The key difference between "Android's Play Integrity API" and this new thing which they are no longer proposing to put in Chrome but into Android WebView instead is the remote part of "remote attestation".
The article does not make it entirely clear, but the new thing looks to be exactly the same as the old Web Environment Integrity we knew and hated, but with a new name and temporarily exclusive to Android.
I'm so glad there are devs behind things like Lineage, DivestOS and Graphene. I'm currently setting up a oh one using Divest without Google.
I'll be buying some Pixel 5's to get me through the next 5 years (my current phones are from 2018, and really fast with Lineage or Divest, and load a bunch of apps, and automation).
As someone who uses root (not at the moment but plans to) as I believe in owning my devices, fully, this is horrible. We still need to oppose this.
I know right? The article touches on this:
Google said the inspiration for the original Web Integrity project was Android's Play Integrity API, which already scans your phone for root privileges and denies access to things
^^^ this should have never, ever been a thing!
That is just standard and a completely sensible security measure for preventing people from tampering with an application. It cannot replace proper, server-side security measures but is a big step. Especially for stuff like banking applications.
I never really understood that:
If I'm using my browser to do banking via the website, Having root privileges and tampering with the Browser running the applications is not an issue.
If i use the banking app, Having root privileges suddenly become a problem.
--> To me, it doesn't look like the problem is technical, but that users are accepting things on mobile that they wouldn't accept on a PC.
The problem with root is that banking applications and many others straight up actively try to detect it and refuse to work if you are rooted. Android is in the process of being completely locked down.
Not just root. Some even detect if you have usb debugging enabled and warn or refuse to work unless you turn that off.
I've had video games refuse to play because of that. Ridiculous.
There are many workarounds. It never really is an issue anymore
Last I rooted there were also workarounds, but they didn't always work, relying on the workarounds being updated to fight ever more advanced detection methods. It was a cat and mouse chase. And I need to be able to send money reliably, unfortunately.
Apps I use work fine with vanilla magisk. If there are apps detecting root even after enabling zygisk, use magisk delta and enable magisk hide
What's the workaround for apps detecting usb debuging or other user apps on your device? I'm not rooted, but use shizuku and WiFi adb for certain features on my android.
Was not aware that some apps detect USB debugging and deny access
The biggest continuing issue is NFCs, which will require people to accept that non-stock OSes are perfectly fine.
Big fucking sigh. I've been an Android user since the T-mobile G1, and I have ferociously defended the platform against iPhone for that entire time.
Is there a 3rd option? Or do I have to learn to love the enemy? I won't be a part of the problem with privacy just because I'm too lazy to change.
Use Graphene, Lineage or DivestOS (fork of Lineage) . Graphene and Divest enable you to sandbox all Google BS if you need it, and Dos uses their own we view from Mull.
What about bank apps and nfc? Do those work or are you just out of luck if you need them on graphene or lineage?
No attestation = no Google Pay
It's not there yet but... https://www.pine64.org/pinephonepro/
I love the idea, and would be willing to be an early adopter of a linux phone... but its tough to give up application support.
Honourable mention for Sailfish OS
https://en.wikipedia.org/wiki/Sailfish_OS
The commercial version comes with an android emulator.
It's not recommended for non-technical people, it sometimes crashes, it has random bugs that will drive you insane, and currently the weather app can't connect to the service that provides the weather data.
But:
The people making it are not seeing you as the product and you will be free of all the bullshit.
..... and i love it :)
I have ferociously defended the platform against iPhone
Why tho
Because Apple are: closed system, unrepairable, proprietary, refuse to adopt standards, elitist and exclusionary, and generally less flexible and customizable. They are a baby toy, they are any recent BMW, and they are jerks about it.
And somehow, that's becoming the better option over thieves and scammers with bad intentions. I may have to go with the assholes over the bastards. It doesn't feel great.
I get you, but calling iOS a toy just makes you sound childish and ignorant. I don't use apple for the same reasons, but iOS right now offers by far the most polish, mature and thought-through experience. In the meantime, Android continues to change everything on a whim every couple versions to nonsensical defaults. The UI keeps getting worse.
But I just can't stand the inability of customizing iOS. Google is strangling the platform, replacing FOSS features with Google counterparts, and if it wasn't for Samsung and maybe a few other big ones, they would probably have abandoned AOSP by now.
iOS right now offers by far the most polish, mature and thought-through experience
If you want to do it exactly as they allow you to. Everytime you try to deviate from Apples happy path there are suddenly thorns everywhere and you find yourself without any support, be it on iOS or MacOS
I should have said out of the box experience.
Use custom ROMs
A bit late... Something new might replace it but this experiment got killed a couple days ago already.
Google is killing off its proposal for "Web Environment Integrity API" as a new web standard, though Android phones may still have to deal with it.
That is literally the first sentence of the linked article. I think this is one of the things how it comes back.
Does Vanced really use WebView for playback (the link the article provides suggests it's used for sign-in)?
Aside from forgetting to mention Revanced which is very much alive, I have doubts about the article. It feels like the author realized his headline doesn't work anymore so came up with something plausible sounding...
Vanced and Revanced use(d) a fork of MicroG for sign-in. MicroG is a FOSS implementation of Google Play Services and other Google app APIs but with minimum tracking. It uses the website to sign in, which I imagine is rendered with WebView because the app is so small.
Yeah, I'm running LineageOS with MicroG, so I tried disabling Android System Webview as a test. ReVanced seems perfectly happy to browse/play videos (though I didn't try logging out). The only apps I have that fall over without webview seem to be eBay and Amazon, so no great loss there.
MicroG can run in background without WebView, only logging in requires the website-based GUI.
This is like, save the children war fund, or some such nonsense naming scheme.
The new home of /r/Android on Lemmy and the Fediverse!
Android news, reviews, tips, and discussions about rooting, tutorials, and apps.
🔗Universal Link: !android@lemdro.id
💡Content Philosophy:
Content which benefits the community (news, rumours, and discussions) is generally allowed and is valued over content which benefits only the individual (technical questions, help buying/selling, rants, self-promotion, etc.) which will be removed if it's in violation of the rules.
Support, technical, or app related questions belong in: !askandroid@lemdro.id
For fresh communities, lemmy apps, and instance updates: !lemdroid@lemdro.id
📰Our communities below
Stay on topic: All posts should be related to the Android OS or ecosystem.
No support questions, recommendation requests, rants, or bug reports: Posts must benefit the community rather than the individual. Please post to !askandroid@lemdro.id.
Describe images/videos, no memes: Please include a text description when sharing images or videos. Post memes to !androidmemes@lemdro.id.
No self-promotion spam: Active community members can post their apps if they answer any questions in the comments. Please do not post links to your own website, YouTube, blog content, or communities.
No reposts or rehosted content: Share only the original source of an article, unless it's not available in English or requires logging in (like Twitter). Avoid reposting the same topic from other sources.
No editorializing titles: You can add the author or website's name if helpful, but keep article titles unchanged.
No piracy or unverified APKs: Do not share links or direct people to pirated content or unverified APKs, which may contain malicious code.
No unauthorized polls, bots, or giveaways: Do not create polls, use bots, or organize giveaways without first contacting mods for approval.
No offensive or low-effort content: Don't post offensive or unhelpful content. Keep it civil and friendly!
No affiliate links: Posting affiliate links is not allowed.
Our Communities
Lemmy App List
Chat and More