Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An experimental Android WebView Media Integrity API early next year

android-developers.googleblog.com

Post reply on HN
Print view View original

221–230 of 247 posts

Re: An experimental Android WebView Media Integrity API early next year

#221

Post by akdor1154 »

cmrdporcupine wrote: post #210
dmoy wrote: post #140

Earlier quoted context omitted.

Uhhh, what? I use y'all 'cus that's how all the kids in my school talked growing up. I ditched a lot of the lexicon because after my family moved to the suburbs, I got made fun of by my new friends, literally calling me "less white". So no more finna', for example. I will die on the hill of having a good second person plural pronoun though.

Here in the rural parts of Ontario (well not in my rural part of Ontario, but further north), that pronoun is "youse" As a long boy visiting from Alberta I was astounded that this existed. It might be dying out tho

Exists in Australia, has connotations of rural government (un)education, youse can rip it from my cold dead hands because plural second person is fabulous.

Re: An experimental Android WebView Media Integrity API early next year

#222

Post by trinsic2 »

cesarb wrote: post #175
trinsic2 wrote: post #124

Earlier quoted context omitted.

If you keep track of the changes to the BIOS firmware, you can see the changes. Their minuscule but happening. We don't have full blow preventing from disabling secure boot yet, but it appears to me that's were this is going. (Disabling usb ports, having keys that prevent disabling Secure boot unless you clear them or change them. All it takes is some event to bring these companies over the edge. The Asus MB developm…

> > I’ve complained about this before, but I’ve been hearing “Microsoft is going to block you from installing Linux!” since like 2004 [...] > If you keep track of the changes to the BIOS firmware, you can see the changes. Their minuscule but happening. We don't have full blow preventing from disabling secure boot yet, but it appears to me that's were this is going. Case in point: until recently, even with SecureBoot…

I just seems like we need to create coalition and put pressure on OEMS to stop buying int Microsoft's crap.

Re: An experimental Android WebView Media Integrity API early next year

#223

Post by Intralexical »

mcpackieh wrote: post #99
belval wrote: post #42

Earlier quoted context omitted.

For people wondering which of the links to click: https://news.ycombinator.com/item?id=36857676 It's mostly just the classic "nono if you don't agree it's because you don't understand" and "please educate yourself" approach.

> "P.S. I'd love to discuss this with y'all like professional adults. Can we do that?" You can tell somebody is a snake when they aren't from the South but use "y'all" . It's become a sort of corporate snake shibboleth.

Look, it's either "y'all", "vous", or bringing back "thou" for the singular, okay?

Re: An experimental Android WebView Media Integrity API early next year

#224

Post by Intralexical »

cmrdporcupine wrote: post #210
dmoy wrote: post #140

Earlier quoted context omitted.

Uhhh, what? I use y'all 'cus that's how all the kids in my school talked growing up. I ditched a lot of the lexicon because after my family moved to the suburbs, I got made fun of by my new friends, literally calling me "less white". So no more finna', for example. I will die on the hill of having a good second person plural pronoun though.

Here in the rural parts of Ontario (well not in my rural part of Ontario, but further north), that pronoun is "youse" As a long boy visiting from Alberta I was astounded that this existed. It might be dying out tho

> I's the by that build the boat.

> You's the by that sail 'er.

— Wait, that's singular.... I think? Does it change again when you go further east? ....Or actually, is the second line also "I"?

Re: An experimental Android WebView Media Integrity API early next year

#225

Post by Intralexical »

mcpackieh wrote: post #167
dmoy wrote: post #140

Earlier quoted context omitted.

Uhhh, what? I use y'all 'cus that's how all the kids in my school talked growing up. I ditched a lot of the lexicon because after my family moved to the suburbs, I got made fun of by my new friends, literally calling me "less white". So no more finna', for example. I will die on the hill of having a good second person plural pronoun though.

If you actually grew up using it, then you're not who I'm talking about. The word, like "folks", has become part of the affected dialect used by corporate ass-kissers to tell other corporate ass-kissers what they're about. Used primarily by slimy management, HR and PR types. These types do not say finna, that isn't part of this affected dialect. If you say finna then you're not who I'm talking about.

…Okay, again, I really need/want there to be a gender-neutral plural familiarism like "guys", though, and "folks" fits great....

Re: An experimental Android WebView Media Integrity API early next year

#226

Post by jppittma »

JohnFen wrote: post #206
jppittma wrote: post #203

Earlier quoted context omitted.

Do you really believe that the ability for people to play YouTube without ads benefits the user? I mean, it sounds great on some level. Perhaps browsers should just ship with ad blocking by default. Everybody the world over can use the internet and have a better experience without anybody ever seeing any of those pesky paid ad things.

I think there are some end-user benefits, but they're more side-effects than the reason the technology was invented.

What is the basis for assuming that something like this was created in bad faith?

Re: An experimental Android WebView Media Integrity API early next year

#227

Post by [deleted] »

danShumway wrote: post #204
happytiger wrote: post #130

Earlier quoted context omitted.

I mean this is the problem with the entire situation. I immediately read the article looking for any evidence that they would abandon the direction of the idea rather than do what Google does sometimes and roll out a POC on some other less controversial part of their infrastructure and then come back to it when the timing is more right (like after a large cybersecurity event happens, mark these words). They did exact…

> They rolled it back to the Android team and promised to perfect a smaller effort in a less controversial sandbox Conveniently this also seems to mean (assuming I understand the announcement correctly) they get to roll it out for the webview and finalize everything without going through the web standards process and without dealing with any community feedback because it's not technically a web standard anymore. They…

[deleted]

Re: An experimental Android WebView Media Integrity API early next year

#228

Post by jezzamon »

zarzavat wrote: post #70
pkaye wrote: post #51

Can anyone summarize what WEI is an why its bad?

DRM for web browsing. A website would be able to request an attestation that your browser is “trusted”, i.e. it is secure and unmodified. Because some systems are by definition untrusted, e.g. Linux, or Firefox compiled from source, these users might be blocked from certain websites. At least that seemed like the intention, otherwise what’s the point of building such a feature?

If you want the "assuming good intent" explanation it was to be able to detect spam and bots which apparently are a significant problem now and are no longer stopped by captchas. One online community I'm part of literally turned off new sign ups because they couldn't stop the bot problem (ldjam.com). Users also find captchas annoying so it supposedly stop the need for that for many cases (except for when you're in the 10% hold out group or whatever)

Re: An experimental Android WebView Media Integrity API early next year

#229

Post by IshKebab »

londons_explore wrote: post #171
IshKebab wrote: post #136

Earlier quoted context omitted.

> being used for embedded logins for sometimes dubious 3rd party apps. That's a difficult problem to solve though. To do it properly you'd need something like Windows' secure key sequence (ctrl-alt-del) which apps can't intercept. Otherwise there's no way that a user can know that what they're seeing is the system rather than a malicious app. Consider that any app can embed any browser or UI that they want.

That exists on mobile though... They could easily have a "swipe down to login" gesture, where you would see some system UI saying "Appname wants your password to foo.com, do you want to allow the app to log in using your saved password?". foo.com could also cooperate and allow the message to say: "Appname wants to 'send pokes' on foo.com, do you want to allow this?" - allowing the app a scoped login to only specific…

Yeah an edge swipe could work. It would be difficult to introduce but Google doesn't seem to shy away from forcing app developers to make big changes so who knows.

Of course a malicious app could still just show a webview and make you type the password in. The above solution would only work if everyone uses a password manager and showing a webview becomes way more suspicious than it is now.

Re: An experimental Android WebView Media Integrity API early next year

#230

Post by rezonant »

nolist_policy wrote: post #127
rezonant wrote: post #111

This blog post is how they should have started the discussion about WEI, but better late than never. That being said, while I can somewhat understand the use case for preventing fraud, misconception of source, etc, what we're talking about effectively kneecaps the ability to write bonafide Android browsers that leverage the WebView engine, while doing little to prevent the fraud and abuse the proposal intends to solv…

Sure, malware can ship its own browser engine but it can not attest authenticity to the server . The proposal doesn't limit the Android WebView in any way.

Yes, but that's not sufficient.

If, say, YouTube would like to prevent an Android game from running an invisible and silent webview watching videos on YouTube.com (because some ethically challenged YouTubers paid them to help juice their view counts), YouTube could use the new web view integrity API to validate that webview, but if the developer ships an engine inside of that game and uses that instead of using the WebView, then YouTube cannot tell that its not just a third party browser. So unless they are going to block all third party browsers, which they can't actually do because the browser could be configured to emulate Chrome, and Chrome doesn't actual implement any kind of attestation...

So there's already a way to bypass what they are trying to do.

Post reply on HN