When Authentication Moved to Hardware

For years, when a website tightened its defenses, we'd adapt. Better session management. Smarter request patterns. More sophisticated timing. Code could always get better.

Then in May 2025, it couldn't.

Google made hardware attestation mandatory for all Android 13+ devices. Apps without cryptographic proof from trusted hardware would fail integrity checks. Apple had already moved iOS toward Private Access Tokens backed by Secure Enclave. Software-based authentication was over. Hardware attestation became the baseline.

We hit this threshold in our infrastructure before most organizations realized it was coming.

The Ceiling

We'd seen sites tighten defenses before. Usually it meant refining our approach—adjusting timing, improving session handling, optimizing request patterns. This time, our refinements didn't matter.

Sites that had accepted our automation for months suddenly didn't. Not gradually, with warning patterns we could optimize around. Just... stopped.

The Play Integrity API replaced SafetyNet entirely in January 2025. By May, any Android automation without genuine hardware was locked out.

Hardware attestation works through cryptographic tokens generated by specialized chips—Apple's Secure Enclave, Android's Platform Key Attestation. These tokens prove a device is genuine and unmodified. You either have the cryptographic keys provisioned in trusted hardware, or you don't. No amount of clever software can approximate this.

Virtual machines can't generate valid attestation. Emulators fail integrity checks. The infrastructure that worked when authentication was behavioral—spinning up cloud instances, optimizing software—hits a wall when authentication requires genuine hardware.

Crossing the Threshold

Some sites moved to hardware attestation gradually. Others flipped overnight. We'd have workflows that worked Monday and failed Tuesday, not because our code changed, but because the authentication model underneath us did.

The operational challenge became managing physical device inventory:

• Recent iPhones with current security patches
• Android 13+ phones with security updates within the last year
• Device pools sized for rate limits, not just throughput
• Hardware distributed across geographic regions with compliant attestation keys

The Play Integrity API's MEETS_STRONG_INTEGRITY verdict requires security updates within the last year. Device provisioning became infrastructure.

Cost structures shifted completely. Software scales cheaply. Hardware doesn't. Each automation workflow needs genuine devices, and those devices have physical constraints.

iOS 16 limits attestation token generation to once per minute. High-frequency operations require device pools sized for rate limits, not throughput. The math changes entirely.

Geographic distribution means something different now. Attestation keys vary by region. Devices need recent security updates. Maintaining compliant hardware across markets becomes the operational reality, not an optimization problem.

The efficiency gains are real. Google's hardware attestation update reduced device signal collection by ~90% and sped up verification by ~80%. But accessing that efficiency requires genuine hardware. The optimization happens at the platform level, not in your code.

The Approximation Ceiling

As more verification moves to cryptographic proof—identity, payment, access control—the infrastructure requirements will follow the same pattern. The web is establishing a new baseline: genuine hardware, cryptographic proof, no software workarounds.

For web automation, this marks the end of purely software-based solutions. The mandatory cutover dates are already here. Organizations building on web automation need to understand this isn't a temporary challenge to optimize around. It's the new foundation.

We're navigating this threshold in production. Some inflection points can't be smoothed over with better code. Hardware attestation changes what infrastructure must look like to operate reliably at scale. The web stopped accepting software approximations. Now it requires genuine hardware.

That requirement changes the economics, the architecture, the operational model. Everything that comes after builds on this new foundation.