Google Abandons Web Environment Integrity API
Thomas Claburn (via Hacker News):
Amid rising community concern, Google says it will no longer develop controversial technology that was said to fight fraud online though to critics looked more like DRM for websites.
[…]
Apple incidentally has already shipped its own attestation scheme called Private Access Tokens, which while it presents some of the same concerns is arguably less worrisome than Google’s proposal because Safari’s overall share of the web browser market across all devices is far lower than Chrome’s.
Google also offers two more limited attestation services, the Play Integrity API and Firebase App Check. And its YouTube subsidiary’s scanning of client browsers for ad blocking extensions also represents a form of attestation or integrity check, albeit where what’s evaluated is installed software rather than a cryptographic token.
[…]
Instead, the Android team aims to focus on the Android WebView Media Integrity API, which provides a similar form of attestation but only for WebViews embedded in Android apps.
Previously:
