How Play Integrity Stops Devices That Don't Exist

on YouTube ↗39m

" summary

Cash App reports Play Integrity prevents roughly $150,000/week in fraud, blocks ~2% of daily sign-ups and drives 13% of login blocks by combining hardware-backed attestation (post–May 2025 chip-signed verdicts) with backend signals. Implementation uses weld token to action (hash amount, destination, id), short TTLs and de-dup caches, a conservative warm‑up/TTL quota strategy that holds ~98% token success, recent-device rhythm and app-access risk signals, and a ladder enforcement config (allow → shadow → step‑up → remediate → deny) stored server-side.

AI-written summary · about

" chapters (33)

1. 0:00Welcome
2. 1:24Meet the speaker
3. 2:05Reverse-engineering defenses
4. 3:05Play Integrity overview
5. 4:09Client as courier
6. 5:11Using Play Integrity APIs
7. 6:36Attestation types and strategies
8. 7:59Decoding verdicts and tiers
9. 9:44Hardware security patches
10. 10:50Hardware key attestation shift
11. 12:36Handling API failures
12. 13:41Avoiding quota traps
13. 15:50Introducing ghost: hollow
14. 17:58Catching hollow with attestation
15. 19:22Enforcement ladder for fraud
16. 21:30Introducing ghost: pickpocket
17. 22:36Binding tokens to actions
18. 24:45Preventing client-server drift
19. 26:11Summary: catching pickpocket
20. 26:31Introducing ghost: farm hand
21. 27:57Detecting farm hands
22. 29:25Using developer bits
23. 31:09Summary: catching farm hand
24. 31:29Introducing ghost: puppeteer
25. 32:11App access risk recovery
26. 33:35Compensating with verification
27. 34:17From device to session safety
28. 34:59Single enforcement ladder
29. 35:42Enforcement policy example
30. 36:24Why imperfect defenses
31. 36:44Google’s impact numbers
32. 37:49Attestation trust layer
33. 38:15Q&A

" related talks

• 32mTrust no one - Introducing the Play Integrity APIPietro Maggi · Droidcon London 2023
• 07mIntroducing Play Integrity API developer previewDom Elliott, Solène Maître · Google for Games Developer Summit 2021
• 19mSecurityMichael Reitblat, Steve Shillingford, Sanjit Singh Dang · Collision 2018
• 14mDemystifying attestationTodd Burner · Android Dev Summit 2022
• 26mAPI Abuse - Comprehension and PreventionDavid Stewart · Apidays Live Hong Kong 2020
• 26mProtecting games and players by fighting abuse and piracyDom Elliott · Playtime 2019
• 10mProtect your game's integrity on Google PlayDom Elliott · Google for Games Developer Summit 2020
• 31mPlatform Integrity: Lessons Learned in Protecting the Facebook PlatformJonathan Gross · Spam Fighting @Scale 2015