logoalt Hacker News

subscribedtoday at 1:55 PM1 replyview on HN

Okay, but Google certifies phones which are not updates for the last several years.

They can be trivially rooted, then they spoof the signature and get a pass in Integrity while being wide open for malware (or cooying the ID, ID presume).


Replies

pwlbtoday at 6:48 PM

The documentation clearly outlines that there are multiple signals being analysed. Relying on play integrity alone is definitely not sufficient as you state.