Android 17 will soon tell you whether your OS is legit

Google has brought plenty of security improvements to Android over the years, such as theft protection and scam detection. However, the company is now bringing another noteworthy security feature to Android 17.

Google has announced that it’s bringing an OS verification feature to Android 17. The company says it developed this feature in response to bad actors releasing modified versions of Android that look like the real deal.

“These malicious versions are created to deceive you by mimicking the official OS while secretly compromising the integrity of your device,” the company explains.

The company says Android OS verification will help you confirm that your device is indeed running an official, widely distributed Android build. A close look at an official screenshot (seen above) shows a menu displaying Play Protect status, bootloader status, and build number info. It also looks like you can verify your Android OS with another device, but Google didn’t reveal more details about this option.

Google says Android OS verification will initially launch on Pixel phones, ostensibly as part of the stable Android 17 release. So we’re guessing that other OEMs will gain this feature when they eventually release stable Android 17 on their devices too.

This seems like a pretty passive take on OS verification, but we do wonder what this means for custom ROMs and Android forks like GrapheneOS. This news also comes a couple of days after the GrapheneOS team criticized Google’s device verification systems, saying it could lock people into the company’s ecosystem.

Otherwise, Google also announced that it will offer a “public, append-only ledger” to provide cryptographical proof that Google’s Android apps and APIs are legitimate releases.

The company describes this as a “Source of Truth” that anyone can check:

If a Google-signed app isn’t on this ledger, we didn’t intend to release it. For Pixel users, this works with our existing Pixel System Image Transparency to prove that both the system itself and the apps running on it are official production software.

Either way, we’re glad that Google is bringing more security features to Android. We were a bit concerned this might adversely affect non-Google Android releases, and reached out to ask Google what OS verification means for custom ROMs and forks. The company tells us:

This feature provides transparency for users on Android certified devices and does not apply to custom ROMs or forks. Separately, developers use either Play Integrity API or Key Attestation for device transparency and making device trust decisions. Our goal is to empower users on certified devices with OS clarity without restricting the broader Android developer community.

That’s just what we were hoping to hear!

Updated to add Google’s response about custom ROMs and third-party devices.