mobile / attestation reference
reference only · the web cannot attest mobile
the off-browser axis: device + app attestation on android and ios, and the evasion + proxy vectors that attack them. there is no live self-probe and no harness data here, a web page has no path to a device's secure enclave or play services. this is a reading surface for the completeness of the picture.
reference as-of 2026-06-15
- android · attestation
- ios · attestation
- cross-surface · proxy
google play integrity api
android · attestation
mechanism
an app asks google play services to vouch for the request. play returns a signed verdict token covering three labels: device integrity (is this a genuine, uncompromised android device), app integrity (is this the unmodified play-distributed binary), and account/licensing. the app's server decrypts and verifies the token google-side, never trusting the client to self-report.
what it proves
that a request comes from a genuine play-certified device running the official app, not an emulator, a rooted device, or a repackaged apk. the binding is to play services + the device, not to anything the page's javascript can read.
attacked by
notes
supersedes safetynet attestation (deprecated, shutdown completing through 2024-2025). the strong-integrity label leans on hardware-backed key attestation (a key in the tee / strongbox), which raises the bar but is bypassable on compromised devices and via play-services hooking on rooted hardware. rate-limited and quota'd, so it is a gate, not a per-request stamp.
- confidence
- confirmed
- as-of
- 2026-06-15
go deeper
- → ai-agent detection the declared-agent attestation parallel: signed agents (web bot auth) vs hardware-backed device tokens.
- → network details where sdk-proxy networks surface: residential / mobile asn class on the transport axis.
- → velocity & device reputation the money lens: when a rented real device passes attestation, reputation and velocity are what is left.
go deeper
- → ai-agent detection the web-to-app collusion vector: an operator on web, an attested app on the same device, signals stitched.
- → network details the sdk-proxy axis: mobile traffic relayed to look residential, the transport reputation it inherits.
- → velocity & device-reputation attestation as the strongest device-reputation signal, where the off-browser axis meets the money lens.