Googles “Web Integrity” Android API Could Kill “alternative” Media Clients
Google is abandoning its proposal to use the Web Integrity API as a new web standard, although Android phones should still work with it. According to Google's proposal, the main goal of the project was to "allow web servers to estimate the state of a device and accurately represent the software package." Google essentially wanted to create a digital rights management (DRM) gatekeeper for the Internet. In July, the project attracted widespread attention and much criticism.
The dark malware was supposed to allow web browsers to detect if your computer had been "modified" in such a way that a web page became unattractive. This could likely be anything from a rooted or jailbroken phone to the installation of an unwanted plugin (read: ad blockers). When you try to access protected content, a browser that supports the Web Integrity API will first connect to a third-party "local authentication" server and your computer will need to pass a certain type of test. After examining your local environment, uh... Staging environments receive a signed "IntegrityToken" indicating the content they want to serve. It will send it back to the web server and you will finally be able to unblock the content.
Google's proposal was not good. The explanation was full of conflicting information about how badly he wanted to intervene and what his goals were. Google promised that it did not intend to "intrusive or interfere with browser functionality, including add-ons and extensions" (a vague reference to ad blockers), but the first draft of the proposal also aimed to more accurately measure ad impressions. The most alarming thing is that this was not discussed. Google never published this feature for feedback, and the company was already actively developing a prototype of this feature in Chrome before the Internet discovered it.
On the Android Developers Blog, Google officially announced the end of its proposed web standard. "We've heard your feedback and the Chrome team is no longer considering web integration," the company said. I think this is the first time network integrity has been mentioned in a Google blog post, but hey! Dead. Let's move on to the next problem.
Want to switch to Android so YouTube Vanced doesn't rise from the grave?
But the project did not die completely. Google has now moved on to the "experimental Android WebView Media Integrity API [emphasis added]." Unlike the web version, which would be a big "step forward" for invasive DRM solutions, Android is already green certified, so it doesn't look like it would be useful. Google said the original Web Integrity project was inspired by Android's Play Integrity API, which essentially scans your phone for root access and blocks access to games, media and banking apps. Now Google wants to do this with WebViews (web content displayed in apps) built into Android, saying "media content providers" would be interested.
If you use Spotify or YouTube, you can block modified devices at the application level before running the embedded WebView via the Play Integrity API. Google also pre-installed a non-portable Android DRM called "Widevine" designed specifically for media playback. Netflix is known to require Widevine to be pre-installed on devices to watch HD content, and DRM issues are a common support issue.
Google clearly views this proposal as undesirable, so its pivot to the Android WebView component indicates some internal need to protect WebView with DRM. Google has been suspiciously vague about these projects, although it's hard to say exactly what the company's intentions are. The blog post notes that while Android's WebView system offers "great flexibility... it can be used as a tool for fraud and abuse because it allows app developers to access web content and intercept or alter how users interact with it." This has its benefits when applications host their own web content and prevent attackers from modifying the content and tampering with its source through proxies.
Unlike regular malware, this is very similar to the use case of YouTube Vanced, a modified (now dead) YouTube app for Android. Use Vanced WebView and YouTube tricks to play videos without ads and unlock YouTube Premium features like background playback. Since Vanced was just an application, it did not require root access and did not disable the Integrity Play API. Allowing YouTube to access your phone via WebView is similar to disabling these "alternative" clients. Google has become increasingly hostile toward ad blockers in recent years, and while Google's legal department already shut down YouTube Vanced with a cease-and-desist letter in 2022, its tech division's focus on customers has changed, which seems like a reasonable next step.
