Can anyone summarize what WEI is an why its bad?
An experimental Android WebView Media Integrity API early next year
51–60 of 247 posts
Re: An experimental Android WebView Media Integrity API early next year
#52Earlier quoted context omitted.
What does your heart tell you? Palladium[1] came and went and then suddenly most laptops and mobile devices have a built-in TPM today. No doubt history will repeat. [1] https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi...
Yes and according to discussions at that time Palladium would be always on, on all PCs and it would banish Linux from all PCs making Windows the some possible OS.. Which is totally what happened, right? /s
and it would banish Linux from all PCs making Windows the some possible OS
We're getting closer to that with things like "secure" boot. Fortunately that can still be disabled, but MS even required that on ARM platforms it can't. The bigger Linux distros have bent over and gotten MS to sign their bootloaders, essentially making them at the mercy of MS.
Re: An experimental Android WebView Media Integrity API early next year
#53Re: An experimental Android WebView Media Integrity API early next year
#54This is really good. Google did the right thing. We don’t need to thank them for acting the way they should have originally, but we can appreciate it.
Re: An experimental Android WebView Media Integrity API early next year
#55Earlier quoted context omitted.
What does your heart tell you? Palladium[1] came and went and then suddenly most laptops and mobile devices have a built-in TPM today. No doubt history will repeat. [1] https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi...
Uhm… what? Your beef is with things like Pluton, Intel’s ME and AMD’s PSP. TPM at their base are nothing else than a more secure place to store cryptographic data.
TPM at their base are nothing else than a more secure place to store cryptographic data.
One which you, as the owner, don't have the keys to.
Re: An experimental Android WebView Media Integrity API early next year
#56I expect to see the usual Google approach: back off, then come back with another take on the same thing, but wrapped differently.
They have been tamed in the past. Correct me if I'm mistaken, but Google Native Client was completely discontinued and wasm was adopted eventually. I see that as a victory for the open internet.
Re: An experimental Android WebView Media Integrity API early next year
#57Earlier quoted context omitted.
It's a place that applications can store such data without my knowledge or control, and I don't trust applications enough to be comfortable with them having that ability. Don't get me wrong, it's not a major issue for me, it's just uncomfortable. It just means I prefer my machines to not have TPM hardware in them.
I don't trust applications enough to have things like the encryption key for my hard drive outside a TPM.
I don't disagree, but how do you feel about you (the machine owner) also not having access to it?
That's my major problem with it; it locks you out of messing with your own machine data, which you can see being instantly abused by third parties to prevent modifications.
Re: An experimental Android WebView Media Integrity API early next year
#58Sorry Google, too late, already switched to Firefox.
Re: An experimental Android WebView Media Integrity API early next year
#59The title is misleading. They've dropped the proposal as applied to Chrome, but are still pursuing it for the Android WebView API, which is basically a wrapper around Chrome.
Webviews are particularly vulnerable though, being used for embedded logins for sometimes dubious 3rd party apps. Is there a reasonable angle to view this from? I personally don't think embedded webviews should be allowed general browsing capability unless they are part of a standalone browser. It's usually a trick to capture traffic that would otherwise go off to the open web.
If that's the problem you're trying to solve, disallow embedded ~~logins~~ webviews and do it through a proper browser, same as on a regular computer. The other way seems overkill and smells like foul play to me.
Re: An experimental Android WebView Media Integrity API early next year
#60I notice that this post's title hasn't been edited by HN mods for "editorialization." Why not?