3

In our project we're using safetynet for attestation, but we need to migrate project into google play integrity API because safetynet is deprecated. We're not using google play to distribute our app, so I need to link our app with project on google cloud.

Linking is available only with using google cloud project number which I need to pass with setCloudProjectNumber() method in my request.

And this is my doubt - linking app with google play integrity ONLY with google cloud project number. Not with using firebase, nor with generated api key from google cloud restricted to Google Play Integrity API. I noticed that using play integrity requests consume my requests daily limit (10000) to google play integrity API what I can check here.

My question is: Is this the only protection - knowing google cloud project number - to prevent using someone else's requests limit to google play integrity API?

I checked google documentation, but I cannot found information about requests limit protection. The only thing I found is a form to request Google for increase the limit - form.

Imo, I didn't understand something and Google Play Integrity service limit for my project is protected by something else, not only by number.

I tried to disconnect my app with firebase by using different package name, but my request limit was still consumed when I was sending requests to Google Play Integrity API.

wacsza
  • 31
  • 1
  • As far as I can tell the CloudProjectNumber is the only protection. Note, however, the integrity token can only be decoded with valid credentials for the API service of the Cloud Project used to generate the token. Decoding an IntegrityToken generated using a different CloudProjectNumber will fail. – Marcus Feb 15 '23 at 18:15
  • If you're concerned about denial of service due to a hacker consuming your quota, you may create a request to increase the quota, easily: Select "Google Play Integrity API" via "API" and click on the "Quotas" tab. Select the quota from the table and click on "EDIT Quotas" on the upper right hand side of the screen.A form will slide in were you can simply add the new value you wish to request. Note beyond, multiple requests from a single device at short time intervals will also be rejected by the GPI service - INTEGRITY_TOO_MANY_REQUESTS – Marcus Feb 15 '23 at 18:33

0 Answers0