[dead]
That is a cost that our future authoritarian world leader has decided is more than acceptable.
reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
21–30 of 74 posts
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#22Earlier quoted context omitted.
That's the whole goal of the concept. Safetynet (the predecessor of Play Integrity) was developed to block CyanogenMod and then later used to block Huawei.
App developers need to put effort into enabling these APIs so it's not like Google is actively blocking your favorite apps. Their makers are. Like with reCAPTCHA, there are other services and libraries out there to detect root access and other things companies want to detect in their apps.
Sure, Google was betting that bureaucratic companies would enroll voluntarily and it worked.
> Like with reCAPTCHA, there are other services and libraries out there to detect root access and other things companies want to detect in their apps.
My opinion on this is that any method to check integrity, root access or if developer mode is enabled is a security vulnerability by itself, no such app should be able to know that.
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#23Earlier quoted context omitted.
Integrity doesn't guarantee any security to your device, just that the device is same as from the factory. That's a common misconception.
"strong integrity" also takes into account if a security update has been installed recently enough. I don't believe hardware integrity spoofing has been accomplished on Android yet. Software integrity and compatibility with old hardware has been used to spoof device IDs and pretend a phone doesn't have the ability to do hardware attestation. It's technically possible to exploit a kernel and get root access on a runni…
> "strong integrity" also takes into account if a security update has been installed recently enough.
My Galaxy S10, last update in 2023 passes strong integrity.
With the little amount of security updates most Android devices have, I'm pretty sure you can find an exploit for pretty much everything except the most expensive flagships.
What does integrity really means when nobody really knows what's in the device and with a terrible software update policy anyways.
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#24So, let me see if I understand it:
Apple+Google got punished by the EU for non-competitive practices and now they offered to ordinary websites their most desired features: bot blocking and unavoidable user tracking across all devices and operating systems.
And if EU wants to sue, they'll have to sue each and every website that requires this, and they would loose, because there are no alternatives and even if there were, they would be just as bad.
Great job Google+Apple! I'm proud of you. /s
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#25> linux desktop
That's the only part I'm interested in. I've read this article - or something similar - before and it doesn't surprise me that these big tech companies want more control. What I don't understand is how this affects linux desktop?
Is it going to be that online services or websites or webapps can choose to require attestation? Whether you use this OS or that OS? Or are linux developers forced to change their open source software?
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#26[dead]
Blind people need to start suing at least in America the ADA is far easier to win against large companies than in the UK as the equality act is treated vastly weaker by judges than if someone presented a religion or race lawsuit.
America is the only place to take down big tech discrimination.
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#27Earlier quoted context omitted.
Integrity doesn't guarantee any security to your device, just that the device is same as from the factory. That's a common misconception.
"strong integrity" also takes into account if a security update has been installed recently enough. I don't believe hardware integrity spoofing has been accomplished on Android yet. Software integrity and compatibility with old hardware has been used to spoof device IDs and pretend a phone doesn't have the ability to do hardware attestation. It's technically possible to exploit a kernel and get root access on a runni…
> if a security update has been installed recently enough
In turn, this enables any tyrannical or anti-competitive demand which can be implemented in software, such as "user is not on the blasphemer list" or "all communications are being CC'ed to the Ministry of Truth."
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#28> linux desktop That's the only part I'm interested in. I've read this article - or something similar - before and it doesn't surprise me that these big tech companies want more control. What I don't understand is how this affects linux desktop? Is it going to be that online services or websites or webapps can choose to require attestation? Whether you use this OS or that OS? Or are linux developers forced to change…
It'll affect you the same way reCAPTCHA does. A website decides to use "Google Cloud Fraud", and locks you out if you don't complete the "challenges" it shows. Your OS doesn't matter at all.
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#29Earlier quoted context omitted.
Integrity doesn't guarantee any security to your device, just that the device is same as from the factory. That's a common misconception.
"strong integrity" also takes into account if a security update has been installed recently enough. I don't believe hardware integrity spoofing has been accomplished on Android yet. Software integrity and compatibility with old hardware has been used to spoof device IDs and pretend a phone doesn't have the ability to do hardware attestation. It's technically possible to exploit a kernel and get root access on a runni…
>I don't believe hardware integrity spoofing has been accomplished on Android yet.
It has, but extracted keys aren't free.
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#30Earlier quoted context omitted.
"strong integrity" also takes into account if a security update has been installed recently enough. I don't believe hardware integrity spoofing has been accomplished on Android yet. Software integrity and compatibility with old hardware has been used to spoof device IDs and pretend a phone doesn't have the ability to do hardware attestation. It's technically possible to exploit a kernel and get root access on a runni…
> "strong integrity" also takes into account if a security update has been installed recently enough. My Galaxy S10, last update in 2023 passes strong integrity. With the little amount of security updates most Android devices have, I'm pretty sure you can find an exploit for pretty much everything except the most expensive flagships. What does integrity really means when nobody really knows what's in the device and w…
The exact requirements for security updates depends on the Android version you're running and the one your device came with. From the docs:
MEETS_STRONG_INTEGRITY
The app is running on a genuine and certified Android device with a recent security update.
On Android 13 and higher, the MEETS_STRONG_INTEGRITY verdict requires MEETS_DEVICE_INTEGRITY and security updates in the last year for all partitions of the device, including an Android OS partition patch and a vendor partition patch.
On Android 12 and lower, the MEETS_STRONG_INTEGRITY verdict only requires hardware-backed proof of boot integrity and does not require the device to have a recent security update. Therefore, when using the MEETS_STRONG_INTEGRITY, it is recommended to also take into account the Android SDK version in the deviceAttributes field.
A single device will return multiple device labels in the device integrity verdict if each of the label's criteria is met.