41–50 of 74 posts
[dead]
Blind people need to start suing at least in America the ADA is far easier to win against large companies than in the UK as the equality act is treated vastly weaker by judges than if someone presented a religion or race lawsuit. America is the only place to take down big tech discrimination.
My only hope left is that the EU will step in and prevent this. At least in Europe.
They're publicly agreeing that only users using their approved mobile devices are allowed to do banking, and competitors cannot. I'm not sure how much more clearly anti-competitive this could be.
The only possible reason for this is to lock out the competition.
In recent r/Android update post, this is put at the very last, I believe this completely verifies that Google is implementing hardware attestation. And, r/android being mostly google worshipers won't say anything, but also it's difficult to parse through such a huge ai generated post. New data isolation and verification tools Expanded Binary Transparency: Anyone can now verify that the critical software layers on the…
[dead]
The real problems with this technology are control (need a google approved phone) and privacy/tracking.
Earlier quoted context omitted.
The exact requirements for security updates depends on the Android version you're running and the one your device came with. From the docs: MEETS_STRONG_INTEGRITY The app is running on a genuine and certified Android device with a recent security update. On Android 13 and higher, the MEETS_STRONG_INTEGRITY verdict requires MEETS_DEVICE_INTEGRITY and security updates in the last year for all partitions of the device,…
I didn't know about this change, this is actually good news, it means no app can realistically rely on strong integrity as it will cut them from their user base.
Also, there is still the DEVICE_INTEGRITY check that verifies the hardware side of things so if old devices have to be pushed, app developers still won't let you run their apps on LineageOS
Earlier quoted context omitted.
> My opinion on this is that any method to check integrity, root access or if developer mode is enabled is a security vulnerability by itself, no such app should be able to know that. I think knowledge of such information should be available to all apps, but I think apps should not be so annoyingly restrictive. There's absolutely no reason why games or generic apps need to act on any of this information.
Realistically, in which scenario this information can be useful? I can't think of anything, it should be removed. It's been misused by banking app and games, I've never seen a legitimate use case.
If I were a bank I wouldn't want to be on the hook for someone getting their bank account drained by the custom ROM someone downloaded from XDA.
Then there's the DRM thing, where copyright owners make companies like Netflix sign a document like "if you don't enforce strong DRM, you cannot serve our media". Their choice is either use DRM (which in turn uses integrity checking) or not serve you at all. As a user, you once again have the choice of "buy the box set" or "use a smartphone with a trusted OS".
There's also the corporate use case, companies have remote wipe capabilities for data integrity purposes and don't want their employees rooting phones.
Pokemon Go used it to check whether people were spoofing their location and ruining the game for others. They were especially assholish about it, but that should hardly be a surprise when Nintendo is involved at any part of the chain.
Any game with in-app purchases wants to verify that nobody messed with the APK to get paid content for free. It's almost a basic business requirement. Combining limited-lifetime remote attestation tokens with data fetch URLs means superweatherapp-patched-luckypatcher.apk on LineageOS will not be able to pretend to be the real app (GPlay on stock Android already offers app verification APIs).
In Google's case, "this is a physical device and not an emulator" is a strong signal that the user is not a bot pretending to be a human. In an age where CAPTCHAs are easier to solve for AI than they are for humans, that kind of verification is worth a lot.
I'm sure I'm missing a lot of use cases here, but the technology is useful. It's often used in apps and games I would never want to run on my phone anyway, except for banking apps perhaps.
Earlier quoted context omitted.
Pray tell, how might you get them to trust your signing key? Do you just email Mr. Pichai and ask nicely, is that enough?
I would try reaching out to the Recaptcha team so you can create a legal contract around what guarantees and compensation are needed to get your key trusted.