Device Integrity Attestation through the Browser

Chrome proposes developing a high-level document to capture use-cases and requirements for device attestation and other high-fidelity, low-entropy signals. This is a call for collaboration among interested members of the anti-fraud community group to identify important signals for Invalid Traffic (IVT) detection and other relevant security use cases. Many modern platforms have built-in tools to help differentiate legitimate and emulated devices. Android provides applications with the [Safety Net API](https://developer.android.com/training/safetynet) and Apple’s App Attest offers some of the same protections. By transmitting signals of legitimacy from the device’s platform, such as if the device is emulated or rooted, publishers and their technology partners could use this information in part to determine if traffic is invalid. They could then choose appropriate actions like flagging advertising actions as suspicious or requiring more information for sensitive actions like logins or financial transactions. These signals could be open for all websites to consume and could additionally facilitate a variety of other security use cases in a privacy compliant manner. We would like to forward the most useful integrity signals on each platform, and provide a unified representation to web sites and applications. There are many open questions in this area that we’d like to explore: 1. Would a platform signal attesting to the device’s legitimacy be a useful addition? 2. What integ

Posted by philippp on Apr 13, 2022, 10:28 PM

Tags

• github (SaaS)

Related issues

• 2026 - Microsoft Office 365
• [Ubuntu] `ubuntu-latest` label will use Ubuntu 26.04 in November 2026
• Gamut mapping
• [Codex Desktop] Editing and resending a queued message triggers "App-server queued follow-up no longer exists"
• [Windows] ChatGPT 26.820.60940 fails with "invalid transport in mcp_servers.codex_app"; Beta 26.727.40816 works
• [BUG]: infinite loading of videos