Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An experimental Android WebView Media Integrity API early next year

android-developers.googleblog.com

Post reply on HN
Print view View original

181–190 of 247 posts

Re: An experimental Android WebView Media Integrity API early next year

#181

Post by yjftsjthsd-h »

ajross wrote: post #74
londons_explore wrote: post #31

> Android WebView Media Integrity API is narrowly scoped I don't see any benefit to the user... Surely any app which wishes to embed a webview can simply add an api to said webview with native code to use existing android integrity API's? To me, this looks like a backdoor way to prevent people making "hacked" apps which, for example, play youtube but without ads. This API doesn't benefit the users.

> To me, this looks like a backdoor way to prevent people making "hacked" apps which, for example, play youtube but without ads. More like "impersonate your bank and steal your login credentials". MitM attacks using interposed clients are a genuine threat outside the Apple and Google walled gardens (and even a little bit within). WEI was an attempt at solving a real problem. Now, maybe it had unacceptable side effect…

Google tried to take actions that would trivially lead to the end of the open web and enforce complete control over the software people ran on their own hardware. You can't accuse people of "hyperbole wars" when the worst-case is realistic (and indeed most likely).

Re: An experimental Android WebView Media Integrity API early next year

#182

Post by jauntywundrkind »

Major war on general purpose computing vibes resumes

'It's in the users best interest to not let them bring their own computer & have to use a Google approved computer because [fill in corporate doublespeak bullshit here]'.

Fwiw, the whole system of native apps have dealt with this hlkind of crap forever & it's expected. An old super small native app we had failed pen testing because it would run on jailbroke devices. Google Play SafetyNet and probably three other frameworks on Android all exist to make sure users don't have ownership of devices.

So this is basically a Google Project Fugu effort, but the dark side. the web should be capable of doing everything native apps do, even when that thing is placing a huge boot on the face of users & rejecting their user-agency. Womp womp.

Also, notably, Apple already shipped a just as bad implementation of PrivateTokens where websites can ask Apple to make sure the device is legitimate. I'm not sure why Google built a new spec, why they decided to be a huge lightning rod for this, a lightning rod with much less cover from publicity, as instead of being a generic attestation system (and relying on Apple having dominion over their platform in a way Android lacks), it's a very narrow attestation system about device integrity. https://httptoolkit.com/blog/apple-private-access-tokens-att...

Re: An experimental Android WebView Media Integrity API early next year

#183

Post by batch12 »

Pannoniae wrote: post #177
skydhash wrote: post #150

Earlier quoted context omitted.

Mostly because most people don’t care about the original spirit of the internet. As long as they can get their job done, consume entertainment, and play status game, they are content. Which is why for most people, their internet is just a handful of tech companies. It’s basically Minitel, but fueled by ads.

what's a "status game"?

I spent way too much time wondering the same thing. Maybe social media?

Re: An experimental Android WebView Media Integrity API early next year

#184

Post by jauntywundrkind »

Wowfunhappy wrote: post #161
creshal wrote: post #152

Earlier quoted context omitted.

A lot of "native" apps are just thin wrappers around web components, since it's a lot cheaper to develop.

Okay, thanks. So then this truly doesn't affect websites at all, it's for apps which work like websites behind the scenes, but whose content no one is ever supposed to access from within a web browser anyway. I can live with that!

Can you live with that? What about when your rooted, or out of date, or LineageOS phone won't be authenticated and your banking app doesn't work? Or Uber or the scooter app or the social network?

What about when Google in 10 years requires some absurd personal identity verification for WEI, perhaps because xy or z union of states decides to require it?

These security apparatuses are checks that nations and leagues of nations will not resist meddling with, once the hooks for control are on place.

Re: An experimental Android WebView Media Integrity API early next year

#185

Post by [deleted] »

londons_explore wrote: post #172
andybak wrote: post #69

Earlier quoted context omitted.

I'm not sure how you disallow embedded login without disallowing embedded webviews. The line is very blurry.

You have two types of webviews... "Webviews to the appmakers server", and "Webviews for the wider web". Webviews to the appmakers server need to be authorized by some manifest file on the server whitelisting the app identifier. Webviews for the wider web don't allow the app to know what's going on inside the webview, nor interact with it. So these are safe to type passwords into etc.

[deleted]

Re: An experimental Android WebView Media Integrity API early next year

#186

Post by pvg »

brycewray wrote: post #7
mynameisash wrote: post #5

Actual blog post title is, "Android Developers Blog: Increasing trust for embedded media"

True, but that seriously buried the lede. Sorry for the edit.

probably better off picking some language from the article in those cases (the original title is almost certainly worth an edit) which has a higher chance of avoiding explosion of title meta and less likely to be wrong in some minor, title-meta-generating way

Re: An experimental Android WebView Media Integrity API early next year

#187

Post by ajross »

yjftsjthsd-h wrote: post #181
ajross wrote: post #74

Earlier quoted context omitted.

> To me, this looks like a backdoor way to prevent people making "hacked" apps which, for example, play youtube but without ads. More like "impersonate your bank and steal your login credentials". MitM attacks using interposed clients are a genuine threat outside the Apple and Google walled gardens (and even a little bit within). WEI was an attempt at solving a real problem. Now, maybe it had unacceptable side effect…

Google tried to take actions that would trivially lead to the end of the open web and enforce complete control over the software people ran on their own hardware. You can't accuse people of "hyperbole wars" when the worst-case is realistic (and indeed most likely).

> Google tried to take actions that would trivially lead to the end of the open web and enforce complete control over the software people ran on their own hardware.

So did Apple though, years ago. And no one freaked out like this. It just seems like maybe the argument is about something else.

Re: An experimental Android WebView Media Integrity API early next year

#188

Post by smoldesu »

yjftsjthsd-h wrote: post #181
ajross wrote: post #74

Earlier quoted context omitted.

> To me, this looks like a backdoor way to prevent people making "hacked" apps which, for example, play youtube but without ads. More like "impersonate your bank and steal your login credentials". MitM attacks using interposed clients are a genuine threat outside the Apple and Google walled gardens (and even a little bit within). WEI was an attempt at solving a real problem. Now, maybe it had unacceptable side effect…

Google tried to take actions that would trivially lead to the end of the open web and enforce complete control over the software people ran on their own hardware. You can't accuse people of "hyperbole wars" when the worst-case is realistic (and indeed most likely).

It's arguable that the "open web" will exist for as long as Linux and KHTML exists. There will always be agnostic choices available, even if people choose outdated, locked-down or underdeveloped devices. Unlike the situation with AdSense, I'd argue it's really hard to identify any potential harm in this scenario. Multiple companies (Apple included) have also built their own remote attestation services, and nobody cried bloody murder then.

If you think this is bad, then I regret to inform you that your war is probably lost. Maybe give GrapheneOS or Lineage a try?

Re: An experimental Android WebView Media Integrity API early next year

#189

Post by smoldesu »

jauntywundrkind wrote: post #184
Wowfunhappy wrote: post #161

Earlier quoted context omitted.

Okay, thanks. So then this truly doesn't affect websites at all, it's for apps which work like websites behind the scenes, but whose content no one is ever supposed to access from within a web browser anyway. I can live with that!

Can you live with that? What about when your rooted, or out of date, or LineageOS phone won't be authenticated and your banking app doesn't work? Or Uber or the scooter app or the social network? What about when Google in 10 years requires some absurd personal identity verification for WEI, perhaps because xy or z union of states decides to require it? These security apparatuses are checks that nations and leagues of…

I already live with that (and life is fine).

Re: An experimental Android WebView Media Integrity API early next year

#190

Post by yjftsjthsd-h »

smoldesu wrote: post #188
yjftsjthsd-h wrote: post #181

Earlier quoted context omitted.

Google tried to take actions that would trivially lead to the end of the open web and enforce complete control over the software people ran on their own hardware. You can't accuse people of "hyperbole wars" when the worst-case is realistic (and indeed most likely).

It's arguable that the "open web" will exist for as long as Linux and KHTML exists. There will always be agnostic choices available, even if people choose outdated, locked-down or underdeveloped devices. Unlike the situation with AdSense, I'd argue it's really hard to identify any potential harm in this scenario. Multiple companies (Apple included) have also built their own remote attestation services, and nobody cri…

I am literally typing this on a LineageOS device; I don't see how that helps, if anything it just highlights the problem. The problem is that WEI, in any form, is most likely to be used in a way that results in websites blocking my device because I'm running my own operating system. And I'm pretty sure people did in fact cry bloody murder when Apple started doing it, but at least Apple was small enough percentage of the overall web browser share that nobody was going to try and mandate a feature that only they supported, unlike Chrome.

Edit: In short, the open web relies on being able to run any client you want; having KHTML doesn't do any good if sites block it.

Post reply on HN