Play Integrity after 2025

JollyRancher

dokmaistr
Contact Swiss elected officials. Especially any who have previously expressed dislike for Googles monopolistic practices.

Articulating that a government service should not require the approval of a foreign megacorp to work is generally not that hard.

As a private individual, bitching yo your elected officials is generally about the most you can do and it actually does work to some extent.

If one has more money to throw at the problem, lawsuits are your friend but consult with a local legal professional about that.

dokmaistr

JollyRancher thanks for your feedback and I agree with you.

For the sake of completeness: I forgot to mention that although the name suggest it is an official government service it is actually a service of the Swiss Post (postal service). There is no such government service available at this point in time.

schweizer

The Swiss government is aware oft the problem and they just launched their own unified login system based on FIDO2. It is called AGOV. A huge improvement IMO.
https://www.agov.admin.ch/
SwissID has such a bad reputation that I expect them to shut down the service once AGOV is established.

dokmaistr

schweizer thank you. I was not aware of AGOV. Just tried it out - works as expected. And yes, definitely a huge improvement.

Franco

I am reading the documentation of the Play Integrity API:
https://developer.android.com/google/play/integrity/improvements
https://android-developers.googleblog.com/2024/12/making-play-integrity-api-faster-resilient-private.html

I am not an Android developer, but understand that after May 2025, the test "Strong Integrity" will require security updates within the last year, and they expect a decrease of strong responses by 14.5%.

This change makes sense from security perspective, but I fear that it may encourage more developers to use the "strong integrity" test, which will impact us.

Existing integrations after May 2025: The improvements will go live for all integrations, with no developer work required.

Play Integrity API offers enhanced security signals, like the optional “meets-strong-integrity” and “meets-basic-integrity” responses in the device recognition verdict, to help you decide how much you trust the environment your app is running in. Now, we’re updating the “meets-strong-integrity” response to require a security update within the last year on devices running Android 13 and above.

Probably9857

we’re updating the “meets-strong-integrity” response to require a security update within the last year on devices running Android 13 and above.

Franco This change makes sense from security perspective

Only if devices running Android <13 will fail "strong integrity", but I don't believe that will be the case.

Franco I fear that it may encourage more developers to use the "strong integrity" test

IMO, it is more likely to have the opposite effect, because most developers don't want to prevent people from using their apps. Even banking apps.

These decisions are being made from a business perspective of being able to plausibly claim that they are following standard industry security practices, to avoid lawsuits/liability. But if security (or security theater) starts to interfere with profitability, that will change the calculus.

GrapheneOS

Franco This doesn't in any way negatively impact GrapheneOS or app compatibility with GrapheneOS. It would be a very good thing if the device integrity level didn't exist and there was only the strong integrity level since apps wouldn't be willing to use it due to reducing compatibility with stock OS devices. The device integrity level which exists entirely to ban using a non-stock OS or non-Google-certified hardware is the problem, not the strong integrity level. There are barely any apps using strong integrity and fewer apps will be willing to use it with a requirement that Android 13 and later devices have the bare minimum security patches backported to older releases from a year earlier. That's still hardly caring about security: up to 1 year without even applying the backported patches is a complete joke, but less of a complete joke than the existing lack of any standard.

Equal2024

Probably9857 IMO, it is more likely to have the opposite effect, because most developers don't want to prevent people from using their apps. Even banking apps.

This does check out with how old the lowest supported Android version is for some banking apps. But I do wonder if that is only incidental, or just because it's too hard to constantly increase the lowest-supported version through feature support. If given an easy way to restrict users to a security update in the past year...I wonder how many developers would take it.

It sure is insidious to tie this feature to Google OS verification in any case. This means that the Hardware Attestation API and Play Integrity API are not comparable anymore. Play Integrity meets-strong-integrity is more secure as it enforces a security update within the last 12 months, which I don't think the Hardware Attestation API does.

It seems likely the Play Integrity API will continue checking more and more things until there is no single API that competes with it.

@GrapheneOS I've now made an extraordinary statement without extraordinary knowledge about how the APIs work. Feel free to correct me, as I don't want to spread misinformation :)

Equal2024

(ignore my comment where I said because it's too hard to constantly increase the lowest-supported version through feature support. You just choose the SDK version you want to support; it's really easy. So banks seem to care about running on really old phones.

Viewpoint0232

GrapheneOS

Are there many apps checking for the "device integrity" or do you expect this to happen in the future?

LysolPionex

So far, the apps I've found that use it are:

SwiftKey keyboard (probably shouldn't use this anyway)
myQ (garage door app)
Nintendo Music
youcut video editor

Is there any way to "Spoof" a response to the requesting app?

FlyingStars_

LysolPionex Not possible in GrapheneOS

wuseman

LysolPionex SwiftKey keyboard (probably shouldn't use this anyway)

Swiftkey uses it? But... why?

Stewart

We can add the Yuka application, very popular in France, which uses Play Service Integrity and is not compatible with GOS.

teezeh

Add dott (Micromobility), too.