Apps should only resort to this if they're forced to do it. Root-based attestation provides minimal security and is easy to bypass. It's inherently insecure due to trusting the weakest security systems. A leaked key from the TEE/SE on any device can be used to spoof attestations for any device.
Play Integrity permits a device with years of missing security patches. It isn't a legitimate security feature. It checks for a device in compliance with Google's Android business model, not security.
GrapheneOS
npub123…g0ht5
2026-03-25 00:51:55 UTC
in reply to nevent1q…0ecn
Author Public Key
npub1235tem4hfn34edqh8hxfja9amty73998f0eagnuu4zm423s9e8ksdg0ht5Seen on
wss://relay.ditto.pubPublished at
2026-03-25 00:51:55 UTCEvent JSON
{
"id": "75044328af524eb9972f0411da693966882c9e1130ee22add6fea1a2a1595768",
"pubkey": "5468bceeb74ce35cb4173dcc9974bddac9e894a74bf3d44f9ca8b7554605c9ed",
"created_at": 1774399915,
"kind": 1,
"tags": [
[
"e",
"8d3bc1c8c97d385e0dbbd1d4f40b886a52c4ed4a594a0b9b65fcd65ed116e6bb",
"wss://relay.ditto.pub",
"reply"
],
[
"proxy",
"https://grapheneos.social/users/GrapheneOS/statuses/116287072829582212",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "Apps should only resort to this if they're forced to do it. Root-based attestation provides minimal security and is easy to bypass. It's inherently insecure due to trusting the weakest security systems. A leaked key from the TEE/SE on any device can be used to spoof attestations for any device.\n\nPlay Integrity permits a device with years of missing security patches. It isn't a legitimate security feature. It checks for a device in compliance with Google's Android business model, not security.",
"sig": "87e39557f0967ff21a9fea224681309fdadc494e997e20939579134a48268f4513a15b47bc9d5e40b2115eb735dab1d38ccfb65b6bfe18d5f771f41eb46ff40d"
}