Play Integrity after 2025

[deleted]

What will happen after 2025 January, when SafetyNet is shut down completely?

https://developer.android.com/privacy-and-security/safetynet/deprecation-timeline

Will most apps using SafetyNet migrate over to Play Integrity?

AlphaElwedritsch

Who can seriously answer this question?

[deleted]

AlphaElwedritsch People familiar with app development.

Murcielago

The following contributions are about a year old but (hopefully) still valid:

The vast majority of apps check only whether the phone meets basic integrity in the Play Integrity API, if at all, which GrapheneOS passes. Therefore, the vast majority of apps work fine on GrapheneOS.

source: https://discuss.grapheneos.org/d/6361-play-integrity-api-and-future-of-grapheneos/2

and

Keep in mind that Play Integrity API is essentially the evolution of, and replacement for SafetyNet. Apps have had the ability to block out non-Stock OSes for years, this isn't really something new. Only a minority of apps will realistically use this to block non-Stock OSes, as they did with SafetyNet. I don't think much will change in the quantity of apps opting for this.

source: https://discuss.grapheneos.org/d/6361-play-integrity-api-and-future-of-grapheneos/5

Stewart

This crap that Google wants to launch doesn't go against the European RGPD, will it kill alternative OS?

zzz

See also from the official GOS mastodon account:

Google can either permit GrapheneOS in the Play Integrity API in the near future via the approach documented at https://grapheneos.org/articles/attestation-compatibility-guide or we'll be taking legal action against them and their partners. We've started the process of talking to regulators and they're interested.

https://grapheneos.social/@GrapheneOS/112878070618462132

https://discuss.grapheneos.org/d/14585-action-against-google

dokmaistr

Here is an example of the App SwissID which has Play Integrity enforced: https://nowtransfer.de/f9a5b2219083

I tried it on secondary profile with Google Services enabled but not logged in.

The German text translates (via deepl) into:
"Device appears to be insecure

The integrity algorithm of Google Play Integrity algorithm indicates that your device and/or operating system does not meet our security requirements.

We recommend that you run the SwissID app on another device.

If you believe that this is an error, please is a mistake, please contact customer service.

Please note Rooted Android devices and certain operating systems, e.g. GrapheneOS, do not pass the Google Play integration check."

So it is explicitly stated that GrapheneOS is blocked due to the Google Play Integrity algorithm.

JollyRancher

dokmaistr
Contact Swiss elected officials. Especially any who have previously expressed dislike for Googles monopolistic practices.

Articulating that a government service should not require the approval of a foreign megacorp to work is generally not that hard.

As a private individual, bitching yo your elected officials is generally about the most you can do and it actually does work to some extent.

If one has more money to throw at the problem, lawsuits are your friend but consult with a local legal professional about that.

dokmaistr

JollyRancher thanks for your feedback and I agree with you.

For the sake of completeness: I forgot to mention that although the name suggest it is an official government service it is actually a service of the Swiss Post (postal service). There is no such government service available at this point in time.

schweizer

The Swiss government is aware oft the problem and they just launched their own unified login system based on FIDO2. It is called AGOV. A huge improvement IMO.
https://www.agov.admin.ch/
SwissID has such a bad reputation that I expect them to shut down the service once AGOV is established.

dokmaistr

schweizer thank you. I was not aware of AGOV. Just tried it out - works as expected. And yes, definitely a huge improvement.

Franco

I am reading the documentation of the Play Integrity API:
https://developer.android.com/google/play/integrity/improvements
https://android-developers.googleblog.com/2024/12/making-play-integrity-api-faster-resilient-private.html

I am not an Android developer, but understand that after May 2025, the test "Strong Integrity" will require security updates within the last year, and they expect a decrease of strong responses by 14.5%.

This change makes sense from security perspective, but I fear that it may encourage more developers to use the "strong integrity" test, which will impact us.

Existing integrations after May 2025: The improvements will go live for all integrations, with no developer work required.

Play Integrity API offers enhanced security signals, like the optional “meets-strong-integrity” and “meets-basic-integrity” responses in the device recognition verdict, to help you decide how much you trust the environment your app is running in. Now, we’re updating the “meets-strong-integrity” response to require a security update within the last year on devices running Android 13 and above.

Probably9857

we’re updating the “meets-strong-integrity” response to require a security update within the last year on devices running Android 13 and above.

Franco This change makes sense from security perspective

Only if devices running Android <13 will fail "strong integrity", but I don't believe that will be the case.

Franco I fear that it may encourage more developers to use the "strong integrity" test

IMO, it is more likely to have the opposite effect, because most developers don't want to prevent people from using their apps. Even banking apps.

These decisions are being made from a business perspective of being able to plausibly claim that they are following standard industry security practices, to avoid lawsuits/liability. But if security (or security theater) starts to interfere with profitability, that will change the calculus.

GrapheneOS

Franco This doesn't in any way negatively impact GrapheneOS or app compatibility with GrapheneOS. It would be a very good thing if the device integrity level didn't exist and there was only the strong integrity level since apps wouldn't be willing to use it due to reducing compatibility with stock OS devices. The device integrity level which exists entirely to ban using a non-stock OS or non-Google-certified hardware is the problem, not the strong integrity level. There are barely any apps using strong integrity and fewer apps will be willing to use it with a requirement that Android 13 and later devices have the bare minimum security patches backported to older releases from a year earlier. That's still hardly caring about security: up to 1 year without even applying the backported patches is a complete joke, but less of a complete joke than the existing lack of any standard.

Equal2024

Probably9857 IMO, it is more likely to have the opposite effect, because most developers don't want to prevent people from using their apps. Even banking apps.

This does check out with how old the lowest supported Android version is for some banking apps. But I do wonder if that is only incidental, or just because it's too hard to constantly increase the lowest-supported version through feature support. If given an easy way to restrict users to a security update in the past year...I wonder how many developers would take it.

It sure is insidious to tie this feature to Google OS verification in any case. This means that the Hardware Attestation API and Play Integrity API are not comparable anymore. Play Integrity meets-strong-integrity is more secure as it enforces a security update within the last 12 months, which I don't think the Hardware Attestation API does.

It seems likely the Play Integrity API will continue checking more and more things until there is no single API that competes with it.

@GrapheneOS I've now made an extraordinary statement without extraordinary knowledge about how the APIs work. Feel free to correct me, as I don't want to spread misinformation :)

Equal2024

(ignore my comment where I said because it's too hard to constantly increase the lowest-supported version through feature support. You just choose the SDK version you want to support; it's really easy. So banks seem to care about running on really old phones.

Viewpoint0232

GrapheneOS

Are there many apps checking for the "device integrity" or do you expect this to happen in the future?

LysolPionex

So far, the apps I've found that use it are:

SwiftKey keyboard (probably shouldn't use this anyway)
myQ (garage door app)
Nintendo Music
youcut video editor

Is there any way to "Spoof" a response to the requesting app?