The Chromium Mess Meets Android
Total Page:16
File Type:pdf, Size:1020Kb
The Chromium mess meets Android David Ludovino, The Chromium mess meets Android Jeremy Rand Proposals on how to get a fully free WebView build or replace it with something What is completely new WebView? Which apps use it? What's underneath it? ∗ What's the David Ludovino Jeremy Rand matter with Chromium? WebView and Replicant Replicant Chromium forks Desktop Chromium Android Chromium Stepwise cleansing GeckoView shim Mapping WebView to GeckoView GeckoView on apps ∗with support from Andr´esD and Kurtis Hanna Feedback? The Chromium mess meets Android What is WebView? David Ludovino, Jeremy Rand Renders web content (HTML, CSS, JavaScript) What is WebView? inside apps. Which apps use it? What's underneath it? API has been around since Android 1. What's the matter with Chromium? public class MainActivity extends Activity { WebView and @Override Replicant protected void onCreate(Bundle state) { Chromium super.onCreate(state); forks WebView v = new WebView(this); Desktop Chromium setContentView(v); Android Chromium Stepwise cleansing v. loadUrl ("https://replicant.us"); } GeckoView shim } Mapping WebView to GeckoView GeckoView on apps Feedback? The Chromium mess meets Android Which apps use WebView? David Apps that render HTML: email clients, RSS readers, etc. Ludovino, Jeremy Rand Became pervasive with the advent of cross-platform mobile frameworks. What is WebView? Which apps use it? What's underneath Half of the apps listed at PRISM Break depend on WebView it? What's the uses WebView does not use WebView matter with Chromium? WebView and Replicant K-9 Mail OsmAnd Nextcloud Tiny Tiny I2P Orbot F-Droid andOTP Shaarlier Briar RSS Chromium forks Desktop Chromium Android Chromium Stepwise cleansing wallabag OpenKey- EteSync Syncthing Signal Conversa- Silence Tinc App KeePass Jami chain tions DX GeckoView shim Mapping WebView to GeckoView GeckoView on dande- Nomad Tusky Movim Bitmask Wire- Fennec Tor Thorium apps lion* guard F-Droid Browser Feedback? The Chromium mess meets Android What is underneath WebView? David Ludovino, Jeremy Rand What is WebView? Which apps use it? What's underneath it? WebKit until Android 4.3 Jelly Bean (API 18). What's the matter with Chromium? WebView and Replicant Chromium forks Desktop Chromium Android Chromium Chromium from Android 4.4 KitKat (API 19) onwards. Stepwise cleansing GeckoView shim Mapping WebView to GeckoView GeckoView on apps Feedback? Security issues: • Prevents users from escaping the certificate authority system for TLS. Freedom issues: • Pre-built binaries throughout the code base. • Missing license in some source files. Verdict: unfit for fully free-software distributions. The Chromium mess meets Android What's the matter with Chromium? David Ludovino, Privacy issues: Jeremy Rand • Background requests to Google during build and run. What is WebView? • Depends on Google services for several features (e.g. Safe Browsing). Which apps use it? What's underneath • it? Limited privacy controls. What's the • API prevents extensions from blocking ads. matter with Chromium? WebView and Replicant Chromium forks Desktop Chromium Android Chromium Stepwise cleansing GeckoView shim Mapping WebView to GeckoView GeckoView on apps Feedback? Freedom issues: • Pre-built binaries throughout the code base. • Missing license in some source files. Verdict: unfit for fully free-software distributions. The Chromium mess meets Android What's the matter with Chromium? David Ludovino, Privacy issues: Jeremy Rand • Background requests to Google during build and run. What is WebView? • Depends on Google services for several features (e.g. Safe Browsing). Which apps use it? What's underneath • it? Limited privacy controls. What's the • API prevents extensions from blocking ads. matter with Chromium? WebView and Security issues: Replicant • Prevents users from escaping the certificate authority system for TLS. Chromium forks Desktop Chromium Android Chromium Stepwise cleansing GeckoView shim Mapping WebView to GeckoView GeckoView on apps Feedback? Verdict: unfit for fully free-software distributions. The Chromium mess meets Android What's the matter with Chromium? David Ludovino, Privacy issues: Jeremy Rand • Background requests to Google during build and run. What is WebView? • Depends on Google services for several features (e.g. Safe Browsing). Which apps use it? What's underneath • it? Limited privacy controls. What's the • API prevents extensions from blocking ads. matter with Chromium? WebView and Security issues: Replicant • Prevents users from escaping the certificate authority system for TLS. Chromium forks Desktop Chromium Freedom issues: Android Chromium Stepwise cleansing • Pre-built binaries throughout the code base. GeckoView shim • Missing license in some source files. Mapping WebView to GeckoView GeckoView on apps Feedback? The Chromium mess meets Android What's the matter with Chromium? David Ludovino, Privacy issues: Jeremy Rand • Background requests to Google during build and run. What is WebView? • Depends on Google services for several features (e.g. Safe Browsing). Which apps use it? What's underneath • it? Limited privacy controls. What's the • API prevents extensions from blocking ads. matter with Chromium? WebView and Security issues: Replicant • Prevents users from escaping the certificate authority system for TLS. Chromium forks Desktop Chromium Freedom issues: Android Chromium Stepwise cleansing • Pre-built binaries throughout the code base. GeckoView shim • Missing license in some source files. Mapping WebView to GeckoView GeckoView on Verdict: unfit for fully free-software distributions. apps Feedback? The Chromium mess meets Android WebView and Replicant David Ludovino, Jeremy Rand What is Replicant: WebView? Which apps use it? • Android distribution What's underneath it? • compliant with GNU Free System Distribution Guidelines (FSDG) What's the matter with Chromium? WebView and Replicant Using outdated WebView based on Chromium 43: lots of security concerns. Chromium forks Desktop Chromium Android Chromium Stepwise cleansing How to create a WebView build that respects user's privacy and freedom? GeckoView shim Mapping WebView to GeckoView GeckoView on apps Feedback? The Chromium mess meets Android Desktop Chromium forks David Ludovino, Jeremy Rand What is • ungoogled-chromium: aligned with privacy and freedom WebView? Which apps use it? What's underneath it? • Bromite: can build WebView; only focused on privacy and ad blocking What's the matter with Chromium? • Debian: replaces pre-builts with system libs; Google services not removed WebView and Replicant Chromium • Iridium: one step on every direction; not as thorough as others forks Desktop Chromium Android Chromium Stepwise cleansing GeckoView Guix, a FSDG compliant distro, uses: shim ungoogled-chromium + build recipe that removes some files. Mapping WebView to GeckoView GeckoView on apps Feedback? The Chromium mess meets Android Android Chromium forks David Ludovino, Jeremy Rand What is WebView? Android builds require many more pre-builts and proprietary dependencies. Which apps use it? E.g.: Google Mobile Services (GMS) What's underneath it? What's the matter with Chromium? • ungoogled-chromium-android: ungoogled-chromium + Android specific WebView and Replicant patches; has some remaining pre-builts Chromium forks Desktop Chromium • Unobtainium: aimed to be built within F-Droid (forbids pre-builts); Android Chromium Stepwise cleansing project is unmaintained GeckoView shim Mapping WebView to GeckoView GeckoView on apps Feedback? The Chromium mess meets Android Android Chromium forks David strings classes.dex | grep google Ludovino, Jeremy Rand Chromium 78 WebView - 227 lines . You must have the following declaration within the <application> element: What is <meta-data android:name="com.google .android.gms.version" android:value="@integer/google _play_services_version" /> WebView? Google Inc .1 Google Inc .1 Which apps use it? Google Inc .1 What's underneath A required meta-data tag in your app's AndroidManifest.xml does not exist. it? You must have the following declaration within the <application> element: <meta-data android:name="com.google .android.gms.version" android:value="@integer/google _play_services_version" /> RCompositeGoogle ApiClient should not be used without any APIs that require sign-in. What's the OConnection timed out while waiting for Google Play services update to complete. matter with +Failed to connect to Google Play Services: -Failed to get Google certificates from remote Chromium? Google Play Services "Google Play Services not available WebView and Google Play Store is missing. $Google Play Store signature invalid. Replicant 0Google Play services is invalid. Cannot recover. Google Play services is missing. Chromium ;Google Play services missing when getting application info. ,Google Play services out of date. Requires forks 'Google Play services signature invalid. Desktop Chromium Google ApiActivity Google ApiAvailability Android Chromium &Google ApiClient connecting is in step Stepwise cleansing )Google ApiClient is not configured to use HGoogle ApiClient is not configured to use the API required for this call. GeckoView Google ApiClient is not configured to use the LocationServices.API Api. Pass thisinto Google ApiClient.Builder#addApi() to use this feature. %Google ApiClient is not connected yet. shim Google ApiClient must not be null Mapping WebView &Google ApiClient parameter is required. to GeckoView Google ApiClient received too many callbacks for the given step. Clients may be in an unexpected state; Google