Mobile Privacy

App Attestation: What Your Phone Tells an App About Itself

July 31, 2026 10 min read Haven Team

Someone installs a banking app on a phone they have deliberately hardened, and the app refuses to start. The phone in question has verified boot enabled, a locked bootloader, faster security patches than the stock device, and a threat model its owner can describe in detail. The check it failed was never asking about any of that.


Device attestation is one of the more consequential pieces of mobile infrastructure that most users never see named. It runs on hundreds of millions of handsets, decides whether apps will function, and works exactly as designed. The friction comes from a gap between what it measures and what people assume it measures.

The problem it solves is real

A server talking to a mobile app has no way to know what is on the other end. The app could be the published binary. It could be a modified build with the fraud checks removed, an automated client pretending to be a phone, or an emulator farm creating accounts at scale. Every signal the client sends about itself can be forged by whoever controls the client.

Attestation breaks that loop by moving the claim to a party the server already trusts. Rather than the app asserting "I am genuine," a key held in hardware on the device signs a statement, and that signature chains up to a certificate from the platform vendor. The server verifies the chain. The assertion is now made by the hardware and the vendor rather than by the software being questioned.

This is the same primitive underneath verified boot and it relies on the same components: a key that software cannot extract, held in a trusted execution environment or a dedicated secure element.

The two implementations you will meet

On Android, the mechanism is the Play Integrity API, which succeeded and has now replaced the older SafetyNet Attestation. The app asks Google Play services for a token, sends it to the developer's backend, and the backend has it decoded and verified. The response is a set of verdicts rather than a single yes: whether the device appears to be a genuine Android device with an untampered boot state, whether the running binary matches the one distributed through Play, and whether the account holds a valid Play licence for it. Newer devices can supply hardware-backed signals rather than software ones.

On iOS, the equivalent is App Attest, part of the DeviceCheck framework. The app generates a key inside the Secure Enclave, Apple attests to that key, and the developer's server records the public key. Every later request can carry an assertion signed by that key, which gives the server continuity across sessions without a user account, plus a small amount of per-device state it can set and read.

Claim Attestation establishes it?
This token came from hardware the vendor recognises Yes
The running binary matches the distributed one Yes
The boot state is one the vendor considers standard Yes
The device is free of malware No
The user is not committing fraud No
The device is well configured or promptly patched No

Recognition is not the same measurement as security

The bottom three rows are where the friction lives. A device attestation verdict answers a question about conformance to an expected configuration. A phone running an unpatched stock build from three years ago, with a dozen preinstalled apps holding broad permissions, passes comfortably. A phone running a hardened alternative distribution with a locked bootloader and a stricter permission model may not, because its verified boot chain terminates in a key the verdict was not built to recognise.

That result is internally consistent. The check is asking whether the device is the configuration the vendor ships and vouches for, and the hardened phone is genuinely not that. The error is in reading the output as a security score, which is how it is typically presented to the user when an app declines to run and says the device is "not secure."

The verdict says: this is a device I recognise, running software I distributed. It does not say: this is a device that will keep your money safe.

The costs, stated plainly

There are three, and they are different in kind.

A third party enters every launch. Attestation requires contacting the platform vendor's service, so the vendor learns that this app requested a token on this device at this time. For most apps this changes little, since the vendor already distributes the app. For an app whose whole point is that few parties know you use it, the calculation is different, and it is one reason some privacy-oriented apps decline to adopt attestation at all.

App function becomes contingent on vendor services. An Android device without Google Play services cannot produce a Play Integrity token. Whether that device is in a region with limited service availability, is a de-Googled build, or is simply older, the app fails for a reason unrelated to anything the app is protecting against.

The decision about what runs on your computer moves. This is the largest one and the least discussed. A phone is a general-purpose computer that you own. Attestation, applied broadly, means the set of software configurations on which your bank, your transit pass, your employer's tools and your government identity app will operate is determined by a platform vendor rather than by you. The individual check is reasonable. The aggregate is a change in who controls a device you paid for, and Google has already announced plans to extend verification requirements to apps installed outside its store on certified devices, which pushes the same boundary further.

The asymmetry worth naming

Attestation is available to any developer with an account. It is not available to you. There is no supported way for a device owner to ask an app to attest that it has not been modified, or to prove which build a server is running. The primitive is deployed in exactly one direction.

Why WebAuthn made the opposite choice

The web platform has the same primitive and treats it with visible caution. In WebAuthn, an authenticator can attest to its own make and model when a credential is created. The specification warns about the privacy implications, browsers prompt or restrict it, most relying parties request none, and attestation certificates are deliberately shared across large batches of devices so that the statement identifies a model rather than a unit.

Two designs, one mechanism, opposite defaults. The web treats attestation as a specialised control for enterprises that genuinely need to restrict hardware, and assumes it is off. The mobile platforms treat it as a normal part of shipping an app. That divergence is not a technical fact about attestation. It is a decision about who the platform is built to serve, made twice, differently.

What you can actually do

Not a great deal per app, and it is worth being straightforward about that rather than offering a workaround that does not exist.

Attestation is a well-built answer to a genuine fraud problem, and the engineering is sound. Its root of trust is what determines the rest. Every question it can answer terminates at a platform vendor's certificate, which means every guarantee it offers is a statement about the vendor's relationship with your device rather than about your device. That is a perfectly good thing to know. It is just not the thing the error message says.

Try Haven free for 15 days

Encrypted email and chat in one app. No credit card required.

Get Started →