A bit late… Something new might replace it but this experiment got killed a couple days ago already.
Google is killing off its proposal for “Web Environment Integrity API” as a new web standard, though Android phones may still have to deal with it.
That is literally the first sentence of the linked article. I think this is one of the things how it comes back.
Does Vanced really use WebView for playback (the link the article provides suggests it’s used for sign-in)?
Aside from forgetting to mention Revanced which is very much alive, I have doubts about the article. It feels like the author realized his headline doesn’t work anymore so came up with something plausible sounding…
Vanced and Revanced use(d) a fork of MicroG for sign-in. MicroG is a FOSS implementation of Google Play Services and other Google app APIs but with minimum tracking. It uses the website to sign in, which I imagine is rendered with WebView because the app is so small.
As someone who uses root (not at the moment but plans to) as I believe in owning my devices, fully, this is horrible. We still need to oppose this.
I know right? The article touches on this:
Google said the inspiration for the original Web Integrity project was Android’s Play Integrity API, which already scans your phone for root privileges and denies access to things
^^^ this should have never, ever been a thing!
That is just standard and a completely sensible security measure for preventing people from tampering with an application. It cannot replace proper, server-side security measures but is a big step. Especially for stuff like banking applications.
I never really understood that:
If I’m using my browser to do banking via the website, Having root privileges and tampering with the Browser running the applications is not an issue.
If i use the banking app, Having root privileges suddenly become a problem.
–> To me, it doesn’t look like the problem is technical, but that users are accepting things on mobile that they wouldn’t accept on a PC.
The problem with root is that banking applications and many others straight up actively try to detect it and refuse to work if you are rooted. Android is in the process of being completely locked down.
Switched to web browser…
These apps are fucking obnoxious.
Google wants you to pay for hardware but they get to control it because they can’t trust you lol
What’s the workaround for apps detecting usb debuging or other user apps on your device? I’m not rooted, but use shizuku and WiFi adb for certain features on my android.
Last si rooted there were also workarounds, but they didn’t always work, relying on the workarounds being updated to fight ever more advanced detection methods. It was a cat and mouse chase.
Not just root. Some even detect if you have usb debugging enabled and warn or refuse to work unless you turn that off.
You mean removing the “Don’t be evil” slogan? That’s not entirely true, they moved that from Google to Alphabet
google has been on the dark side since before “don’t be evil” was even associated with the company.
The key difference between “Android’s Play Integrity API” and this new thing which they are no longer proposing to put in Chrome but into Android WebView instead is the remote part of “remote attestation”.
The article does not make it entirely clear, but the new thing looks to be exactly the same as the old Web Environment Integrity we knew and hated, but with a new name and temporarily exclusive to Android.
I’m so glad there are devs behind things like Lineage, DivestOS and Graphene. I’m currently setting up a oh one using Divest without Google.
I’ll be buying some Pixel 5’s to get me through the next 5 years (my current phones are from 2018, and really fast with Lineage or Divest, and load a bunch of apps, and automation).
