Google has listened to the criticism and halted the promotion of the Web Environment Integrity API, while also removing its experimental implementation from the Chromium codebase and archiving the repository of the specification. Meanwhile, experiments continue on the Android platform with a similar API for verifying the user's environment — WebView Media Integrity, which is positioned as an extension based on Google Mobile Services (GMS). It is claimed that the WebView Media Integrity API will be limited to the WebView component and applications related to multimedia content processing, for example, it may be used in mobile applications based on WebView for streaming audio and video. Providing access to this API through a browser is not planned.
The Web Environment Integrity API was designed to give website owners the ability to ensure that the client's environment is trustworthy regarding the protection of user data, adherence to intellectual property rights, and interaction with a real person. It was anticipated that the new API could be in demand in areas where a website needs to verify that there is a real person and a real device on the other side, and that the browser is neither modified nor infected with malware. The API is based on Play Integrity technology, already used in the Android platform to confirm that the request is made from an unmodified application installed from the Google Play store and running on a genuine Android device.
As for the Web Environment Integrity API, it could be used to filter traffic from bots when displaying advertisements; combat automatically sent spam and inflated ratings on social networks; detect manipulations when viewing copyright-protected content; fight cheaters and fake clients in online games; identify the creation of fake accounts by bots; counteract password guessing attacks; and protect against phishing conducted via malware redirecting to real sites.
To verify the browser environment in which the downloaded JavaScript code is executed, the Web Environment Integrity API proposed using a special token issued by a third-party attester, which could be linked to a chain of trust with integrity control mechanisms on the platform (e.g., Google Play). The token was formed by sending a request to the third-party attestation service. server This service, after performing certain checks, confirmed that the browser environment was not modified. Encrypted Media Extensions (EME), similar to those used in DRM for decoding copyright-protected media content, were utilized for authentication. In theory, EME is not tied to individual vendors; however, in practice, three proprietary implementations became widespread: Google Widevine (used in Chrome, Android, and Firefox), Microsoft PlayReady (used in Microsoft Edge and Windows), and Apple FairPlay (used in Safari and Apple products).
The attempt to implement the discussed API raised concerns that it could undermine the open nature of the Web and lead to increased user dependency on individual providers, significantly limiting the use of alternative browsers and complicating the entry of new browsers into the market. As a result, users could be left dependent on officially vetted browsers, without which they would lose the ability to access certain major websites and services.
Source: opennet.ru
