3 ms·
This blog post is how they should have started the discussion about WEI, but better late than never. That being said, while I can somewhat understand the use c
by rezonant 3y ago
This blog post is how they should have started the discussion about WEI, but better late than never.
That being said, while I can somewhat understand the use case for preventing fraud, misconception of source, etc, what we're talking about effectively kneecaps the ability to write bonafide Android browsers that leverage the WebView engine, while doing little to prevent the fraud and abuse the proposal intends to solve.
If you are an Android browser author, you certainly can ship your own browser engine, unlike on Apple's platforms where that's still prohibited. However, if your motivation for creating that browser is primarily around the user experience or other "over the top" features, building your own browser engine simply because WebView cannot operate as a real web browser to your users, is unfortunate.
Meanwhile, as an app developer who is interested in engaging in fraud, misinformation, or other nefarious things, they _can_ ship their own browser engine to bypass this functionality entirely. Does it add more work? Yes, but if their goals include this bad behavior, why wouldn't they?
Even without all this, assuming that Chrome itself, Firefox nor anyone else will actually implement some kind of "this is definitely not a web view" attestation, the content owner has no choice but to allow that access, since they have no idea if the user agent they are looking at is a legitimate browser or an embedded webview.
Google, there is no way to solve this problem using attestation short of the original WEI proposal, which is bad for users. All you are doing now is muddying the waters and adding _some_ harm instead of _a lot_ of harm.
- nolist_policy 3y agoSure, malware can ship its own browser engine but it can not attest authenticity to the server. The proposal doesn't limit the Android WebView in any way.
- rezonant 3y agoYes, but that's not sufficient. If, say, YouTube would like to prevent an Android game from running an invisible and silent webview watching videos on YouTube.com (because some ethically challenged YouTubers paid them to help juice their view counts), YouTube could use the new web view integrity API to validate that webview, but if the developer ships an engine inside of that game and uses that instead of using the WebView, then YouTube cannot tell that its not just a third party browser. So unless they are going to block all third party browsers, which they can't actually do because the browser could be configured to emulate Chrome, and Chrome doesn't actual implement any kind of attestation... So there's already a way to bypass what they are trying to do.