Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

discuss.grapheneos.org

Post reply on HN
Print view View original

31–40 of 74 posts

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#31

Post by charcircuit »

jeroenhd wrote: post #14
charcircuit wrote: post #4

If Windows wasn't so far behind Apple and the rest of the industry in regards to integrity APIs this wouldn't be necessary. It's embarrassing for Microsoft that someone needs to use a separate, more secure device since their security is so bad.

Windows Hello offers an attestation API according to the releases I found, though because Microsoft has called at least four products "hello" now, I can't easily find the details. I don't think there's a technical reason why Google couldn't have released an app with a URL handler that uses that API except maybe for the Windows TPMs being less secure than mobile ones in general.

That attestation is for attesting you are using a TPM for user authentication. Which is different than attestation of integrity.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#32

Post by charcircuit »

foltik wrote: post #17
charcircuit wrote: post #7

Earlier quoted context omitted.

Attestation isn't against being able to do whatever you want with your own device. It just means that if you want other people to trust your custom device you need to get them to trust your signing key.

Not sure if you’re being deliberately obtuse, but a signing key means nothing by itself. What exactly do you think is being attested TO? Thats right: that the user can’t do what they want with their own device. Obviously your key wouldn’t be trusted if they could. There is no other conceivable purpose that attestation could serve.

There are many changes that are possible which do not harm the integrity of applications.

>the user can’t do what they want with their own device

In the same way the user can't make their device have the Microsoft Word app send them $1 million from Microsoft's bank account. Once other people are in the picture you can't always have your way.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#33

Post by rambambram »

CodesInChaos wrote: post #28
rambambram wrote: post #25

> linux desktop That's the only part I'm interested in. I've read this article - or something similar - before and it doesn't surprise me that these big tech companies want more control. What I don't understand is how this affects linux desktop? Is it going to be that online services or websites or webapps can choose to require attestation? Whether you use this OS or that OS? Or are linux developers forced to change…

It'll affect you the same way reCAPTCHA does. A website decides to use "Google Cloud Fraud", and locks you out if you don't complete the "challenges" it shows. Your OS doesn't matter at all.

Thanks! It was slightly confusing, now I get it.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#34

Post by jeroenhd »

realusername wrote: post #22
jeroenhd wrote: post #13

Earlier quoted context omitted.

App developers need to put effort into enabling these APIs so it's not like Google is actively blocking your favorite apps. Their makers are. Like with reCAPTCHA, there are other services and libraries out there to detect root access and other things companies want to detect in their apps.

Sure, Google was betting that bureaucratic companies would enroll voluntarily and it worked. > Like with reCAPTCHA, there are other services and libraries out there to detect root access and other things companies want to detect in their apps. My opinion on this is that any method to check integrity, root access or if developer mode is enabled is a security vulnerability by itself, no such app should be able to know…

> My opinion on this is that any method to check integrity, root access or if developer mode is enabled is a security vulnerability by itself, no such app should be able to know that.

I think knowledge of such information should be available to all apps, but I think apps should not be so annoyingly restrictive. There's absolutely no reason why games or generic apps need to act on any of this information.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#35

Post by jeroenhd »

charcircuit wrote: post #31
jeroenhd wrote: post #14

Earlier quoted context omitted.

Windows Hello offers an attestation API according to the releases I found, though because Microsoft has called at least four products "hello" now, I can't easily find the details. I don't think there's a technical reason why Google couldn't have released an app with a URL handler that uses that API except maybe for the Windows TPMs being less secure than mobile ones in general.

That attestation is for attesting you are using a TPM for user authentication. Which is different than attestation of integrity.

They do have some kind of attestation mechanism to actually attest the device state: https://learn.microsoft.com/en-us/azure/attestation/tpm-atte...

It seems like the documentation for the feature is aimed entirely at MDM setups, though.

The basic API requirements are all there, and Windows 11 requires TPM 2.0, so I believe it should be possible for Google to build a Play Integrity equivalent around that.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#36

Post by t_mahmood »

In recent r/Android update post, this is put at the very last, I believe this completely verifies that Google is implementing hardware attestation.

And, r/android being mostly google worshipers won't say anything, but also it's difficult to parse through such a huge ai generated post.

  New data isolation and verification tools

  Expanded Binary Transparency: Anyone can now verify that the critical software layers on their device were actually authorized by Google and haven't been secretly modified by attackers. We are publishing a public, append-only ledger that provides cryptographic proof that production Google applications and Mainline Modules are the authentic versions released by Google. If a Google-signed app isn’t on this ledger, we didn’t intend to release it.

  Android OS verification: We have seen some bad actors begin to distribute malicious, unofficial versions of the Android OS that secretly compromise device integrity. To combat this, we are introducing Android OS verification in Android 17. Launching initially on Pixel devices, this feature helps you verify that your device is running an official, widely distributed build.

  Keeping your ambient data confidential and isolated: Android 17 introduces AISeal with pKVM which, along with Private AI Compute, creates an isolated, verifiable, hardware-backed environment where ambient data can be processed securely

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#37

Post by realusername »

jeroenhd wrote: post #30
realusername wrote: post #23

Earlier quoted context omitted.

> "strong integrity" also takes into account if a security update has been installed recently enough. My Galaxy S10, last update in 2023 passes strong integrity. With the little amount of security updates most Android devices have, I'm pretty sure you can find an exploit for pretty much everything except the most expensive flagships. What does integrity really means when nobody really knows what's in the device and w…

The exact requirements for security updates depends on the Android version you're running and the one your device came with. From the docs: MEETS_STRONG_INTEGRITY The app is running on a genuine and certified Android device with a recent security update. On Android 13 and higher, the MEETS_STRONG_INTEGRITY verdict requires MEETS_DEVICE_INTEGRITY and security updates in the last year for all partitions of the device,…

I didn't know about this change, this is actually good news, it means no app can realistically rely on strong integrity as it will cut them from their user base.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#38

Post by realusername »

jeroenhd wrote: post #34
realusername wrote: post #22

Earlier quoted context omitted.

Sure, Google was betting that bureaucratic companies would enroll voluntarily and it worked. > Like with reCAPTCHA, there are other services and libraries out there to detect root access and other things companies want to detect in their apps. My opinion on this is that any method to check integrity, root access or if developer mode is enabled is a security vulnerability by itself, no such app should be able to know…

> My opinion on this is that any method to check integrity, root access or if developer mode is enabled is a security vulnerability by itself, no such app should be able to know that. I think knowledge of such information should be available to all apps, but I think apps should not be so annoyingly restrictive. There's absolutely no reason why games or generic apps need to act on any of this information.

Realistically, in which scenario this information can be useful? I can't think of anything, it should be removed.

It's been misused by banking app and games, I've never seen a legitimate use case.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#39

Post by RandomGerm4n »

charcircuit wrote: post #7
chadgpt3 wrote: post #5

Earlier quoted context omitted.

It's embarrassing for Hacker News that people here are commenting to support attestation systems that prevent you from owning the device you bought.

Attestation isn't against being able to do whatever you want with your own device. It just means that if you want other people to trust your custom device you need to get them to trust your signing key.

The intention behind it doesn't matter at all. In the end, it just means that only a few major operating systems are allowed, and the market is divided up among the established manufacturers. Anyone new to the market faces a major problem right off the bat, and trying to build something yourself doesn't work either.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#40

Post by charcircuit »

dns_snek wrote: post #18
charcircuit wrote: post #7

Earlier quoted context omitted.

Attestation isn't against being able to do whatever you want with your own device. It just means that if you want other people to trust your custom device you need to get them to trust your signing key.

Pray tell, how might you get them to trust your signing key? Do you just email Mr. Pichai and ask nicely, is that enough?

I would try reaching out to the Recaptcha team so you can create a legal contract around what guarantees and compensation are needed to get your key trusted.
Post reply on HN