While Google says it merely wants to make the web a safer place with a suggested new standard, rights advocates have taken a very different view
For a long time now, Google has been trying to make the experience of using the web just as intuitive and useful as using a native app. In 2015, the company controversially launched AMP, a framework for building websites that would load quickly, without invasive ads and other bloat.
Now the company is proposing a web-based solution to the other major advantage apps have over the native web: security.
Unlike viewing a page in a web browser, the app experiences on both iOS and Android are heavily locked down, restricting what information flows in and out. Google is promoting something similar for the web.
“At the moment the web is very relaxed and casual,” said Terence Eden, a veteran open standards campaigner and consultant. “I, as a server, can send you out any information. Your browser can choose to do whatever the hell it likes with it, and then send back whatever data it wants.”
The problem, then, is that data sent and received on the web is comparatively easy to meddle with. For example, a rogue plugin or a piece of malware could intercept sensitive data, or display misleading information to the end user. To be specific, a plugin could conceivably inject a fake login box on your bank’s online banking site, and snaffle your credentials while appearing legitimate.
Hence the “Web Environment Integrity” (WEI) proposal, which was put forward to the W3C consortium that oversees web standards by Google’s Rupert Ben Wiser.
It works by “attestation”. The device you’re using confirms that it is unmodified and uncompromised, and securely sends the virtual thumbs up to the server sending the data. And because it confirms that there’s no funny business taking place, it could even mean the end of annoying Captcha verifications pop-ups (especially as AI bots have now been proven better at spotting the objects than humans).
However,
