Sorry, custom ROM fans: Google would rather have broken apps than insecure apps

Android’s openness as a platform is a bit of a double-edged sword. On one hand, that empowers users to explore apps from sources outside the Play Store, and even experiment with custom ROMs. But that also leaves developers of security-minded apps in a tricky position, as they don’t know if they can trust what other apps or even the operating system itself is communicating. That’s led to the development of frameworks like Play Integrity, an API that devs can use to ensure their apps are only running on “genuine” Android devices. But as more apps start enforcing Play Integrity checks, that’s causing some serious headaches for modders in the custom ROM community.

The idea of Play Integrity causing headaches for anyone running anything particularly custom is hardly new, and earlier this year we saw Google using the API to block access to sending RCS messages on custom ROMs — supposedly an effort to prevent spammers from sending automated texts. The most recent issue to surface concerns the multi-factor authentication app Authy, which (fresh off an embarrassing hack) just started enforcing Play Integrity checks, leading to reports of broken operation on GrapheneOS.

GrapheneOS’s community manager took the issue to X, confronting Google’s Shawn Willden, who works on Android’s hardware-backed security subsystems. Willden doesn’t mince words about the situation Play Integrity finds itself in with regards to custom ROMs, writing, “If it’s not an official OS, we have to assume it’s bad.”

That doesn’t mean that custom ROMs are dead, or that apps using Play Integrity will never have a chance to run on unofficial Android builds in the future. In fact, Willden expresses that his team and some Google management range from positive to enthusiastic about the idea of working on a process to certify third-party ROMs and get them passing Android’s Compatibility Test Suite. But the problem really seems to be interest — there just aren’t enough people using custom ROMs on their phones (and experiencing these problems with apps refusing to run due to Play Integrity checks) to be worth the time investment in putting together a program to work with the teams behind “high quality” ROMs and develop the sort of trust and relationships necessary to bring these projects in under the protection of Play Integrity.

While that’s a minor cop-out on Google’s part, the company’s approach here really does sound pragmatic. The vast majority of Android users are concerned with the integrity of their user experience on mainstream devices running mainstream software. Should community efforts instead focus on third-party developers themselves, and working with them to release apps that don’t insist on Play Integrity checks? There’s more than one way to go here, and if you’re curious we really recommend checking out the whole thread on X; it’s a fascinating look at the flaws that exist in the the current system (like insufficient checks on users running current software, letting them roll back to older code without this enforcement) for readers interested in the complete picture.