5 ms·

I don't understand how this works. > The new Android WebView Media Integrity API will give embedded media providers access to a tailored integrity response tha

I don't understand how this works. > The new Android WebView Media Integrity API will give embedded media providers access to a tailored integrity response that contains a device and app integrity verdict so that they can ensure their streams are running in a safe and trusted environment, regardless of which app store the embedding app was installed from. But this only applies to the Android WebView API, not standalone web browsers like Google Chrome. Otherwise we'd be back to where we started with the original Web Environment Integrity proposal. But no one has to use the WebView API, it's a convenient option but Chromium is open source! What stops Bob the Evil Android Developer from compiling his own version of Chromium, bundling that into his app, and doing whatever malevolent website trickery his ink black heart desires? Put another way, if this is only built into the special WebView API, wouldn't a malicious developer just avoid using that API?

nolist_policy 3y ago
All this is about attesting authenticity to the server.
- Wowfunhappy 3y ago
  But only Android WebViews can attest their authenticity. Are servers going to block standalone web browsers? If they are, why even use a WebView? Just make it part of your app.
  - KRAKRISMOTT 3y ago
    Many corporate apps in e.g. banking are just Cordova/browser wrappers around a website.
  - creshal 3y ago
    A lot of "native" apps are just thin wrappers around web components, since it's a lot cheaper to develop.
    - Wowfunhappy 3y ago
      Okay, thanks. So then this truly doesn't affect websites at all, it's for apps which work like websites behind the scenes, but whose content no one is ever supposed to access from within a web browser anyway. I can live with that!
      - jauntywundrkind 3y ago
        Can you live with that? What about when your rooted, or out of date, or LineageOS phone won't be authenticated and your banking app doesn't work? Or Uber or the scooter app or the social network? What about when Google in 10 years requires some absurd personal identity verification for WEI, perhaps because xy or z union of states decides to require it? These security apparatuses are checks that nations and leagues of nations will not resist meddling with, once the hooks for control are on place.
        smoldesu 3y ago
        I already live with that (and life is fine).
        Wowfunhappy 3y ago
        The situation with SafetyNet isn't great, it's just... not new? It's not pushing us any further down the path than where we already are, and it's not corrupting the open web (because mobile apps aren't a part of the web).
  - rezonant 3y ago
    I've posted elsewhere about this as well, and I think it means the WebView Integrity solution will effectively do nothing. It just won't solve the problems Google is trying to solve. The bad actors they want to route out will work around it, so even if websites implement it, the fraud or other bad behaviors they describe will continue mostly unimpeded, because the websites literally cannot block unattested access (because all legitimate non-WebView browsers will be unattested)
ethbr1 3y ago
Step 1: Cryptographically fingerprint an attested environment, for one method among alternatives Step 2: Ban the alternatives Step 3: Profit
- keepamovin 3y ago
  I appreciate your succinct explanation regarding WEI—it highlights the core issue effectively. I’d like to expand upon your point, not to contradict, but to further explore the implications. I’m encouraged by recent announcements suggesting a shift away from policies that could hinder browser user agents. I believe Google’s actions represent a compromise with media IP owners, who were instrumental in the initial advocacy for these changes. By limiting technological controls to Android, Google appears to appease media stakeholders while avoiding restrictions on the open web, despite their dominant browser market share. This issue is particularly pertinent to me since my business depends on the freedom of alternative browser user agents to access the web unimpeded. While some might argue my stance stems from self-interest, it does not diminish the value of an unrestricted web. My product, BrowserBox, is designed to circumvent web content embedding restrictions on both mobile and desktop, eliminating the need for a Webview tag. Hence, Google’s approach doesn’t concern me personally. In fact, I view it as a positive—if it deflects media companies’ pressure from the open web. Furthermore, if Android’s technology faces constraints, people might look for other options, and BrowserBox stands as a prime, open-source choice. It’s a low-maintenance solution compared to others, like proxy-based DOM mirroring, which often result in site breakages and require constant, costly tweaks. As video streaming bandwidth becomes more affordable, the operational cost advantages of these alternative solutions diminish. High-volume operations can leverage colocation services with unlimited bandwidth, further reducing concerns over data transmission costs.

nolist_policy 3y ago

All this is about attesting authenticity to the server.

Wowfunhappy 3y ago
But only Android WebViews can attest their authenticity. Are servers going to block standalone web browsers? If they are, why even use a WebView? Just make it part of your app.
- KRAKRISMOTT 3y ago
  Many corporate apps in e.g. banking are just Cordova/browser wrappers around a website.
- creshal 3y ago
  A lot of "native" apps are just thin wrappers around web components, since it's a lot cheaper to develop.
  - Wowfunhappy 3y ago
    Okay, thanks. So then this truly doesn't affect websites at all, it's for apps which work like websites behind the scenes, but whose content no one is ever supposed to access from within a web browser anyway. I can live with that!
    - jauntywundrkind 3y ago
      Can you live with that? What about when your rooted, or out of date, or LineageOS phone won't be authenticated and your banking app doesn't work? Or Uber or the scooter app or the social network? What about when Google in 10 years requires some absurd personal identity verification for WEI, perhaps because xy or z union of states decides to require it? These security apparatuses are checks that nations and leagues of nations will not resist meddling with, once the hooks for control are on place.
      - smoldesu 3y ago
        I already live with that (and life is fine).
      - Wowfunhappy 3y ago
        The situation with SafetyNet isn't great, it's just... not new? It's not pushing us any further down the path than where we already are, and it's not corrupting the open web (because mobile apps aren't a part of the web).
- rezonant 3y ago
  I've posted elsewhere about this as well, and I think it means the WebView Integrity solution will effectively do nothing. It just won't solve the problems Google is trying to solve. The bad actors they want to route out will work around it, so even if websites implement it, the fraud or other bad behaviors they describe will continue mostly unimpeded, because the websites literally cannot block unattested access (because all legitimate non-WebView browsers will be unattested)

ethbr1 3y ago

Step 1: Cryptographically fingerprint an attested environment, for one method among alternatives Step 2: Ban the alternatives Step 3: Profit

keepamovin 3y ago
I appreciate your succinct explanation regarding WEI—it highlights the core issue effectively. I’d like to expand upon your point, not to contradict, but to further explore the implications. I’m encouraged by recent announcements suggesting a shift away from policies that could hinder browser user agents. I believe Google’s actions represent a compromise with media IP owners, who were instrumental in the initial advocacy for these changes. By limiting technological controls to Android, Google appears to appease media stakeholders while avoiding restrictions on the open web, despite their dominant browser market share. This issue is particularly pertinent to me since my business depends on the freedom of alternative browser user agents to access the web unimpeded. While some might argue my stance stems from self-interest, it does not diminish the value of an unrestricted web. My product, BrowserBox, is designed to circumvent web content embedding restrictions on both mobile and desktop, eliminating the need for a Webview tag. Hence, Google’s approach doesn’t concern me personally. In fact, I view it as a positive—if it deflects media companies’ pressure from the open web. Furthermore, if Android’s technology faces constraints, people might look for other options, and BrowserBox stands as a prime, open-source choice. It’s a low-maintenance solution compared to others, like proxy-based DOM mirroring, which often result in site breakages and require constant, costly tweaks. As video streaming bandwidth becomes more affordable, the operational cost advantages of these alternative solutions diminish. High-volume operations can leverage colocation services with unlimited bandwidth, further reducing concerns over data transmission costs.