3 ms·
Yes, but that's not sufficient. If, say, YouTube would like to prevent an Android game from running an invisible and silent webview watching videos on YouTube.
by rezonant 3y ago
Yes, but that's not sufficient.
If, say, YouTube would like to prevent an Android game from running an invisible and silent webview watching videos on YouTube.com (because some ethically challenged YouTubers paid them to help juice their view counts), YouTube could use the new web view integrity API to validate that webview, but if the developer ships an engine inside of that game and uses that instead of using the WebView, then YouTube cannot tell that its not just a third party browser. So unless they are going to block all third party browsers, which they can't actually do because the browser could be configured to emulate Chrome, and Chrome doesn't actual implement any kind of attestation...
So there's already a way to bypass what they are trying to do.