6 ms·

> To me, this looks like a backdoor way to prevent people making "hacked" apps which, for example, play youtube but without ads. More like "impersonate your ba

by ajross 3y ago

> To me, this looks like a backdoor way to prevent people making "hacked" apps which, for example, play youtube but without ads. More like "impersonate your bank and steal your login credentials". MitM attacks using interposed clients are a genuine threat outside the Apple and Google walled gardens (and even a little bit within). WEI was an attempt at solving a real problem. Now, maybe it had unacceptable side effects, maybe it was more harmful than useful. And now it's dead. But the underlying issues got completely lost in the hyperbole wars around here. People were wildly slinging accusations of secret agendas and general bad faith[1]. It wasn't our finest moment as a community. [1] Most of them while typing said comments on an Apple device objectively even less friendly to nonstandard clients!

c0pium 3y ago
You’re being downvoted at the moment, but this is absolutely true. Fake bank apps are a huge problem, which this addresses.
- richij 3y ago
  It absolutely does not. The ability to craft a realistic phishing login page is unaffected by Google's proposed MI API.
  - c0pium 3y ago
    Crafting a fake login page in your app is a totally different problem than transparently proxying the web interface. First, if you copy the login page those assets are in the apk. This is easily detectable by bouncer and allows those apps to be denied (this happens today). Second, stealing the assets opens the app up to dmca takedown, which also happens today. Third, and most importantly, if you reverse proxy the page then the app will appear to users to actually work. This is crucial for the bad actor as it keeps the app from having a low rating in the App Store for not working. When they just steal the login page, the app gets downvoted quickly for being “broken”. All of this adds up to making the bad actors have to work much harder, which is the goal.
    - KETHERCORTEX 3y ago
      > First, if you copy the login page those assets are in the apk. You don't need to store the assets in the APK if you can load a webpage. > Third, and most importantly, if you reverse proxy the page then the app will appear to users to actually work. This is crucial for the bad actor You don't need to show the working bank app if it isn't advertised as one. Name it "Government assistance program" with "application process" requiring logging in with bank credentials (to confirm identity, because bank knows who you are). Then you can make it more convincing by adding some bs forms and stuff like "your application will be processed in two weeks". I saw this stuff already implemented and used. They can add as many integrity protection layers as they want, but it won't trigger one. So it looks like a measure to say "bank apps are safe now we are great guys" without real effect. I'd say that it may increase login thefts because users may get a false impression that anything they will install is safe now.
yjftsjthsd-h 3y ago
Google tried to take actions that would trivially lead to the end of the open web and enforce complete control over the software people ran on their own hardware. You can't accuse people of "hyperbole wars" when the worst-case is realistic (and indeed most likely).
- ajross 3y ago
  > Google tried to take actions that would trivially lead to the end of the open web and enforce complete control over the software people ran on their own hardware. So did Apple though, years ago. And no one freaked out like this. It just seems like maybe the argument is about something else.
  - danShumway 3y ago
    People did complain about Apple; fewer because it's harder to get press attention about Apple on privacy issues, but it's pure revisionism to say that Apple's attestation systems weren't criticized. This is how HN reacted to Apple's announcement: https://news.ycombinator.com/item?id=31751203 https://news.ycombinator.com/item?id=31751203 I have my own set of negative comments in that very thread where I literally call Apple's system DRM. So do I pass this ridiculous "hypocrisy" check well enough now that I'm allowed to complain about Google killing the Open web?
    - deleted 3y ago
      [deleted]
- smoldesu 3y ago
  It's arguable that the "open web" will exist for as long as Linux and KHTML exists. There will always be agnostic choices available, even if people choose outdated, locked-down or underdeveloped devices. Unlike the situation with AdSense, I'd argue it's really hard to identify any potential harm in this scenario. Multiple companies (Apple included) have also built their own remote attestation services, and nobody cried bloody murder then. If you think this is bad, then I regret to inform you that your war is probably lost. Maybe give GrapheneOS or Lineage a try?
deleted 3y ago
[deleted]

by ajross 3y ago

c0pium 3y ago

You’re being downvoted at the moment, but this is absolutely true. Fake bank apps are a huge problem, which this addresses.

richij 3y ago
It absolutely does not. The ability to craft a realistic phishing login page is unaffected by Google's proposed MI API.
- c0pium 3y ago
  Crafting a fake login page in your app is a totally different problem than transparently proxying the web interface. First, if you copy the login page those assets are in the apk. This is easily detectable by bouncer and allows those apps to be denied (this happens today). Second, stealing the assets opens the app up to dmca takedown, which also happens today. Third, and most importantly, if you reverse proxy the page then the app will appear to users to actually work. This is crucial for the bad actor as it keeps the app from having a low rating in the App Store for not working. When they just steal the login page, the app gets downvoted quickly for being “broken”. All of this adds up to making the bad actors have to work much harder, which is the goal.
  - KETHERCORTEX 3y ago
    > First, if you copy the login page those assets are in the apk. You don't need to store the assets in the APK if you can load a webpage. > Third, and most importantly, if you reverse proxy the page then the app will appear to users to actually work. This is crucial for the bad actor You don't need to show the working bank app if it isn't advertised as one. Name it "Government assistance program" with "application process" requiring logging in with bank credentials (to confirm identity, because bank knows who you are). Then you can make it more convincing by adding some bs forms and stuff like "your application will be processed in two weeks". I saw this stuff already implemented and used. They can add as many integrity protection layers as they want, but it won't trigger one. So it looks like a measure to say "bank apps are safe now we are great guys" without real effect. I'd say that it may increase login thefts because users may get a false impression that anything they will install is safe now.

yjftsjthsd-h 3y ago

Google tried to take actions that would trivially lead to the end of the open web and enforce complete control over the software people ran on their own hardware. You can't accuse people of "hyperbole wars" when the worst-case is realistic (and indeed most likely).

ajross 3y ago
> Google tried to take actions that would trivially lead to the end of the open web and enforce complete control over the software people ran on their own hardware. So did Apple though, years ago. And no one freaked out like this. It just seems like maybe the argument is about something else.
- danShumway 3y ago
  People did complain about Apple; fewer because it's harder to get press attention about Apple on privacy issues, but it's pure revisionism to say that Apple's attestation systems weren't criticized. This is how HN reacted to Apple's announcement: https://news.ycombinator.com/item?id=31751203 https://news.ycombinator.com/item?id=31751203 I have my own set of negative comments in that very thread where I literally call Apple's system DRM. So do I pass this ridiculous "hypocrisy" check well enough now that I'm allowed to complain about Google killing the Open web?
  - deleted 3y ago
    [deleted]
smoldesu 3y ago
It's arguable that the "open web" will exist for as long as Linux and KHTML exists. There will always be agnostic choices available, even if people choose outdated, locked-down or underdeveloped devices. Unlike the situation with AdSense, I'd argue it's really hard to identify any potential harm in this scenario. Multiple companies (Apple included) have also built their own remote attestation services, and nobody cried bloody murder then. If you think this is bad, then I regret to inform you that your war is probably lost. Maybe give GrapheneOS or Lineage a try?

deleted 3y ago

[deleted]