tetch

Nice work! May I inquire as to the design decision behind storing a hash of the long token server-side for verification of the long token, versus digitally signing the short token plus a nonce and including this signature in the API key (instead of a long token), as some other API key schemes do?

Both are valid approaches of course, I'm just interested to hear your thoughts on the relative tradeoffs.

Looks like this has already been created, back in March?

Here's their charter: https://github.com/WebView-CG/charter/blob/main/charter.md

This reminds me, back when I used to do app security, one of the issues with webviews was that some apps would hide much of the UI that users are used to seeing in browsers to make security decisions. So if an attacker could, via some vulnerability, redirect the site being viewed in the webview to one of their choosing, the user wouldn't be any the wiser.

I think it would generally be better if webviews, by default, have restricted navigation, and the developer has to deliberately whitelist domains they wish to view in it. Rather than having to write a navigation delegate or similar to implement their own whitelist, which most developers won't bother with.

This seems a tad hyperbolic. And the comparison between encryption and abortion is really weak - the differences are much greater than the parallels.

Especially when the author then goes on a tirade about law enforcement. Encryption helps conceal evidence of crimes, which is why many of those who enforce the laws seek to curb it, but abortion is controversial because those who oppose it believe that it's essentially a type of murder. It's not really comparable to just hiding one's tracks. I don't see how the two are intrinsically linked, like the author seems to be arguing they are.

I agree with the legal right both to encryption (albeit with penalties for refusing to decrypt specific data that could plausibly be considered evidence of a crime) and abortion (where the foetus is sufficiently undeveloped, or where necessary for medical reasons), but this article is just too much over the top.