Hacker News Reader

Comment by ajross | Hacker News Reader

> To me, this looks like a backdoor way to prevent people making "hacked" apps which, for example, play youtube but without ads.

More like "impersonate your bank and steal your login credentials". MitM attacks using interposed clients are a genuine threat outside the Apple and Google walled gardens (and even a little bit within). WEI was an attempt at solving a real problem.

Now, maybe it had unacceptable side effects, maybe it was more harmful than useful. And now it's dead. But the underlying issues got completely lost in the hyperbole wars around here. People were wildly slinging accusations of secret agendas and general bad faith[1]. It wasn't our finest moment as a community.

[1] Most of them while typing said comments on an Apple device objectively even less friendly to nonstandard clients!

View on HN

Google tried to take actions that would trivially lead to the end of the open web and enforce complete control over the software people ran on their own hardware. You can't accuse people of "hyperbole wars" when the worst-case is realistic (and indeed most likely).

> Google tried to take actions that would trivially lead to the end of the open web and enforce complete control over the software people ran on their own hardware.

So did Apple though, years ago. And no one freaked out like this. It just seems like maybe the argument is about something else.

People did complain about Apple; fewer because it's harder to get press attention about Apple on privacy issues, but it's pure revisionism to say that Apple's attestation systems weren't criticized.

This is how HN reacted to Apple's announcement: https://news.ycombinator.com/item?id=31751203

I have my own set of negative comments in that very thread where I literally call Apple's system DRM. So do I pass this ridiculous "hypocrisy" check well enough now that I'm allowed to complain about Google killing the Open web?

It's arguable that the "open web" will exist for as long as Linux and KHTML exists. There will always be agnostic choices available, even if people choose outdated, locked-down or underdeveloped devices. Unlike the situation with AdSense, I'd argue it's really hard to identify any potential harm in this scenario. Multiple companies (Apple included) have also built their own remote attestation services, and nobody cried bloody murder then.

If you think this is bad, then I regret to inform you that your war is probably lost. Maybe give GrapheneOS or Lineage a try?

I am literally typing this on a LineageOS device; I don't see how that helps, if anything it just highlights the problem. The problem is that WEI, in any form, is most likely to be used in a way that results in websites blocking my device because I'm running my own operating system. And I'm pretty sure people did in fact cry bloody murder when Apple started doing it, but at least Apple was small enough percentage of the overall web browser share that nobody was going to try and mandate a feature that only they supported, unlike Chrome.

Edit: In short, the open web relies on being able to run any client you want; having KHTML doesn't do any good if sites block it.

> Multiple companies (Apple included) have also built their own remote attestation services, and nobody cried bloody murder then.

HN, at the time, crying bloody murder about Apple's attestation system: https://news.ycombinator.com/item?id=31751203

This argument keeps getting brought out about Google, but in reality people are critical of iOS and Apple all the time. Yes, it is harder to get widespread reactions from people who are disengaged from web standards because Apple doesn't have Google's reputation. Yes, people tend to be more worried about Chrome than Safari in part because Safari is sitting at 20% market share.

But people do (and did) criticize Safari. It's not separate standards; if you pay attention to the people who are most engaged on these issues, Apple's DRM systems get criticism.

> If you think this is bad, then I regret to inform you that your war is probably lost.

There's an awful lot of gust in that sail, and yet no wind... Got anything to back it up or are we just being a corporate sycophant?

You’re being downvoted at the moment, but this is absolutely true. Fake bank apps are a huge problem, which this addresses.

It absolutely does not. The ability to craft a realistic phishing login page is unaffected by Google's proposed MI API.

Crafting a fake login page in your app is a totally different problem than transparently proxying the web interface. First, if you copy the login page those assets are in the apk. This is easily detectable by bouncer and allows those apps to be denied (this happens today). Second, stealing the assets opens the app up to dmca takedown, which also happens today. Third, and most importantly, if you reverse proxy the page then the app will appear to users to actually work. This is crucial for the bad actor as it keeps the app from having a low rating in the App Store for not working. When they just steal the login page, the app gets downvoted quickly for being “broken”.

All of this adds up to making the bad actors have to work much harder, which is the goal.

> First, if you copy the login page those assets are in the apk.

You don't need to store the assets in the APK if you can load a webpage.

> Third, and most importantly, if you reverse proxy the page then the app will appear to users to actually work. This is crucial for the bad actor

You don't need to show the working bank app if it isn't advertised as one. Name it "Government assistance program" with "application process" requiring logging in with bank credentials (to confirm identity, because bank knows who you are). Then you can make it more convincing by adding some bs forms and stuff like "your application will be processed in two weeks".

I saw this stuff already implemented and used. They can add as many integrity protection layers as they want, but it won't trigger one. So it looks like a measure to say "bank apps are safe now we are great guys" without real effect.

I'd say that it may increase login thefts because users may get a false impression that anything they will install is safe now.

Reply on news.ycombinator.com