Nov 07, 2023 21:00:00

Testing of ``Android WebView Media Integrity API'' that expands Android WebView and increases safety will start in early 2024, while ``Web Environment Integrity'' aiming for ``healthy Internet'' will be abandoned

The Android team has revealed that Google has given up on promoting the new web standard ``

Web Environment Integrity '' that was advocated for a ``healthy Internet.'' In addition, it has been revealed that the scope will be narrowed down to Android WebView, and a trial operation of the 'Android WebView Media Integrity API', which will improve Android's security and privacy protection performance, will be conducted from early 2024.

Android Developers Blog: Increasing trust for embedded media
https://android-developers.googleblog.com/2023/11/increasing-trust-for-embedded-media.html

On Android, the 'WebView' API is used to embed media in apps. According to the Android team, WebView's API is highly flexible, and continuous improvement of its security and privacy protection is a top priority.

App developers and SDK providers can offer solutions that include attestation services like

Play Integrity API and Firebase App Check that can verify an app's server requests while protecting user privacy, ensuring media is trusted and secure. This allows the embedded media provider to confirm that the embedded media is being played in a safe environment.

However, the current process is neither simple nor scalable, so we plan to start piloting the Android WebView Media Integrity API with selected embedded media providers in early 2024. The Android team has revealed something.

The name 'Integrity API' is reminiscent of the new web standard ' Web Environment Integrity ' proposed by Google in July 2023, but according to the Android team, after receiving feedback from various quarters, The Chrome team has abandoned consideration of ``Web Environment Integrity''

Google employee proposes a new web standard ``Web Environment Integrity'' to eliminate bots and modified browsers and create a ``healthy Internet'' through authentication by a ``trusted third party'' - GIGAZINE

On the other hand, this Android WebView Media Integrity API only targets WebViews embedded in apps. It only extends existing functionality on Android devices with Google Mobile Services, and there are no plans to offer embedded media such as streaming video or audio, or beyond the scope of Android WebView.

The Android team believes the challenge with WebView is that while it is highly flexible, it also allows app developers to access web content and read or modify user interactions, which could potentially be used for fraud or malicious purposes. There is a point. This is an advantage when an app embeds its own web content, but a malicious attacker can modify the content.

The Android WebView Media Integrity API supports responses that include device and app integrity determinations, so embedded media providers can ensure that their streams run in a secure and trusted environment, regardless of which app store the embedded app was installed from. It is possible to confirm that These decisions do not include user or device identifiers.

The goal of the Android WebView Media Integrity API is to help maintain a thriving and diverse ecosystem of media content in Android apps, and for media interested in participating in the early access program starting in early 2024. They are currently recruiting content providers.