It's a bit more complicated than that, unfortunately.

What happens when Microsoft adds something to their web building tools that forces all visitors to websites using these tools to use IE? Or when your bank (or even worse, utilities) start requiring Windows and IE?

If I as an adult still had my mom telling me that's enough internet for today, and taking away my laptop, I'd hate it but it would objectively be good for me. This is kind of a similar thing. I don't like that these companies fuck up services I like but there's no denying that me leaving reddit for example was overall quite positive thing to happen.

These schemes all have the same problem that reddit and Twitter have: they need me more than I need them.

This sentiment comes off a lot like "it won't affect me, I don't care".

Like, it doesn't really matter whether you decide not to use these websites anymore. Nobody should have to put up with this shit. That's why we take a stand against it.

Till one day your government will require it.

It's hardly OK for Apple to be doing even that either, you know. Who the fuck does Apple think it is, to be entitled to "attest" to a goddamn thing?!

The notion that anyone can "attest" to users' caputured-by-DRM status is fundamentally toxic to the Internet as a whole and must be resisted at all costs and by any means necessary, legal or illegal.

Your comment was on the top for me, Lemmy's default "hot" sorting brings fresh takes to the front, so don't worry too much about your answers always getting buried.

Can you post any source at all that would back your claims? Or any technical details at all?

Neither the actual proposal https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#what-information-is-in-the-signed-attestation, nor the article itself seem to show that there would be a difference when it comes to privacy.

The entire problem with this proposal is that it limits client choice, similar to how Google Play integrity API on Android restricts some apps from running on rooted/unlocked phones.

That same problem obviously also exists in Apple's implementation.

Transmitting that info to Apple is still a problem. Why do you trust Apple, but not Google?

Google's version will likely ask you first, and you'll know which sites are asking for it. Apple's won't.

Bank: my bank is too boomercore to ever implement something like this, we only recently got 2fa

Government: my government still makes me file my taxes on paper and mail it to them so I’m ok for now

My bank is welcome to implement features that prevent using Firefox. It'll cost them when I move my deposits, but they're welcome to do it.

The EU wouldn't really stand for that.

It makes it even more easy to adjust online prices for apple users, lol

is there any positive use case for it for the user at all?

It needs integration with the TPM/secure element chip in the CPU and a device key issued by the manufacturer to sign an attestation that nothing in the software chain from kernel to browser has been modified .

These schemes tends to get regularly broken, just look at SGX

A very short TLDR would be:

Apple (in this case) decides if your device should be trusted as a human, or if it's suspicious / a robot, which could break parts of the Internet for those not joining this "attestation", or using software that doesn't support it.

A more ELI5 version would be that Apple has implemented a controversial API (The Web Environment Integrity API) that indicates if a combination of OS + Browser + User behaviour is to be trusted as being human.

Attestation before used to mean "is this device who it says it is", and one can check that in some ways as part of WebAuthN (aka "Passwordless login"), where it would be useful to know if an Android device a site knows you have (as you've logged in before) is that same device. It's a system to trust devices. The WEI-API expands this to look at your OS, your browser and your environment, like installed applications.

Problem with this, is that the requirements don't have to be public. Apple can decide what makes a "trustworthy device" and what can be considered "suspicious".

Bad examples like these are to "fail" attestation if you have torrent clients installed, of if you're connected via a VPN, or if you're not using Bing + Edge on Windows.

Browsers and OS'es refusing to support attestation are likely to become a minority (most users use Chrome, and Google seems to be in favour). Should sites start blindly trusting this "attestation" - in replacement of captcha's -, we could start seeing more privacy-prone combinations being locked out of these kind of sites.