Google is abandoning its proposal to use the Web Integrity API as a new web standard, although Android phones should still work with it. According to Google's proposal, the main goal of the project was to "allow web servers to estimate the state of a device and accurately represent the software package." Google essentially wanted to create a digital rights management (DRM) gatekeeper for the Internet. In July, the project attracted widespread attention and much criticism.
The dark malware was supposed to allow web browsers to detect if your computer had been "modified" in such a way that a web page became unattractive. This could likely be anything from a rooted or jailbroken phone to the installation of an unwanted plugin (read: ad blockers). When you try to access protected content, a browser that supports the Web Integrity API will first connect to a third-party "local authentication" server and your computer will need to pass a certain type of test. After examining your local environment, uh... Staging environments receive a signed "IntegrityToken" indicating the content they want to serve. It will send it back to the web server and you will finally be able to unblock the content.
Google's proposal was not good. The explanation was full of conflicting information about how badly he wanted to intervene and what his goals were. Google promised that it did not intend to "intrusive or interfere with browser functionality, including add-ons and extensions" (a vague reference to ad blockers), but the first draft of the proposal also aimed to more accurately measure ad impressions. The most alarming thing is that this was not discussed. Google never published this feature for feedback, and the company was already actively developing a prototype of this feature in Chrome before the Internet discovered it.
On the Android Developers Blog, Google officially announced the end of its proposed web standard. "We've heard your feedback and the Chrome team is no longer considering web integration," the company said. I think this is the first time network integrity has been mentioned in a Google blog post, but hey! Dead. Let's move on to the next problem.
