TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

An experimental Android WebView Media Integrity API early next year

377 pointsby brycewrayover 1 year ago

41 comments

lol768over 1 year ago
WEI itself was previously discussed across a number of threads, which make interesting reading:<p>(July 2023, 456 comments) <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36854114">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36854114</a> - &quot;Google&#x27;s nightmare Web Integrity API wants a DRM gatekeeper for the web&quot;<p>(July 2023, 431 comments) <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36817305">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36817305</a> - &quot;Web Environment Integrity API Proposal&quot;<p>(July 2023, 434 comments) <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36875940">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36875940</a> - &quot;Unpacking Google’s Web Environment Integrity specification&quot;<p>(July 2023, 111 comments) <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36857676">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36857676</a> - &quot;So, you don&#x27;t like a web platform proposal&quot; - Google employee&#x27;s view on how folks <i>should&#x27;ve</i> responded to the proposal<p>(August 2023, 100 comments) <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36960882">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=36960882</a> - &quot;Web Environment Integrity: Locking Down the Web&quot;
评论 #38119196 未加载
评论 #38127074 未加载
评论 #38120045 未加载
zlg_codesover 1 year ago
The world needs to stop looking to a global data broker who feeds data to advertisers as a legitimate and good faith steward of Web technologies.<p>It violates the separation of concerns between server and client, for starters. Clients are user <i>agents</i>, i.e. they do what the <i>user</i> wants, not what the <i>server</i> wants. This fundamental misunderstanding&#x2F;skewing of perspective is part of the problem.<p>If we want HTTP(S) and friends to remain a free and open protocol for all, we have to cut Google out of the decision-making process. They&#x27;ve been behind Encrypted Media Extensions, they&#x27;ve been behind Manifest v3, and now WEI.. The Web doesn&#x27;t belong to Google. They can go do QUIC and leave HTTP alone.
londons_exploreover 1 year ago
&gt; Android WebView Media Integrity API is narrowly scoped<p>I don&#x27;t see any benefit to the user... Surely any app which wishes to embed a webview can simply add an api to said webview with native code to use existing android integrity API&#x27;s?<p>To me, this looks like a backdoor way to prevent people making &quot;hacked&quot; apps which, for example, play youtube but without ads. This API doesn&#x27;t benefit the users.
评论 #38119272 未加载
评论 #38119923 未加载
评论 #38119698 未加载
Wowfunhappyover 1 year ago
I don&#x27;t understand how this works.<p>&gt; The new Android WebView Media Integrity API will give embedded media providers access to a tailored integrity response that contains a device and app integrity verdict so that they can ensure their streams are running in a safe and trusted environment, regardless of which app store the embedding app was installed from.<p>But this only applies to the Android WebView API, not standalone web browsers like Google Chrome. Otherwise we&#x27;d be back to where we started with the original Web Environment Integrity proposal.<p>But no one <i>has</i> to use the WebView API, it&#x27;s a convenient option but Chromium is open source! What stops Bob the Evil Android Developer from compiling his own version of Chromium, bundling that into his app, and doing whatever malevolent website trickery his ink black heart desires?<p>Put another way, if this is only built into the special WebView API, wouldn&#x27;t a malicious developer just avoid using that API?
评论 #38120482 未加载
评论 #38120457 未加载
ZeroCool2uover 1 year ago
The title is misleading. They&#x27;ve dropped the proposal as applied to Chrome, but are still pursuing it for the Android WebView API, which is basically a wrapper around Chrome.
评论 #38119266 未加载
i-am-gizm0over 1 year ago
Official confirmation in the WEI public discussion thread: <a href="https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;g&#x2F;blink-dev&#x2F;c&#x2F;Ux5h_kGO22g&#x2F;m&#x2F;Iu5w_dcoAgAJ" rel="nofollow noreferrer">https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;g&#x2F;blink-dev&#x2F;c&#x2F;Ux5h_...</a>
评论 #38120037 未加载
m-p-3over 1 year ago
Until next time, for the sake of the open Internet we can&#x27;t stop pushing back. It&#x27;s exhausting.
评论 #38120653 未加载
评论 #38120232 未加载
heywintermuteover 1 year ago
Repo has be archived - &quot;NOTE: This proposal is no longer pursued.&quot;<p><a href="https:&#x2F;&#x2F;github.com&#x2F;RupertBenWiser&#x2F;Web-Environment-Integrity">https:&#x2F;&#x2F;github.com&#x2F;RupertBenWiser&#x2F;Web-Environment-Integrity</a>
评论 #38122949 未加载
评论 #38119042 未加载
riku_ikiover 1 year ago
Probably started working on some more cryptic solution already.
评论 #38120411 未加载
评论 #38123550 未加载
评论 #38120396 未加载
jader201over 1 year ago
Original title:<p>“Increasing trust for embedded media”<p>&gt; <i>Otherwise please use the original title, unless it is misleading or linkbait; don&#x27;t editorialize.</i><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;newsguidelines.html">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;newsguidelines.html</a>
评论 #38120438 未加载
mynameisashover 1 year ago
Actual blog post title is, &quot;Android Developers Blog: Increasing trust for embedded media&quot;
评论 #38119006 未加载
评论 #38120959 未加载
exabrialover 1 year ago
Reading between the lines:<p>They&#x27;re leveraging their monopolistic position to force APIs into an &quot;open source&quot; project to prevent users from skipping ads.
pshirshovover 1 year ago
&gt; In contrast, the Android WebView Media Integrity API is narrowly scoped<p>I guess it means that at some point I won&#x27;t be able to use many apps under GrapheneOS with its Vanadium WV?
keepamovinover 1 year ago
This is really good. Google did the right thing. We don’t need to thank them for acting the way they should have originally, but we can appreciate it.
harshitanejaover 1 year ago
I have been walking around with this dread ever since the proposal was announced. Thinking about its implications made me appreciate even in today’s screwed up internet we still don’t have it that bad.
jauntywundrkindover 1 year ago
Major war on general purpose computing vibes resumes<p><i>&#x27;It&#x27;s in the users best interest to not let them bring their own computer &amp; have to use a Google approved computer because [fill in corporate doublespeak bullshit here]&#x27;.</i><p>Fwiw, the whole system of native apps have dealt with this hlkind of crap forever &amp; it&#x27;s expected. An old super small native app we had failed pen testing because it would run on jailbroke devices. Google Play SafetyNet and probably three other frameworks on Android all exist to make sure users don&#x27;t have ownership of devices.<p>So this is basically a Google Project Fugu effort, but the dark side. the web should be capable of doing everything native apps do, even when that thing is placing a huge boot on the face of users &amp; rejecting their user-agency. Womp womp.<p>Also, notably, Apple already shipped a just as bad implementation of PrivateTokens where websites can ask Apple to make sure the device is legitimate. I&#x27;m not sure why Google built a new spec, why they decided to be a huge lightning rod for this, a lightning rod with much less cover from publicity, as instead of being a generic attestation system (and relying on Apple having dominion over their platform in a way Android lacks), it&#x27;s a very narrow attestation system about device integrity. <a href="https:&#x2F;&#x2F;httptoolkit.com&#x2F;blog&#x2F;apple-private-access-tokens-attestation&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;httptoolkit.com&#x2F;blog&#x2F;apple-private-access-tokens-att...</a>
danShumwayover 1 year ago
So... it&#x27;s being implemented anyway, just only for the embedded browser?<p>This doesn&#x27;t make me feel better. And it&#x27;s a very Google type of answer to give: announce that you&#x27;re moving forward anyway, but pretend like you&#x27;re listening to feedback and giving everyone what they want.<p>It&#x27;s annoying that the entire retrospective is two sentences. Still no conversation with the dev community of course, just two sentences that say it&#x27;s not being considered and we move on. And it&#x27;s convenient that the new API is no longer a proposal, it&#x27;s just an internal program that Google is building on their own.<p>----<p>Off the top of my head, I think some of the concerns here still apply? Not all of them, this is <i>better</i> than the original proposal, but this is now dividing the web up into webviews that are supposedly only going to work on Android? Because iOS I don&#x27;t think supports this kind of thing -- maybe I&#x27;m wrong though. We still have this inversion of the Open web where clients attest DRM capabilities to the server, which is not how the web is supposed to work. But I guess that&#x27;s supposedly OK because the idea is you&#x27;d only use this API on a site that was only ever intended to be viewed in a webview for a single app? I&#x27;ll admit I don&#x27;t know how common that is.<p>And all of this to paper over embedded web views, which arguably should be used less on Android anyway. I don&#x27;t know, that could be a long conversation; but the point being I&#x27;m still worried about the announcement -- less worried, but still worried.<p>It&#x27;s both so weirdly narrow and so unsuitable for the goals that the original proposal outlined that my most cynical side almost feels like it&#x27;s being done purely because Google doesn&#x27;t like complete capitulation and wants to have the last word? But it&#x27;s also still so weirdly antithetical to how an Open web works (even within that very narrow band of apps it would apply to) that I can&#x27;t shake the feeling there&#x27;s some horrible side-effect that isn&#x27;t immediately obvious to me.<p>Of course I don&#x27;t know the details or whether or not it&#x27;ll all be fine; maybe this will be nothing and mostly won&#x27;t matter for anything. It&#x27;s hard to tell because we&#x27;re no longer talking about a standards proposal as far as I can tell. It sounds like Google is just going to do this internally and roll it out to small numbers of partners and then will launch it and that will be that, no community feedback required. Which... :shrug: not having your attestation plans be publicly available to comment on is definitely a way to avoid criticism, I guess.
m463over 1 year ago
Web Environment Integrity (WEI) is a controversial API proposal currently being developed for Google Chrome.<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Web_Environment_Integrity" rel="nofollow noreferrer">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Web_Environment_Integrity</a>
endisneighover 1 year ago
It’s interesting that a single googlers repository was what was being used for wei discussion instead of something more “official”.<p>People celebrating this aren’t realizing that it’ll probably stop api scraping via a web view back door.
评论 #38120348 未加载
评论 #38119302 未加载
rezonantover 1 year ago
This blog post is how they should have <i>started</i> the discussion about WEI, but better late than never.<p>That being said, while I can somewhat understand the use case for preventing fraud, misconception of source, etc, what we&#x27;re talking about effectively kneecaps the ability to write bonafide Android browsers that leverage the WebView engine, while doing little to prevent the fraud and abuse the proposal intends to solve.<p>If you are an Android browser author, you certainly can ship your own browser engine, unlike on Apple&#x27;s platforms where that&#x27;s still prohibited. However, if your motivation for creating that browser is primarily around the user experience or other &quot;over the top&quot; features, building your own browser engine simply because WebView cannot operate as a real web browser to your users, is unfortunate.<p>Meanwhile, as an app developer who is interested in engaging in fraud, misinformation, or other nefarious things, they _can_ ship their own browser engine to bypass this functionality entirely. Does it add more work? Yes, but if their goals include this bad behavior, why wouldn&#x27;t they?<p>Even without all this, assuming that Chrome itself, Firefox nor anyone else will actually implement some kind of &quot;this is definitely not a web view&quot; attestation, the content owner has no choice but to allow that access, since they have no idea if the user agent they are looking at is a legitimate browser or an embedded webview.<p>Google, there is no way to solve this problem using attestation short of the original WEI proposal, which is bad for users. All you are doing now is muddying the waters and adding _some_ harm instead of _a lot_ of harm.
评论 #38120389 未加载
sensanatyover 1 year ago
...for the time being, but them being the comic-book, mustache twirling evil villains they are there&#x27;s no doubt WEI will be coming back, in a even more evil package, sometime down the line.
jacknewsover 1 year ago
&quot;We’ve heard your feedback, and the Web Environment Integrity proposal is no longer being considered by the Chrome team.&quot;<p>Instead we&#x27;ll roll it out bit-by-bit with different names.
cmrdporcupineover 1 year ago
Sorry Google, too late, already switched to Firefox.
sarahdellysseover 1 year ago
&gt; backed off WEI<p>for now
doolsover 1 year ago
Title should be:<p>“Increasing trust for embedded media”<p>There is a guideline against editorialising in the title
vsgherziover 1 year ago
Glad to see the chrome team listening to feedback
spitfireover 1 year ago
&quot;Google apparently backs off on WEI.&quot;<p>For the time being.
pkayeover 1 year ago
Can anyone summarize what WEI is an why its bad?
评论 #38119652 未加载
ilcover 1 year ago
Sorry big G. You lost the trust on this one.
hanniabuover 1 year ago
Doesn&#x27;t matter, they&#x27;ve already showed their hand with how they&#x27;re wiling to ignore everyone and try to push through whatever they want.
评论 #38119075 未加载
评论 #38119137 未加载
mplewisover 1 year ago
I notice that this post&#x27;s title hasn&#x27;t been edited by HN mods for &quot;editorialization.&quot; Why not?
samrusover 1 year ago
bullying corporations once again yields results
_Algernon_over 1 year ago
... (for now)
867-5309over 1 year ago
should firstly explain what WEI is
ok123456over 1 year ago
For now.
rubenvover 1 year ago
Good
Loudergoodover 1 year ago
Good.
freedombenover 1 year ago
TFA is about more than just WEI, but it does address it directly:<p>&gt; <i>We’ve heard your feedback, and the Web Environment Integrity proposal is no longer being considered by the Chrome team. In contrast, the Android WebView Media Integrity API is narrowly scoped, and only targets WebViews embedded in apps. It simply extends existing functionality on Android devices that have Google Mobile Services (GMS) and there are no plans to offer it beyond embedded media, such as streaming video and audio, or beyond Android WebViews.</i><p>This is really great to hear, thank you Chrome team!<p>Is there a risk that this is one of those &quot;shelve it for 6 months and we&#x27;ll try again later&quot; playbooks, and that already having the implementation will make it just &quot;an expansion&quot; of existing tech rather than &quot;new&quot; tech, which will make the pill easier for most people to swallow even though it gets to the same end result?
评论 #38119732 未加载
评论 #38119098 未加载
评论 #38119675 未加载
评论 #38119223 未加载
评论 #38119889 未加载
wkat4242over 1 year ago
Wow that surprises me. A lot.<p>I&#x27;m sure they will cook up something else evil though. FLoC just came back under a different name.<p>It is so surprising to me that the one company that had &quot;don&#x27;t be evil&quot; in their motto has become the one most antagonous company to society (or at least in a digital services manner, I&#x27;m sure Palantir and Monsanto can take that crown in their own areas).
评论 #38119898 未加载
jwrover 1 year ago
I expect to see the usual Google approach: back off, then come back with another take on the same thing, but wrapped differently.
评论 #38119479 未加载
评论 #38119765 未加载
评论 #38119784 未加载
sgammonover 1 year ago
We did it. Massive hckrnews W