Comment on Google Play’s latest security change may break many Android apps for some power users. The Play Integrity API uses hardware-backed signals that are trickier for rooted devices and custom ROMs to pass.

Ulrich@feddit.org ⁨1⁩ ⁨month⁩ ago

• seaQueue@lemmy.world ⁨1⁩ ⁨week⁩ ago

  Stares at rooted A13+ phone passing 2/3 integrity checks

  It’s possible, but it’s annoying.

  source

  • Ulrich@feddit.org ⁨1⁩ ⁨week⁩ ago

    Those are the wrong integrity checks

    source

    • seaQueue@lemmy.world ⁨1⁩ ⁨week⁩ ago

      No, they’re absolutely not. Check out tricky store to see how we’re faking a trusted environment on custom and rooted roms. You can pass new device integrity with a valid unrevoked keybox on A13+ and new strong on <A12.

      It’s a new stage in the arms race for sure but it’s still possible to bypass until all of the keys used to sign keyboxes are revoked.

      source
• Zwuzelmaus@feddit.org ⁨1⁩ ⁨month⁩ ago

  Troja has been impossible to conquer. Until.

  source