Play store warning to migrate to Play Integrity API: Critical issues for com.google.android.gms:play-services-safetynet:18.0.1

Question

We got a warning that we should migrate to Play Integrity API. We use only recaptcha from this dependency. In docs I didn't find anything in Play Integrity API which replaces recaptcha from safetynet. Do you have any idea what should we do in this case?

Ear

Answer 1

here's the final response from Google Play Developer Support after six months of waiting:

As per technical team, your intuition is correct. The SafetyNet Attestation API is different from the SafetyNet reCAPTCHA API. In this case, you can safely ignore the SafetyNet Attestation API's deprecation announcements.

Gera

Answer 2

You need to use 'com.google.android.gms:play-services-recaptcha' and remove safetynet unless you need any other api related to SafetyNet (in that case, you need Play Integrity API too)

This is about migrating to ReCaptcha Enterprise: https://cloud.google.com/recaptcha-enterprise/docs/migrate-recaptcha

And for you android code, some changes are needed for getting the token: https://cloud.google.com/recaptcha-enterprise/docs/instrument-android-apps

Essentially you need to call Recaptcha.getClient(activity).init(siteKey) and use the result in calling Recaptcha.getClient(activity).execute(handle, action).

Hughie

Thanks for information. Is there the only way? Because I see it like they force us to pay for that eventually. It says after 1M requests per month you are going to pay. I'm afraid that some cheaters can call functionality related to recaptcha a lot of times and we gonna pay for this. – Ear

No other ways as I know. Maybe you should prevent spamming the api by a client/backend throttle. – Hughie

Hi, recaptcha-enterprise requires min sdk version to be API 23: Android 6.0 (Marshmallow), I want to support my app from min sdk 19. Also there is no example available for 'com.google.android.gms:play-services-recaptcha', could be please share one example or sample code. Thanks! – Clarey

Here is an example for 'com.google.android.gms:play-services-recaptcha' cloud.google.com/recaptcha-enterprise/docs/… – Cordwood

What do you think this message is related to Recaptcha - isnt it a different product? – Velamen

@Velamen previously safetynet had recaptcha inside, now google decides to separate them. and the main functionality of safetynet has been moved to integrityapi. blame google for their message content. – Hughie

Answer 3

I would like to also add the response I received from GP Developer Support, to confirm Helen's response.

Thanks for contacting Google Play Developer Support.

Please note the two SafetyNet APIs are independent, and the Attestation API deprecation will not affect the reCAPTCHA API.

And if you are not actively using the SafetyNet Attestation API in your app, you can safely ignore the message or warning on the Play Console, and keep the SDK version being used in your app for other functionalities.

I hope this clarifies your concern! If you have any other questions about using the Play Console, please let me know and I’ll be happy to help.

Macegan

Answer 4

Following are the APIs provided in SafetyNet

• SafetyNet Attestation API
• SafetyNet Safe Browsing API
• SafetyNet reCAPTCHA API
• SafetyNet Verify Apps API

Only SafetyNet Attestation API is being deprecated, the remaining API are still working. We can also see the SafetyNet SDK is still being updated regularly.

https://developer.android.com/privacy-and-security/safetynet

You can see in More Information of each API present in the above link that only in Article of SafetyNet Attestation API, it's mentioned to be deprecated. In SafetyNet ReCAPTCHA API, nothing is mentioned as such.

I'm writing this even after above messages stating the response of Play Support because I spent my time trying to implement the First Accepted answer which was waste of time.

Recension