Android Protected Confirmation API
security.googleblog.com
security.googleblog.com
> Unlike other mobile OSes, Android is built with a transparent, open-source architecture. We firmly believe that our users and the mobile ecosystem at-large should be able to verify Android’s security and safety and not just take our word for it.
Our users eh? Tell me more.
> One of those features is Android Protected Confirmation, an API that enables developers to utilize Android hardware to provide users even more assurance that a critical action has been executed securely. Using a hardware-protected user interface, Android Protected Confirmation can help developers verify a user’s action intent with a very high degree of confidence.
So, you are locking down my machine to give other people confidence I have no power? That... Seems not at all to be what you just said in the intro paragraph.
It gets so much worse. These palid anti-people-corporatists are doing this shit to the whole web. There's the Web Environment Integrity API, which promises a trusted vendor is running trusted code atop a platform the user has no control over, that Google can attest will only ever do what the developer wants. https://github.com/RupertBenWiser/Web-Environment-Integrity/... https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_...
I just cannot believe the nerve of these assholes. The doublespeak is so vile. They claim to be helping users but they are building a regime of computing where we have no power, where users get nothing, where the developer is fully empowered to do as they please.
I can't believe the nerve & audacity of former HTML editor Hixie & the Flutter folks in trying to dynamite the foundation of the web, in trying to destroy HTML & structured information, replacing it with developer controlled code. (See, Towards a Modern Web Stack.) But those efforts are nothing compared to this steaming mound of fuck you Google is throwing at us. What an obsequious destabilizing piece of trash.
Remember the uproar versus EME on the web, remember the anger we had when TBL overrided, to allow drm codecs to work? This is 3000x worse. This is thermonuclear warfare against the user base. This is anti-personal computing. This is a clipper clip in every system. This is top down authoritarian control over the planet, by Google, for developer's convenience. This is endgame. This is Google one upping everyone to be the evil shittiest worst thing, to be the end of Personal Computing. It's all certified safe Google computing from here on you.
From here in Washington DC, the world's biggest fuck you you fucking assholes: you toxic shitwads have fucking poisoned the "soft" software world & made it an uptight totalitarian regime, you shitty low grade pathetic sinister B-grade villian tarts. What the fucking fuck. And you lie so grotesquely to us about it, you monsters.
Yes, security of the platform is important to users too. They like to rely on the fact that apps are properly sandboxed from each other and can't just steal all of your personal photos without getting your approval.
>So, you are locking down my machine to give other people confidence I have no power?
You are free to modify your machine. Google just may not attest that your sytem is secure if you make changes that compromise the security of your system.
>computing where we have no power, where users get nothing
Users are not losing any power. Owners of services just now have the ability to test if a client is trustworthy. As a user you are free to use services that don't require you to be using a secure environment.
>where the developer is fully empowered to do as they please.
This certainly isn't the case. Developers can't bypass the operating systems security model because that is the whole point of secure devices.
This is the wrong side of the War On General Purpose Computing. Making a world humankind cannot observe or learn about is the wrong direction.
That is not what's happening though.