3 ms·
> Security isn’t binary, it’s about layers and probabilities. A truth frequently abused to excuse obviously bad practices. > A client that attests play integr
by Hizonner 2y ago
> Security isn’t binary, it’s about layers and probabilities.
A truth frequently abused to excuse obviously bad practices.
> A client that attests play integrity is less likely to be an attacker than one that isn’t.
A comfortable, yet completely unjustified, assumption.
- protimewaster 2y ago> A comfortable, yet completely unjustified, assumption. I agree. Knowledgeable users are passing Play Integrity on rooted devices. The idea that these knowledgeable users who are willing to bypass local security checks are more trustworthy than users who honestly fail the security test feels like a strange stance on security. If you want assurance that your code won't run on modified devices, don't let users run the code at all. Have them come into the bank branch and use hardware that you control.