This is begging for anti-competitive investigations, surely? It's explicit collusion between the largest mobile makers and key app-based services (e.g. gov services, communication tools, banking) to directly block any competing OS.
They're publicly agreeing that only users using their approved mobile devices are allowed to do banking, and competitors cannot. I'm not sure how much more clearly anti-competitive this could be.
In recent r/Android update post, this is put at the very last, I believe this completely verifies that Google is implementing hardware attestation.
And, r/android being mostly google worshipers won't say anything, but also it's difficult to parse through such a huge ai generated post.
New data isolation and verification tools
Expanded Binary Transparency: Anyone can now verify that the critical software layers on their device were actually authorized by Google and haven't been secretly modified by attackers. We are publishing a public, append-only ledger that provides cryptographic proof that production Google applications and Mainline Modules are the authentic versions released by Google. If a Google-signed app isn’t on this ledger, we didn’t intend to release it.
Android OS verification: We have seen some bad actors begin to distribute malicious, unofficial versions of the Android OS that secretly compromise device integrity. To combat this, we are introducing Android OS verification in Android 17. Launching initially on Pixel devices, this feature helps you verify that your device is running an official, widely distributed build.
Keeping your ambient data confidential and isolated: Android 17 introduces AISeal with pKVM which, along with Private AI Compute, creates an isolated, verifiable, hardware-backed environment where ambient data can be processed securely
That's the only part I'm interested in. I've read this article - or something similar - before and it doesn't surprise me that these big tech companies want more control. What I don't understand is how this affects linux desktop?
Is it going to be that online services or websites or webapps can choose to require attestation? Whether you use this OS or that OS? Or are linux developers forced to change their open source software?
It'll affect you the same way reCAPTCHA does. A website decides to use "Google Cloud Fraud", and locks you out if you don't complete the "challenges" it shows. Your OS doesn't matter at all.
I don't buy the anti bot argument. Cheap Android phones can be purchased for less than $40 and QR code scanning can be automated. Bot farms will evolve.
The only possible reason for this is to lock out the competition.
the only anticompetitive element I can think of is the way they pushed their scanning app to Android phones with Play Services. On IOS they're not in control but still able to launch an app (app snippets the feature is called, I think?) but on Android they themselves killed off Instant Apps because nobody used it. If one of Google's competitors like hCAPTCHA tries to do the same, they'll have more friction on Android than Google does.
When it comes to GrapheneOS, it's the website owners that decided to block those devices by using this service. There are other services that don't block those phones they can use instead.
That's the whole goal of the concept. Safetynet (the predecessor of Play Integrity) was developed to block CyanogenMod and then later used to block Huawei.
I am going to assume that this also destroys millions of AI agents and bot scrapers this time which is why some “AI Engineers” were complaining about this recently.
Well, this is how Google will kill all the scrapers on its search data.
> Fraud Defense leverages a sophisticated and adaptable risk analysis engine to shield against automated software. It is specifically designed to orchestrate trust for the agentic web, neutralizing malicious scrapers while welcoming legitimate AI agents.
I'm sure it'll block a whole bunch of awful scrapers but if Google doesn't hate a bot, it'll be able to pass.
Sounds like an anti-competitive play to build an AI moat. They'll introduce a sham "verification program" and only allow bots operated by entities large enough to sue them for anti-competitive conduct.
Does mass scraping need google for content discovery? Surely most sites contain a site map or index that would effectively self enumerate once you know the domain, which is more often than not publicly disclosed?
What matters is when websites put this new version of reCAPTCHA on their site, just like archive.is has done. Then the scrapers will have a hard time getting around that.
This one sounds less problematic for blind people than reCAPTCHA, which relied on a visual challenge. Especially since google or the screen reader software can easily add a browser extension that forwards the challenge to the phone removing the need for scanning a QR code.
The real problems with this technology are control (need a google approved phone) and privacy/tracking.
Blind people need to start suing at least in America the ADA is far easier to win against large companies than in the UK as the equality act is treated vastly weaker by judges than if someone presented a religion or race lawsuit.
America is the only place to take down big tech discrimination.
Smart glasses or apps like BeMyEyes can assist blind people through these flows. AI's visual understanding has progressed tremendously over the past couple decades.
Apple+Google got punished by the EU for non-competitive practices and now they offered to ordinary websites their most desired features: bot blocking and unavoidable user tracking across all devices and operating systems.
And if EU wants to sue, they'll have to sue each and every website that requires this, and they would loose, because there are no alternatives and even if there were, they would be just as bad.
If Windows wasn't so far behind Apple and the rest of the industry in regards to integrity APIs this wouldn't be necessary. It's embarrassing for Microsoft that someone needs to use a separate, more secure device since their security is so bad.
Attestation isn't against being able to do whatever you want with your own device. It just means that if you want other people to trust your custom device you need to get them to trust your signing key.
Windows Hello offers an attestation API according to the releases I found, though because Microsoft has called at least four products "hello" now, I can't easily find the details. I don't think there's a technical reason why Google couldn't have released an app with a URL handler that uses that API except maybe for the Windows TPMs being less secure than mobile ones in general.
"strong integrity" also takes into account if a security update has been installed recently enough. I don't believe hardware integrity spoofing has been accomplished on Android yet. Software integrity and compatibility with old hardware has been used to spoof device IDs and pretend a phone doesn't have the ability to do hardware attestation.
It's technically possible to exploit a kernel and get root access on a running device, of course, but the persistent root that is used most often will be detected by hardware integrity mechanisms. Exploit based root might be as well if it makes itself detectable enough.
This is begging for anti-competitive investigations, surely? It's explicit collusion between the largest mobile makers and key app-based services (e.g. gov services, communication tools, banking) to directly block any competing OS.
They're publicly agreeing that only users using their approved mobile devices are allowed to do banking, and competitors cannot. I'm not sure how much more clearly anti-competitive this could be.
I expect that once the infrastructure is in place then it will be co-opted by governments to enforce their control over the digital domain.
In recent r/Android update post, this is put at the very last, I believe this completely verifies that Google is implementing hardware attestation.
And, r/android being mostly google worshipers won't say anything, but also it's difficult to parse through such a huge ai generated post.
https://old.reddit.com/r/Android/comments/1tb8dxv/new_featur...
https://www.reddit.com/r/Android/comments/1tb8dxv/new_featur...
https://blog.google/security/whats-new-in-android-security-p...
> linux desktop
That's the only part I'm interested in. I've read this article - or something similar - before and it doesn't surprise me that these big tech companies want more control. What I don't understand is how this affects linux desktop?
Is it going to be that online services or websites or webapps can choose to require attestation? Whether you use this OS or that OS? Or are linux developers forced to change their open source software?
It'll affect you the same way reCAPTCHA does. A website decides to use "Google Cloud Fraud", and locks you out if you don't complete the "challenges" it shows. Your OS doesn't matter at all.
Thanks! It was slightly confusing, now I get it.
This is very bad. Google has truly become evil.
My only hope left is that the EU will step in and prevent this. At least in Europe.
I don't buy the anti bot argument. Cheap Android phones can be purchased for less than $40 and QR code scanning can be automated. Bot farms will evolve.
The only possible reason for this is to lock out the competition.
Aside from the horrendous privacy implications, is there a possible argument that this is anti-competitive?
the only anticompetitive element I can think of is the way they pushed their scanning app to Android phones with Play Services. On IOS they're not in control but still able to launch an app (app snippets the feature is called, I think?) but on Android they themselves killed off Instant Apps because nobody used it. If one of Google's competitors like hCAPTCHA tries to do the same, they'll have more friction on Android than Google does.
When it comes to GrapheneOS, it's the website owners that decided to block those devices by using this service. There are other services that don't block those phones they can use instead.
That's the whole goal of the concept. Safetynet (the predecessor of Play Integrity) was developed to block CyanogenMod and then later used to block Huawei.
App developers need to put effort into enabling these APIs so it's not like Google is actively blocking your favorite apps. Their makers are.
Like with reCAPTCHA, there are other services and libraries out there to detect root access and other things companies want to detect in their apps.
7 replies →
I am going to assume that this also destroys millions of AI agents and bot scrapers this time which is why some “AI Engineers” were complaining about this recently.
Well, this is how Google will kill all the scrapers on its search data.
Not entirely, Google's own page says:
> Fraud Defense leverages a sophisticated and adaptable risk analysis engine to shield against automated software. It is specifically designed to orchestrate trust for the agentic web, neutralizing malicious scrapers while welcoming legitimate AI agents.
I'm sure it'll block a whole bunch of awful scrapers but if Google doesn't hate a bot, it'll be able to pass.
Sounds like an anti-competitive play to build an AI moat. They'll introduce a sham "verification program" and only allow bots operated by entities large enough to sue them for anti-competitive conduct.
Does mass scraping need google for content discovery? Surely most sites contain a site map or index that would effectively self enumerate once you know the domain, which is more often than not publicly disclosed?
What matters is when websites put this new version of reCAPTCHA on their site, just like archive.is has done. Then the scrapers will have a hard time getting around that.
So fuck blind people I guess?
This one sounds less problematic for blind people than reCAPTCHA, which relied on a visual challenge. Especially since google or the screen reader software can easily add a browser extension that forwards the challenge to the phone removing the need for scanning a QR code.
The real problems with this technology are control (need a google approved phone) and privacy/tracking.
Blind people need to start suing at least in America the ADA is far easier to win against large companies than in the UK as the equality act is treated vastly weaker by judges than if someone presented a religion or race lawsuit.
America is the only place to take down big tech discrimination.
Smart glasses or apps like BeMyEyes can assist blind people through these flows. AI's visual understanding has progressed tremendously over the past couple decades.
1 reply →
That is a cost that our future authoritarian world leader has decided is more than acceptable.
So, let me see if I understand it:
Apple+Google got punished by the EU for non-competitive practices and now they offered to ordinary websites their most desired features: bot blocking and unavoidable user tracking across all devices and operating systems.
And if EU wants to sue, they'll have to sue each and every website that requires this, and they would loose, because there are no alternatives and even if there were, they would be just as bad.
Great job Google+Apple! I'm proud of you. /s
If Windows wasn't so far behind Apple and the rest of the industry in regards to integrity APIs this wouldn't be necessary. It's embarrassing for Microsoft that someone needs to use a separate, more secure device since their security is so bad.
It's embarrassing for Hacker News that people here are commenting to support attestation systems that prevent you from owning the device you bought.
Attestation isn't against being able to do whatever you want with your own device. It just means that if you want other people to trust your custom device you need to get them to trust your signing key.
7 replies →
Windows Hello offers an attestation API according to the releases I found, though because Microsoft has called at least four products "hello" now, I can't easily find the details. I don't think there's a technical reason why Google couldn't have released an app with a URL handler that uses that API except maybe for the Windows TPMs being less secure than mobile ones in general.
That attestation is for attesting you are using a TPM for user authentication. Which is different than attestation of integrity.
1 reply →
Integrity doesn't guarantee any security to your device, just that the device is same as from the factory. That's a common misconception.
"strong integrity" also takes into account if a security update has been installed recently enough. I don't believe hardware integrity spoofing has been accomplished on Android yet. Software integrity and compatibility with old hardware has been used to spoof device IDs and pretend a phone doesn't have the ability to do hardware attestation.
It's technically possible to exploit a kernel and get root access on a running device, of course, but the persistent root that is used most often will be detected by hardware integrity mechanisms. Exploit based root might be as well if it makes itself detectable enough.
8 replies →