3rd party WebView

[mehrvarz]

Hi. I wanted to get back to you earlier, but I am glued to Twitter most of my free time. Anyways, my app has made it through F-Droid approval process and will be available soon. This brings up a view things I still wonder about. In particular: how do you plan to proceed regarding your WebView implementation wrt WebRTC. I assume the switch approach (as we discussed already) not really simple to implement for a WebView. Any thoughts? Any other news?

[wchen342]

I haven't been able to start actually because of reasons, but I expect to update the version to cr98 at least next week. Anyway I assume it will not be that easy for webview to have a global or per-site switch, but I will need to test. I will put the default to disabled. For chromium itself since we will have a switch users can re-enable it, and for webview if there is no switch UI then it will keep being disabled.
Btw chromium has custom tabs which is more flexible than webview. Maybe it will be possible for you to use that?

[mehrvarz]

3 days later and you are still advertising support for WebRTC. This is not only wrong for the current release, but also for many previous releases. It is something you should fix now.

[wchen342]

I don't know what you mean by "advertising support for WebRTC", as it DOES support WebRTC and can be toggled. The best I can do is add the same statement in CHANGELOG to README. Also it was weekend and I do have other things to do. An open source developer does not owe anyone anything, and the license clearly states that the software is provided as "AS IS". It is better leaving the mindset of customer-company relationship out of this.

[mehrvarz]

as it DOES support WebRTC and can be toggled

This thread is about WebViews. Can WebRTC be turned on in your WebView? That would be wonderful. But my understanding so far is that this is not possible. I'm not sure and I start to think this ambiguity is by design.

Open source projects should come with an honest description. This is my mindset. You have disabled a complete W3C specification. And the only thing you say about it:

Prevent WebRTC address leaking

is completely misleading. Please replace this with a honest description:

WebRTC has been disabled. It can be enabled by... but not in the WebView,

[wchen342]

Webview is more a by-product of the browser, it is never the main focus of the project, and it is only provided for convenience. And before you ask, no I didn't mention WebView as a product of the project, only provided download for whoever wanted to try it out.

Prevent WebRTC address leaking

That line has already been replaced.

[Pika3pika]

@wchen342 , i've been trying to install your system webview ungoogled chromium(https://github.com/wchen342/ungoogled-chromium-android/releases/download/83.0.4103.97-1/SystemWebView_arm64.apk) on my lineage 20 , but i get the error message: App not installed as package appears to be invalid. Also, the F-droid repo's you provided are down i believe. Any advice, something im doing wrong? I'm able to install apps from unknown sources so that's no issue, it looks like there is no further development on the webviews, but i'd just love to use yours on my system. Thanks for your time and effort, for example the ungoogled chromium browser is working fine and i'm loving it!

[mehrvarz]

About static signatures for webviews

I am using LineageOS on most of my devices. Lineage behaves like AOSP, by alllowing 3rd party webviews to be installed. This is why I didn't notice this yet. Yesterday I learned that CalyxOS and Omniweb (either one of the two, or both, not 100% sure) prevent the installation of a 3rd party WebViews (including on unlocked devices) by requiring a static signature for ALL WebViews. In my understanding this does not provide any additional security. It only denies choice. What makes this worse: the WebView on these OS's appear to have the same bad WebRTC patch applied to them (or something similar), so WebRTC apps do not work. And bc of the static signature, no one can do anything about it.

On Lineage OS, like on stock AOSP, the owner of an unlocked device can install a 3rd party WebView. He can from then on install updates with the same signature easily via UI. This is fine engineering by Goo and it is 100% secure.

I asked here how the static signature can provide any better security. The provided answer does not make sense to me. This whole thing smells like anti-competitive practice. This would be bad all by itself. But apparently in the two cases mentioned above WebRTC in the WebView does not seem to work.

What is next? Will they lock down the browser also, like on iOS?

I assume you are aware of the overall situation much better than I am. I like to ask you:

1. Can we discuss the static signature situation and try to come to a common understanding?
2. How widespread is this static signature practice? I need to be able to tell the users of my app what to do.

[wchen342]

The signature is not something I can do anything with. The OSes' pre-loaded signatures are generated from vendors' digital certificate, and as long as they are cryptographically strong there is no way to get around that.
There is a way on rooted devices, that you can use something in Magisk or Xposed to override the list of allowed signatures. Otherwise, in order to make the signature into an OS you have to ask the OS vendor to pre-load it into their building process for you.

How widespread is this static signature practice?

It exists on all production builds of Android. LineageOS merely disabled it (or more likely, it is because all Lineage are dev build, which is actually less secure but we chose to exchange security for convenience sometimes).

[mehrvarz]

It exists on all production builds of Android.

This is not true. One signature-free slot exists on most Android devices. Not just on Pixel / Nexus devices, but also (for instance) on production Huawei phones. I own such a device and I installed your UGA WebView on it with no issues.

Until very recently this slot also existed on most Android derivate OS's. If this slot does not exist, it is a deviation from stock Android. The vendor may remove it either because they "think" they provide "better" security this way, or they do it for ill purposes. Stock Android accepts a WebView APK if it exists on the system partition. Updating that WebView from UI (without reboot) is possible, but only with a binary from the same vendor. Which is 100% secure. This is my understanding of the situation. I really hope we can get to the same understanding. If I am wrong somewhere, I am happy to adjust.

cryptographically strong there is no way to get around that

Going around the certificate requirement is not what I want. Here is what I try to achieve: There are 30-40 Android derivate OS's around. I want to complile a list of those, who have removed the signature-free slot for 3rd party WebViews. So if a user with derivate X contacts me and tells me WebRTC does not work, I can tell them: you can / can not solve this problem. The reason I wanted to discuss this with you, is bc I think you would also be interested in such a list.

Not on that list: stock, Lineage, crDroid

[wchen342]

One signature-free slot exists on most Android devices

That slot still requires a specific package name if I recall correctly (chrome debug or sth), so it is not exactly a completely "free" slot, more like a convenience for debugging. Either way, whether it is for lock-down depends on your view, and personally I do lean towards believing it is more about vendor trying to prevent users from using anything else.
It is not unlike secure boot IMO, and yes it could have worked with just a given package pre-installed in system partition.

I want to complile a list of those, who have removed the signature-free slot for 3rd party WebViews

That's an interesting idea. I don't know if anyone had ever tried to compile such a list before, maybe there will be some information on XDA.

30-40 Android derivate OS's

I think that's an underestimtion. Technically yes, there are only so many OS "brands" but they can do small modifications to the OS for each device (I used to flush XDA ROMs a lot so I knew) and that can soon become a huge list if you count in all the different devices.
However, if you managed to collect some information on the most common ones than I'm sure it can be helpful for people who need to deal with WebViews.

[mehrvarz]

That slot still requires a specific package name

It is always com.android.webview, same as with your 3rd party WebView. For an Android variant to demand something else is very, very special (ignoring the signature slots: com.android.chrome, com.chrome.canary, com.google.android.webview, etc.).

it is more about vendor trying to prevent users from using anything else.

Yes. Even from users owning unlocked devices. We need to distinguish device vendors from OS vendors here. OS vendors, who would not exist if devices could not be unlocked, removing choice from their users, is really bad. Especially if you get nothing (security or otherwise) in return. Stock behavior is secure enough for G. And it is very deliberate:

https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/core/java/com/android/server/webkit/WebViewUpdateServiceImpl.java;l=589-606;drc=master

To compile that list, we need to find a few others to run 2 commands and share the return data:

1. adb pull /system/framework/framework-res.apk
2. aapt d xmltree framework-res.apk res/xml/config_webview_packages.xml

Let's continue later with new info.

ED: LineageOS (note: the 6th entry has no "E: signature")

  E: webviewprovider (line=19)
    A: availableByDefault=(type 0x12)0xffffffff
    A: description="Chrome Stable" (Raw: "Chrome Stable")
    A: packageName="com.android.chrome" (Raw: "com.android.chrome")
    E: signature (line=20)
      C: "MIIEQzCC...DAaTCK"
  E: webviewprovider (line=22)
    A: description="Chrome Beta" (Raw: "Chrome Beta")
    A: packageName="com.chrome.beta" (Raw: "com.chrome.beta")
    E: signature (line=23)
      C: "MIIEQzCC...DAaTCK"
  E: webviewprovider (line=25)
    A: description="Chrome Dev" (Raw: "Chrome Dev")
    A: packageName="com.chrome.dev" (Raw: "com.chrome.dev")
    E: signature (line=26)
      C: "MIIEQzCC...DAaTCK"
  E: webviewprovider (line=28)
    A: description="Chrome Canary" (Raw: "Chrome Canary")
    A: packageName="com.chrome.canary" (Raw: "com.chrome.canary")
    E: signature (line=29)
      C: "MIIEQzCC...DAaTCK"
  E: webviewprovider (line=31)
    A: availableByDefault=(type 0x12)0xffffffff
    A: description="Google WebView" (Raw: "Google WebView")
    A: packageName="com.google.android.webview" (Raw: "com.google.android.webview")
    E: signature (line=32)
      C: "MIIEQzCC...DAaTCK"
  E: webviewprovider (line=36)
    A: availableByDefault=(type 0x12)0xffffffff
    A: description="AOSP WebView" (Raw: "AOSP WebView")
    A: packageName="com.android.webview" (Raw: "com.android.webview")

[mehrvarz]

FYI: My WebCall app is available from F-Droid now:
https://f-droid.org/packages/timur.webcall.callee