IndiaAIFounders — Client-side root/tamper detection — is server-side attestation actually standard now, or is everyone still just checking Build.TAGS?

Been going through our app's integrity checks and realized most of what we have is still the old client-side stuff — checking `Build.TAGS` for test-keys, looking for `su` binaries, checking known root package names. All of which Frida can hook around in about five minutes if someone actually wants to bypass it.

Curious what people are actually running in production in 2026. Anyone fully moved to Play Integrity API with server-side verdict checking? What was the migration pain — I'm mostly worried about false positives on rooted-but-legitimate power users, and how much complexity nonce binding adds to a normal auth flow.

Not looking for a lecture on "client-side checks are theater" — I know. Looking for what people actually shipped and what broke.

submitted by /u/yogirana5557
[link] [comments]

Shown as published in the source's RSS feed. IndiaAIFounders doesn't link out to third-party sites — this is the complete detail available from the feed itself.