and software, a deeper analysis reveals potential dangers to user privacy and the open web.

Understanding the Web Environment Integrity Explainer

The Web Environment Integrity Explainer, drafted by four Google engineers, outlines the fundamental concept behind the Web Integrity API. According to the engineers, websites will have the freedom to trust or not trust the information provided by the token. The information, which can come from the operating system, is not mandatory and may vary across different operating systems. The goal of this tool is to detect fraud and maintain the authenticity of devices and software.

However, concerns arise when considering the potential for this API to be exploited for controlling user behaviour on the web. Critics argue that it could serve as a disguised introduction of Digital Rights Management (DRM) into web pages, effectively rendering ad-blocking nearly impossible. This could force users to rely on fully locked-down devices or prove their authenticity to access online content.

Monopolistic Control and Manipulation of Trust Scores

One of the major concerns surrounding Google's Web Integrity API is the possibility of monopolistic control. By controlling the "attesters" responsible for verifying client environments, Google could potentially manipulate trust scores and favour its browser, Chrome, over competitors like Firefox. Attesters play a crucial role in determining whether a device and browser can be trusted to access certain websites. This setup threatens the freedom to choose any browser on any operating system, thus harming the open web.

Google's Dominance and Revenue from Search Ads

Google's dominant position in the web browser market, with Chrome capturing a staggering 63% market share, raises further alarms regarding the implications of the Web Integrity API. With such a massive user base, Google's influence over web standards becomes a cause for concern. This dominance not only impacts Chrome users but also alternative browsers like Brave or Edge, which are built on the same open-source Chromium project. The traditional methods of advocacy and promoting alternatives, such as Firefox, seem futile in the face of Google's overwhelming control.

Furthermore, Google's revenue in 2022 demonstrates the extent of its reliance on search ads. Out of the company's total revenue of $279.81 billion, an astonishing $162.45 billion came from search ads alone. This financial reliance further reinforces the need for Google to ensure its advertising revenue stream, potentially at the expense of user privacy and the open web.

Privacy Concerns and User Identity at Stake

One of the most critical aspects impacted by the Web Integrity API is user privacy. The right to privacy online is considered a human right, encompassing freedom from surveillance, the ability to use encryption, and the right to protect one's anonymity. However, the API defies these principles, posing a significant breach of privacy.

The API allows websites to request a token that provides information about the user's device and software stack. This opens the possibility for Google to collect more data about users than necessary for normal website functionality. While the proposal claims that the tokens will not include unique identifiers, the risk of potential misuse remains. Websites associating specific devices with user behaviour could lead to profiling, enabling targeted advertising and potentially discriminatory practices.

Explicit user consent for the collection and use of this information is not mentioned in the proposal, raising further ethical and privacy concerns. Additionally, the API could undermine users' ability to browse the web anonymously, especially when websites can link specific device and software information with individual users over time.

Ensuring Fairness and Preventing Vendor Exclusion

Another pressing concern with the Web Integrity API is preventing attesters from using the system to exclude certain vendors. While the proposal vaguely mentions the requirement for attesters to provide their services under the same conditions to all browsers meeting baseline requirements, the specifics of setting and enforcing these requirements remain unclear.

The potential for bias and exclusionary practices is a significant worry, as attesters could manipulate the system to favour specific vendors or browsers. This further underscores the risk of monopolistic control and its detrimental impact on competition and user choice.

The Impact on the Open Web and Ad-Blocking

The rise of ad-based business models has been instrumental in the growth of the web, facilitating the development of various online platforms. However, Google's Web Integrity API poses a significant threat to ad-blocking, potentially undermining the open web. By making ad-blocking nearly impossible, users may be forced to endure intrusive ads, compromising their browsing experience and raising concerns about privacy and security.

Proceed with Caution: Google's Privacy Rule Changes

Recent changes to Google's privacy rules indicate a growing trend in data collection and utilization. Google collects information from public sources on the internet to improve its AI services, such as Bard and Cloud. This data-centric approach further emphasizes the need for caution when considering the implications of Google's Web Integrity API.

Conclusion

Google's Web Integrity API proposal, while presented as a means to enhance trust and security, raises significant concerns about privacy, user choice, and the future of the open web. The potential for monopolistic control, the erosion of user privacy, and the threat of ad-blocking all point to a need for careful consideration and scrutiny. As users, it is crucial to be aware of the implications and advocate for the preservation of privacy rights and the open web.

Google's Web Integrity API: A Threat to Privacy and the Open Web