App attestation across iOS, Android and HarmonyOS: is it enough?

TL;DR: Native device attestation on iOS, Android, and HarmonyOS improves mobile trust but still leaves gaps around platform fragmentation, unsupported devices, embedded secrets, and advanced evasion, according to Approov. The practical shift is toward layered app attestation, attestation-gated secrets, and backend enforcement rather than a single device signal.

Editorial analysis by NHI Mgmt Group, based on content published by Approov: “Why Native Hardware Attestation Falls Short and How to Enhance It”.

Key questions

Q: What breaks when mobile attestation is treated as the only trust signal?

A: The control breaks at the point where the device signal is separated from secret custody and backend enforcement.

Q: Why do embedded API keys create risk even when attestation succeeds?

A: Because attestation proves something about the environment, not about whether the app binary contains extractable credentials.

Q: How can security teams measure whether mobile app attestation is working?

A: Look for blocked requests from repackaged clients, fewer anomalous device fingerprints, and lower success rates for scripted API abuse.

Practitioner guidance

• Replace embedded API keys with attestation-gated secret delivery Issue secrets only after a runtime trust decision succeeds, and keep them short-lived so the app binary never contains reusable backend credentials.
• Unify mobile trust policy across supported platforms Create one backend policy layer that consumes Android, iOS, and HarmonyOS attestation outputs instead of maintaining separate verdict handling in each integration path.
• Define explicit fallback rules for unsupported or low-assurance devices Document whether the app blocks, degrades, or uses an alternate verification path when GMS is absent, a TEE is unavailable, or the attestation tier is weak.

Bottom line: Native attestation improves confidence in mobile app requests, but it does not eliminate the need for secret custody, backend policy, and runtime validation.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →