4 ms·

Is it because the sandbox is bad and does not perfectly simulate the computing environment of a real device? Because to me it sounds like a cat and mouse game

• bilkow 2mo ago
  It's because of the Play Integrity API, which AFAIK runs downloaded binaries in the DroidGuard environment: https://en.wikipedia.org/wiki/Play_Integrity_API https://en.wikipedia.org/wiki/Play_Integrity_API The strongest levels require hardware key attestation (which, in my understanding, uses a certificate that's baked in secure hardware and signed by Google): - https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu... - https://developer.android.com/privacy-and-security/security-key-attestation https://developer.android.com/privacy-and-security/security-...
  • wolvoleo 2mo ago
    Still. It must be possible to extract such a key. Even hardware key storage is not 100% safe.
• lucianbr 2mo ago
  There is hardware attestation that prevents a perfect sandbox from being possible. Unless you know how to build a sandbox that can simulate a TPM with a key inside that only Google knows. Or something like that. I'm not an expert but there's plenty of information on the internet about this. It's definitely more than "the sandbox is buggy".