Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An experimental Android WebView Media Integrity API early next year

android-developers.googleblog.com

Post reply on HN
Print view View original

101–110 of 247 posts

Re: An experimental Android WebView Media Integrity API early next year

#101

Post by gray_charger »

marklar423 wrote: post #57
Arainach wrote: post #40

Earlier quoted context omitted.

I don't trust applications enough to have things like the encryption key for my hard drive outside a TPM.

I don't disagree, but how do you feel about you (the machine owner) also not having access to it? That's my major problem with it; it locks you out of messing with your own machine data, which you can see being instantly abused by third parties to prevent modifications.

> That's my major problem with it; it locks you out of messing with your own machine data, which you can see being instantly abused by third parties to prevent modifications.

It locks everybody, including the owner, out of any data it doesn't own. That's the point. If you can pull it out, so can anybody else, and you've just made a small hard drive. Could it be used by vendors for DRM-like things? Sure. That's on the vendor, though, and not the technology itself.

Re: An experimental Android WebView Media Integrity API early next year

#103

Post by alexjplant »

appleskeptic wrote: post #45
jorvi wrote: post #26

Earlier quoted context omitted.

Uhm… what? Your beef is with things like Pluton, Intel’s ME and AMD’s PSP. TPM at their base are nothing else than a more secure place to store cryptographic data.

Don’t forget that the anti-TPM stuff comes from the guy, RMS, who opposes “sudo” because it serves to let a machine owner control and audit use of super-user commands, whereas just having a root password shared by multiple users gives anyone who learns the password the freedom to do whatever they want with plausible deniability. He has a very strange and quaint way of thinking but people uncritically parrot him witho…

For those that would appreciate context: Stallman did say this but the incident that he cites as justification happened _four decades ago_ and he wrote about it in 2002 [1]:

> Sometimes a few of the users try to hold total power over all the rest. For example, in 1984, a few users at the MIT AI lab decided to seize power by changing the operator password on the Twenex system and keeping it secret from everyone else. (I was able to thwart this coup and give power back to the users by patching the kernel, but I wouldn't know how to do that in Unix.)

> However, occasionally the rulers do tell someone. Under the usual su mechanism, once someone learns the root password who sympathizes with the ordinary users, he or she can tell the rest. The "wheel group" feature would make this impossible, and thus cement the power of the rulers.

> I'm on the side of the masses, not that of the rulers. If you are used to supporting the bosses and sysadmins in whatever they do, you might find this idea strange at first.

He was talking about a time-sharing system in an academic context. We have no idea what his thoughts are now, and it's logically fallacious to discount his feelings on what multinational corporations bake into their silicon on the basis of an experience that he had back when Van Halen was still topping the charts. It isn't exactly a secret that RMS is a bit "out there" - lots of historically-significant people are. Contextualizing their work and speech in a constructive way is preferable to writing them off wholesale.

[1] https://ftp.gnu.org/old-gnu/Manuals/coreutils-4.5.4/html_nod...

Re: An experimental Android WebView Media Integrity API early next year

#104

Post by ugh123 »

JohnFen wrote: post #38
londons_explore wrote: post #31

> Android WebView Media Integrity API is narrowly scoped I don't see any benefit to the user... Surely any app which wishes to embed a webview can simply add an api to said webview with native code to use existing android integrity API's? To me, this looks like a backdoor way to prevent people making "hacked" apps which, for example, play youtube but without ads. This API doesn't benefit the users.

It's not intended to benefit the user.

The benefit to the user is they can supposedly "trust" the content that is being shown in the webview is, in fact, owned by or affiliated somehow with the app. They don't give an example, but i'd imagine its something like: "bad app lets user's sign into their bank account through the app's webview, then webview scrapes/intercepts content to do as they wish".

Re: An experimental Android WebView Media Integrity API early next year

#106

Post by msla »

lol768 wrote: post #10

WEI itself was previously discussed across a number of threads, which make interesting reading: (July 2023, 456 comments) https://news.ycombinator.com/item?id=36854114 - "Google's nightmare Web Integrity API wants a DRM gatekeeper for the web" (July 2023, 431 comments) https://news.ycombinator.com/item?id=36817305 - "Web Environment Integrity API Proposal" (July 2023, 434 comments) https://news.ycombinator.com/item?i…

So we can take that yoavweiss_ character as a Google representative.

Re: An experimental Android WebView Media Integrity API early next year

#107

Post by teddyh »

hanniabu wrote: post #27
endisneigh wrote: post #17

Earlier quoted context omitted.

They’ve shown their willingness to ignore by… scrapping something that was disliked?

I imagine they're pulling the politician card. When there's a lot of pushback, you scrap it for optics, and then a few months or years later you bring it back under a different name and presented as something new and hope people don't pick up on it. And if they do, then you repeat until people are exhausted enough to not give any pushback anymore.

A.k.a. “Outrage fatigue”.

Re: An experimental Android WebView Media Integrity API early next year

#108

Post by mcpackieh »

cryptonector wrote: post #94
vlovich123 wrote: post #76

Earlier quoted context omitted.

If you use a mobile device maybe. My desktop machine has a TPM and AFAIK I do have access to load my own keys / replace the root keys. Of course, nothing says there isn't a backdoor within the TPM, but it's not this secret locked down thing.

It's unlikely that there is a backdoor on the TPM itself. The more likely scenario is that given a TPM serial number or EKpub the vendor could furnish a seed in response to a subpoena or warrant -- however, even this is unlikely, as it would make TPM vendors huge targets for hacking. Also TPM vendors make a big deal of how they don't keep TPMs' seeds, and I tend to believe them, because again if they did keep them th…

"Crypto AG's products being compromised is extremely unlikely, because that would make them a huge target."

Re: An experimental Android WebView Media Integrity API early next year

#109

Post by the_duke »

KMag wrote: post #65
TremendousJudge wrote: post #56

Earlier quoted context omitted.

They have been tamed in the past. Correct me if I'm mistaken, but Google Native Client was completely discontinued and wasm was adopted eventually. I see that as a victory for the open internet.

I'm not sure WASM is markedly different from PNaCL, other than using SSA-based LLVM bitcode instead of a stack-based bytecode.

It's a well-defined standard with lots of different implemenetations, instead of "whatever Chrome does", tied to one specific codegen backend.

That's a huge difference.

Re: An experimental Android WebView Media Integrity API early next year

#110

Post by dylan604 »

msla wrote: post #106
lol768 wrote: post #10

WEI itself was previously discussed across a number of threads, which make interesting reading: (July 2023, 456 comments) https://news.ycombinator.com/item?id=36854114 - "Google's nightmare Web Integrity API wants a DRM gatekeeper for the web" (July 2023, 431 comments) https://news.ycombinator.com/item?id=36817305 - "Web Environment Integrity API Proposal" (July 2023, 434 comments) https://news.ycombinator.com/item?i…

So we can take that yoavweiss_ character as a Google representative.

if it walks like a duck, and it quacks like a duck, it must be a...
Post reply on HN