what is play integrity exactly?

m4ri0g

My understanding is that play integrity is forcing apps to be installed though the app store.
if i side load any app with play integrity using obtanium or aurora it would detect it was not installed from the play store and then as soon as i launch the app it will redirect me to google play (or fail if no sandboxed play services are installed.), requesting me to install the app from google play.

is there something more? if i install google play services sandbox, create a google account and connect to google and install the app will that bypass api integrity?

i read the api integrity documentation here:
https://developer.android.com/google/play/integrity/overview
notably the paragraph of Genuine Android device.. and in my understanding as long as the app is installed thorough google play. the app will work?
or is there something i am missing?

de0u

m4ri0g Play Integrity is a way for an app running on a device to cryptographically prove to a server that the app is running on top of an operating system that was signed by one of Google's partner companies and the OS has not been tampered with. Also, I think, that the app itself has not been tampered with.

GrapheneOS devices can't pass that test. Ironically, unsupported end-of-life devices running a stock OS, probably insecure, can pass that check.

Murcielago

de0u

I was wondering if potential collaboration with an OEM would allow GrapheneOS to pass Play Integrity API checks (if, for example, the OEM were to install GrapheneOS (+ Sandboxed Google Play) as its official Android operating system out of the box)?

secrec

It is an anti-competitive practice used by google to try to force everybody to use operating system images that they have authorized. Effectively, its Tivoization: https://en.wikipedia.org/wiki/Tivoization

DeletedUser69

secrec I absolutely love the last two posts and for me there is no chance in the world that I will ever download a Play Store version of an app ever again. I would rather go into the lengths of researching alternatives that will do what I want on my terms.

de0u

Murcielago I was wondering if potential collaboration with an OEM would allow GrapheneOS to pass Play Integrity API checks (if, for example, the OEM were to install GrapheneOS (+ Sandboxed Google Play) as its official Android operating system out of the box)?

Perhaps. But at the moment that is speculating on top of speculation. Do we know what OEM contracts with Google contain?

Murcielago

de0u

Thanks for the quick reply. I didn't want to speculate as much as I wanted to know in general whether something like this would be possible.

de0u

Murcielago What passes Play Integrity is 100% up to Google, at least unless/until some court or legislature intervenes. Tomorrow they could decide to phase out Play Integrity passing EOL devices of theirs and of partners, and arguably that would be appropriate. Also tomorrow Google could decide to pass GrapheneOS devices! It's a policy issue, not a technical issue.

If Google objected enough to some result of an OEM's relationship with GrapheneOS, they could apply leverage on that OEM (and others) via future contracts. It's really a policy issue, and maybe it's already covered by contracts.