Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

discuss.grapheneos.org

Post reply on HN
Print view View original

51–60 of 74 posts

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#51

Post by realusername »

jeroenhd wrote: post #48
realusername wrote: post #37

Earlier quoted context omitted.

I didn't know about this change, this is actually good news, it means no app can realistically rely on strong integrity as it will cut them from their user base.

I think you overestimate how far apps are willing to go for stupid reasons. Also, there is still the DEVICE_INTEGRITY check that verifies the hardware side of things so if old devices have to be pushed, app developers still won't let you run their apps on LineageOS

I'm sure they are stupid but they already have some trouble to justify to their customers that they can't run the app on Android 11 so phasing out actual brand new devices that customers have is going to go a bit too far for them.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#52

Post by realusername »

jeroenhd wrote: post #49
realusername wrote: post #38

Earlier quoted context omitted.

Realistically, in which scenario this information can be useful? I can't think of anything, it should be removed. It's been misused by banking app and games, I've never seen a legitimate use case.

To verify that the user or someone who had physical access to the device (border checks, etc.) hasn't messed with the firmware. If I were a bank I wouldn't want to be on the hook for someone getting their bank account drained by the custom ROM someone downloaded from XDA. Then there's the DRM thing, where copyright owners make companies like Netflix sign a document like "if you don't enforce strong DRM, you cannot se…

Then it's a matter of personal opinion, I would not count any of the ones you listed as valid.

Integrity doesn't prevent customers to download a fake banking app, DRMs should be legally banned to be honest (sorry/not sorry media companies) and passports are best in physical form.

For company usage, locking the bootloader accomplishes the same thing.

As for bots, it doesn't prevent bots as you have unmodified device farms on racks. It's actually how ad fraud is done at the moment, they don't bother modifying the devices.

Pushing integrity even more will just funnel even more money to this ad fraud mafia as they will have a new source of revenue.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#53

Post by jeroenhd »

realusername wrote: post #51
jeroenhd wrote: post #48

Earlier quoted context omitted.

I think you overestimate how far apps are willing to go for stupid reasons. Also, there is still the DEVICE_INTEGRITY check that verifies the hardware side of things so if old devices have to be pushed, app developers still won't let you run their apps on LineageOS

I'm sure they are stupid but they already have some trouble to justify to their customers that they can't run the app on Android 11 so phasing out actual brand new devices that customers have is going to go a bit too far for them.

Massive gaming companies have already started using TPMs + secure boot to detect and ban players. Anyone who upgraded to Windows 11 without compatible hardware or who was/is still using Windows 10 cannot play these games. That was a few years ago when Windows 10 was still around.

It has happened and it probably will happen again. The EU is working on a wallet app that will be legally equivalent to an ID card, I imagine they'll rather have people stick to their plastic ID rather than risk accepting identity theft.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#54

Post by worldofmatthew »

charcircuit wrote: post #41
worldofmatthew wrote: post #26

Earlier quoted context omitted.

Blind people need to start suing at least in America the ADA is far easier to win against large companies than in the UK as the equality act is treated vastly weaker by judges than if someone presented a religion or race lawsuit. America is the only place to take down big tech discrimination.

Smart glasses or apps like BeMyEyes can assist blind people through these flows. AI's visual understanding has progressed tremendously over the past couple decades.

Requiring extra expenses is discrimination.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#55

Post by jeroenhd »

realusername wrote: post #52
jeroenhd wrote: post #49

Earlier quoted context omitted.

To verify that the user or someone who had physical access to the device (border checks, etc.) hasn't messed with the firmware. If I were a bank I wouldn't want to be on the hook for someone getting their bank account drained by the custom ROM someone downloaded from XDA. Then there's the DRM thing, where copyright owners make companies like Netflix sign a document like "if you don't enforce strong DRM, you cannot se…

Then it's a matter of personal opinion, I would not count any of the ones you listed as valid. Integrity doesn't prevent customers to download a fake banking app, DRMs should be legally banned to be honest (sorry/not sorry media companies) and passports are best in physical form. For company usage, locking the bootloader accomplishes the same thing. As for bots, it doesn't prevent bots as you have unmodified device f…

I, for one, like streaming apps enough that I don't want to go back to locked-down, expensive DVD players. The alternative to DRM isn't "no DRM", it's "no content".

Integrity detection means criminals cannot just inject some code into an existing banking app APK and call it a day. The hacked app won't generate valid HTTPS calls when properly validated. You can still phish users, but instead of automated online phishing panels, you need someone with a physical phone copying everything the user enters. It significantly raises the bar for these criminals.

If this stuff wasn't available, we just wouldn't have a lot of useful apps that we do today. The technology itself isn't bad per se, but the combination of a lack of hardware manufacturer support (for doing things like locking down bootloaders), custom ROM support (because bootloaders aren't locked down anyway), and app developer interest (see the whole GrapheneOS story) are what causes problems. Restricting the technology because the companies you deal with are shit is a bad solution in my opinion, because if they are motivated to be shit, they will find other ways to be shit.

For instance, someone set up an alternative attestation company that's even worse than Apple and Google, and if it weren't for Play Integrity, they'd be making the APIs and whitelists instead of Google.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#56

Post by chaz6 »

pimterry wrote: post #43

This is begging for anti-competitive investigations, surely? It's explicit collusion between the largest mobile makers and key app-based services (e.g. gov services, communication tools, banking) to directly block any competing OS. They're publicly agreeing that only users using their approved mobile devices are allowed to do banking, and competitors cannot. I'm not sure how much more clearly anti-competitive this co…

I expect that once the infrastructure is in place then it will be co-opted by governments to enforce their control over the digital domain.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#57

Post by RandomGerm4n »

jeroenhd wrote: post #55
realusername wrote: post #52

Earlier quoted context omitted.

Then it's a matter of personal opinion, I would not count any of the ones you listed as valid. Integrity doesn't prevent customers to download a fake banking app, DRMs should be legally banned to be honest (sorry/not sorry media companies) and passports are best in physical form. For company usage, locking the bootloader accomplishes the same thing. As for bots, it doesn't prevent bots as you have unmodified device f…

I, for one, like streaming apps enough that I don't want to go back to locked-down, expensive DVD players. The alternative to DRM isn't "no DRM", it's "no content". Integrity detection means criminals cannot just inject some code into an existing banking app APK and call it a day. The hacked app won't generate valid HTTPS calls when properly validated. You can still phish users, but instead of automated online phishi…

> I, for one, like streaming apps enough that I don't want to go back to locked-down, expensive DVD players. The alternative to DRM isn't "no DRM", it's "no content".

That statement is simply not true. The demand for streaming services would still be there. There would simply be even more illegal alternatives than there already are, so companies would still be forced to offer movies and TV shows via streaming. They only have the choice between offering DRM-free content and making money, or making no money while people watch it anyway.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#58

Post by rvz »

hsbauauvhabzb wrote: post #20
rvz wrote: post #8

I am going to assume that this also destroys millions of AI agents and bot scrapers this time which is why some “AI Engineers” were complaining about this recently. Well, this is how Google will kill all the scrapers on its search data.

Does mass scraping need google for content discovery? Surely most sites contain a site map or index that would effectively self enumerate once you know the domain, which is more often than not publicly disclosed?

What matters is when websites put this new version of reCAPTCHA on their site, just like archive.is has done. Then the scrapers will have a hard time getting around that.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#59

Post by expedition32 »

jeroenhd wrote: post #34
realusername wrote: post #22

Earlier quoted context omitted.

Sure, Google was betting that bureaucratic companies would enroll voluntarily and it worked. > Like with reCAPTCHA, there are other services and libraries out there to detect root access and other things companies want to detect in their apps. My opinion on this is that any method to check integrity, root access or if developer mode is enabled is a security vulnerability by itself, no such app should be able to know…

> My opinion on this is that any method to check integrity, root access or if developer mode is enabled is a security vulnerability by itself, no such app should be able to know that. I think knowledge of such information should be available to all apps, but I think apps should not be so annoyingly restrictive. There's absolutely no reason why games or generic apps need to act on any of this information.

I advised my mother to do her banking on her phone instead of laptop.

Hardware attestation kills privacy- yes. But it also works.

Mobile phones are ridiculously locked down compared to legacy platforms such as Windows.

Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops

#60

Post by ShowalkKama »

jeroenhd wrote: post #55
realusername wrote: post #52

Earlier quoted context omitted.

Then it's a matter of personal opinion, I would not count any of the ones you listed as valid. Integrity doesn't prevent customers to download a fake banking app, DRMs should be legally banned to be honest (sorry/not sorry media companies) and passports are best in physical form. For company usage, locking the bootloader accomplishes the same thing. As for bots, it doesn't prevent bots as you have unmodified device f…

I, for one, like streaming apps enough that I don't want to go back to locked-down, expensive DVD players. The alternative to DRM isn't "no DRM", it's "no content". Integrity detection means criminals cannot just inject some code into an existing banking app APK and call it a day. The hacked app won't generate valid HTTPS calls when properly validated. You can still phish users, but instead of automated online phishi…

>I, for one, like streaming apps enough that I don't want to go back to locked-down, expensive DVD players. The alternative to DRM isn't "no DRM", it's "no content".

that's a false dichotomy since piracy exists. Stop giving them money until their behavior changes. If it doesn't... oh well, you still get a better service.

Post reply on HN