3 ms·
Not doubting you, but were did you find that information? The only thing I see is "it’s built into devices running Android 7.0+" and I found that on multiple pa
by penagwin 8y ago
Not doubting you, but were did you find that information? The only thing I see is "it’s built into devices running Android 7.0+" and I found that on multiple pages.
As Android 7.0 is available to install on any device and I don't see anything about "certified android devices", I assume they mean ANY Android 7.0 device? Then again it only works with Google services atm, but I know you can sideload google play services so...
https://support.google.com/accounts/answer/6103523 https://support.google.com/accounts/answer/6103523
- lern_too_spel 8y agoAndroid 7 supports key attestation. https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation
- munchbunny 8y agoThat's great, but that doesn't actually guarantee that this new feature requires that the phone is using the hardware security module, just that you'd be able to prove if it it was. Don't get me wrong, it's still better than TOTP in many ways, but having the actual security coprocessor is a big distinction.
- lern_too_spel 8y agoThere is no practical difference. For people who need the security, this API can guarantee it.
- guelo 8y agoI just said I doubt it, I don't actually know. The combination of the Google web service and the android keystore api probably makes it at least difficult. But if you're running some custom compiled aosp code maybe it could be hacked.
- christiaanbrand 8y ago1. This functionality only works on Android devices having passed CDD (try it). 2. Titan M is leveraged on Pixel 3.