[flagged]
reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
61–70 of 74 posts
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#62Earlier quoted context omitted.
I, for one, like streaming apps enough that I don't want to go back to locked-down, expensive DVD players. The alternative to DRM isn't "no DRM", it's "no content". Integrity detection means criminals cannot just inject some code into an existing banking app APK and call it a day. The hacked app won't generate valid HTTPS calls when properly validated. You can still phish users, but instead of automated online phishi…
>I, for one, like streaming apps enough that I don't want to go back to locked-down, expensive DVD players. The alternative to DRM isn't "no DRM", it's "no content". that's a false dichotomy since piracy exists. Stop giving them money until their behavior changes. If it doesn't... oh well, you still get a better service.
> Stop giving them money until their behavior changes
I did, for the longest time, because none of the streaming platforms worked on Linux. Their behaviour did not change.
The tiniest sliver of a percentage of people who actually care about this aren't enough to move the needle for the multi billion dollar entertainment industry. The population at large is fine with DRM.
Piracy isn't even a better service at all. Almost nothing in my native language is available on pirate sites unless you pay more than the subscription service charges. Subtitles take three or four internet searches and sometimes aren't available at all. Audio tracks default to Russian or Italian or Spanish for English-language shows. I have set up a whole Rube Goldberg machine of radarr/sonarr/lidarr + bazarr + prowlarr + Deluge + Jellyfin to watch stuff and only after all that did piracy became slightly less of a bother.
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#63Earlier quoted context omitted.
That attestation is for attesting you are using a TPM for user authentication. Which is different than attestation of integrity.
They do have some kind of attestation mechanism to actually attest the device state: https://learn.microsoft.com/en-us/azure/attestation/tpm-atte... It seems like the documentation for the feature is aimed entirely at MDM setups, though. The basic API requirements are all there, and Windows 11 requires TPM 2.0, so I believe it should be possible for Google to build a Play Integrity equivalent around that.
It's a lot of work and outside of the scope of the Recaptcha team at Google to roll their own compared to a simple API like macOS has.
https://developer.apple.com/documentation/devicecheck/dcappa...
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#64Related:
Google Cloud fraud defense, the next evolution of reCAPTCHA
https://news.ycombinator.com/item?id=48039362
Google broke reCAPTCHA for de-googled Android users
https://news.ycombinator.com/item?id=48067119
Google Cloud Fraud Defence is just WEI repackaged
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#65Earlier quoted context omitted.
They do have some kind of attestation mechanism to actually attest the device state: https://learn.microsoft.com/en-us/azure/attestation/tpm-atte... It seems like the documentation for the feature is aimed entirely at MDM setups, though. The basic API requirements are all there, and Windows 11 requires TPM 2.0, so I believe it should be possible for Google to build a Play Integrity equivalent around that.
It's a lot of work and outside of the scope of the Recaptcha team at Google to roll their own compared to a simple API like macOS has. https://developer.apple.com/documentation/devicecheck/dcappa...
Definitely, Android/iOS/macOS are easy in comparison. But Google is a multi-billion dollar company, they can figure this out.
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#66Earlier quoted context omitted.
Not sure if you’re being deliberately obtuse, but a signing key means nothing by itself. What exactly do you think is being attested TO? Thats right: that the user can’t do what they want with their own device. Obviously your key wouldn’t be trusted if they could. There is no other conceivable purpose that attestation could serve.
There are many changes that are possible which do not harm the integrity of applications. >the user can’t do what they want with their own device In the same way the user can't make their device have the Microsoft Word app send them $1 million from Microsoft's bank account. Once other people are in the picture you can't always have your way.
> Attestation isn't against being able to do whatever you want with your own device.
“Prison isn’t against being able to go wherever you want.”
> There are many changes that are possible which do not harm the integrity of applications.
“Well there’s a lot of places you can go in prison, you just can’t leave.”
Uh-huh.
> In the same way the user can't make their device have the Microsoft Word app send them $1 million from Microsoft's bank account.
This is completely incoherent. You and I both know that a bank refusing to give away someone else’s money has nothing to do with being able to run whatever code and operating systems we want to on our own devices.
Obviously the decision happens on some remote server which would require a username and password to authorize. It doesn’t matter one bit what piece of code sent it over.
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#67Earlier quoted context omitted.
The exact requirements for security updates depends on the Android version you're running and the one your device came with. From the docs: MEETS_STRONG_INTEGRITY The app is running on a genuine and certified Android device with a recent security update. On Android 13 and higher, the MEETS_STRONG_INTEGRITY verdict requires MEETS_DEVICE_INTEGRITY and security updates in the last year for all partitions of the device,…
I didn't know about this change, this is actually good news, it means no app can realistically rely on strong integrity as it will cut them from their user base.
Attestation as a signal doesn't have to be used as a binary yes or no decision. Weaker integrity could result in lower rate limits for example.
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#68Earlier quoted context omitted.
Smart glasses or apps like BeMyEyes can assist blind people through these flows. AI's visual understanding has progressed tremendously over the past couple decades.
Requiring extra expenses is discrimination.
The expense is not paid toward the business and it is normal for assistive tools to be paid for.
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#69Earlier quoted context omitted.
There are many changes that are possible which do not harm the integrity of applications. >the user can’t do what they want with their own device In the same way the user can't make their device have the Microsoft Word app send them $1 million from Microsoft's bank account. Once other people are in the picture you can't always have your way.
> Attestation isn't against being able to do whatever you want with your own device. “Prison isn’t against being able to go wherever you want.” > There are many changes that are possible which do not harm the integrity of applications. “Well there’s a lot of places you can go in prison, you just can’t leave.” Uh-huh. > In the same way the user can't make their device have the Microsoft Word app send them $1 million f…
>“Prison isn’t against being able to go wherever you want.”
This isn't a good analogy since the user really able to do whatever they want with their computer. A better analogy is that. "You can go wherever you want, but if you are trespassing on other people's property they can report you to the police." Just because you have the freedom to go anywhere does not mean you are not accountable for your actions or that people should not be able to tell that you are trespassing.
>has nothing to do with being able to run whatever code and operating systems we want to on our own devices.
My point is that one's freedom of how they want one's computer to work does not mean they can force other people's server to run code they want. Microsoft is in control of what there servers do.
Re: reCAPTCHA Mobile Verification Is Bringing the Play Integrity API to Desktops
#70Earlier quoted context omitted.
It's a lot of work and outside of the scope of the Recaptcha team at Google to roll their own compared to a simple API like macOS has. https://developer.apple.com/documentation/devicecheck/dcappa...
Definitely, Android/iOS/macOS are easy in comparison. But Google is a multi-billion dollar company, they can figure this out.
And without Microsoft footing the bill either via building the API or paying Google to do it, I do not see it happening. Being a billion dollar company means nothing.