{"$schema": "https://raw.githubusercontent.com/guitaripod/wwdc-sessions/master/schema/transcript.schema.json", "id": "wwdc2026-201", "language": "eng", "source": "https://developer.apple.com/videos/play/wwdc2026/201", "wordCount": 2960, "segments": [{"start": 7.0, "text": "Hello, my name is Manthan,"}, {"start": 8.0, "text": "and I am an engineer on the Trust and Safety team."}, {"start": 11.0, "text": "Today, I will talk about how App Attest can help protect your apps and your users."}, {"start": 17.0, "text": "You built and distributed your app to function"}, {"start": 20.0, "text": "in a secure environment on Apple's platforms."}, {"start": 23.0, "text": "Fraudsters are always looking for ways to exploit your apps"}, {"start": 26.0, "text": "beyond their intended feature functionalities."}, {"start": 29.0, "text": "These may include attack scenarios where compromised copies of your app,"}, {"start": 33.0, "text": "serve valid looking requests to your server, gaining access to sensitive data."}, {"start": 38.0, "text": "Imagine, you've built a quiz proctoring app"}, {"start": 41.0, "text": "for students to take quizzes and submit answers."}, {"start": 43.0, "text": "A fraudster may reverse engineer your app"}, {"start": 46.0, "text": "to create a modified copy that submits falsified quiz responses to your server."}, {"start": 52.0, "text": "App Attest can help your server reject these types of requests"}, {"start": 56.0, "text": "from modified clients."}, {"start": 58.0, "text": "Or, modify your app to include content that you didn't ship."}, {"start": 63.0, "text": "By directly modifying compromised copies of your source code"}, {"start": 66.0, "text": "or related resource bundles, re-signing your app,"}, {"start": 70.0, "text": "and running a modified copy on the device."}, {"start": 73.0, "text": "Imagine, you have a dragon slayer game,"}, {"start": 76.0, "text": "and a fraudster has injected a cheat menu that boosts their abilities in your game."}, {"start": 81.0, "text": "This allows them to submit fraudulent scores to your server"}, {"start": 85.0, "text": "and rise up the leaderboard with a compromised copy of your game app."}, {"start": 90.0, "text": "App Attest is designed to address these types of threat scenarios."}, {"start": 94.0, "text": "I will start with what App Attest protects against,"}, {"start": 97.0, "text": "then walk through integration steps and best practices."}, {"start": 101.0, "text": "I'll flag some common pitfalls, and I'll wrap up with the fraud metric,"}, {"start": 105.0, "text": "a powerful tool for detecting suspicious attestation activity."}, {"start": 109.0, "text": "Starting with how App Attest can help protect your app."}, {"start": 113.0, "text": "App Attest can help ensure that your app is running on genuine Apple hardware."}, {"start": 119.0, "text": "It does this by issuing an attestation, which provides cryptographic proof"}, {"start": 124.0, "text": "about the validity of your app running on the user's device."}, {"start": 128.0, "text": "This can then be verified by your server"}, {"start": 130.0, "text": "and it gives you the assurance that your app is running on a secure Apple device."}, {"start": 135.0, "text": "Next, it helps make you aware of modifications to your App"}, {"start": 139.0, "text": "on the user's device."}, {"start": 141.0, "text": "App Attest surfaces information about the relying party,"}, {"start": 144.0, "text": "launch category, and bundle version associated with your app,"}, {"start": 149.0, "text": "all of which can help you determine if your app has been modified."}, {"start": 153.0, "text": "Your app is uniquely identified through a relying party identifier."}, {"start": 158.0, "text": "This is a concatenation of your Team Identifier from"}, {"start": 162.0, "text": "your Apple developer provisioning profile, and your app's bundle identifier."}, {"start": 166.0, "text": "Imagine a fraudster modifies your app,"}, {"start": 169.0, "text": "and re-signs it with a provisioning profile that does not match your Team Identifier."}, {"start": 175.0, "text": "App Attest surfaces your app identity on the user's device,"}, {"start": 179.0, "text": "allowing you to discover unauthorized modifications."}, {"start": 183.0, "text": "New in iOS 27,"}, {"start": 185.0, "text": "it highlights the launch validation category of your app on the user's device."}, {"start": 190.0, "text": "You may have distributed your app through the App Store,"}, {"start": 193.0, "text": "but observe App Attest indicating a TestFlight launch validation category."}, {"start": 198.0, "text": "It also identifies the bundle version for the version of the app that you ship."}, {"start": 203.0, "text": "If a fraudster re-signs your app with an updated bundle version"}, {"start": 207.0, "text": "that you are not aware of, this will be transparent through App Attest."}, {"start": 212.0, "text": "Lastly, you can secure payloads from your app to your server using App Attest."}, {"start": 217.0, "text": "App Attest can generate assertions"}, {"start": 220.0, "text": "using cryptographic properties from a previously issued attestation."}, {"start": 225.0, "text": "Your server can then verify the assertions on payloads from your app,"}, {"start": 229.0, "text": "ensuring that the payload was not tampered in transit."}, {"start": 234.0, "text": "With this guidance in mind,"}, {"start": 236.0, "text": "here's how App Attest works and how to adopt it."}, {"start": 240.0, "text": "I will go over each of the core parts of App Attest."}, {"start": 243.0, "text": "Starting with determining where App Attest is available."}, {"start": 248.0, "text": "App Attest is supported on all Apple platforms,"}, {"start": 251.0, "text": "including macOS 27 and higher, which was previously not supported."}, {"start": 256.0, "text": "While App Attest is available on all major Apple operating systems,"}, {"start": 261.0, "text": "it may not be available for use through all app types on these platforms."}, {"start": 266.0, "text": "Gate your usage of App Attest through the isSupported API"}, {"start": 269.0, "text": "from the App Attest framework."}, {"start": 271.0, "text": "For example, App Attest is available on Action and SSO app extensions,"}, {"start": 276.0, "text": "but not other types of app extensions."}, {"start": 279.0, "text": "You can also use the isSupported response as a fraud signal,"}, {"start": 282.0, "text": "incorporating it into your risk assessment."}, {"start": 285.0, "text": "If you've distributed your app on a supported platform"}, {"start": 288.0, "text": "but observe a spike in unsupported responses from a particular user,"}, {"start": 292.0, "text": "that may indicate tampering."}, {"start": 295.0, "text": "You should decide if the user should be allowed to proceed"}, {"start": 297.0, "text": "to use your app functions when App Attest is not supported."}, {"start": 301.0, "text": "Moving on to the first step in the App Attest workflow,"}, {"start": 304.0, "text": "which is generating a key ID."}, {"start": 307.0, "text": "Your app starts off by calling App Attest to generate a key ID."}, {"start": 312.0, "text": "App Attest creates a Secure Enclave-bound key pair on behalf of the app,"}, {"start": 318.0, "text": "where the private key resides in the Secure Enclave."}, {"start": 321.0, "text": "App Attest returns a hash of the public key to your app."}, {"start": 326.0, "text": "Your app then stores the key ID in the Keychain."}, {"start": 330.0, "text": "You should keep some best practices in mind when dealing with App Attest keys."}, {"start": 335.0, "text": "Generate 1 key per user for account-based apps"}, {"start": 338.0, "text": "or 1 key for your entire app on the user's device."}, {"start": 341.0, "text": "Do not share keys across your user population."}, {"start": 345.0, "text": "Use Keychain to store the key IDs generated by your app."}, {"start": 349.0, "text": "Key IDs last as long as the app is installed."}, {"start": 352.0, "text": "They survive app updates,"}, {"start": 354.0, "text": "but if the user reinstalls the app or restores their device,"}, {"start": 356.0, "text": "including from iCloud backup, the key is invalidated."}, {"start": 360.0, "text": "And keys are per-device, they don't sync across user devices."}, {"start": 365.0, "text": "That wraps up App Attest key generation."}, {"start": 367.0, "text": "These form the basis for attestations and assertions."}, {"start": 372.0, "text": "Now that your App has generated a key ID,"}, {"start": 374.0, "text": "it can request App Attest to attest the key."}, {"start": 378.0, "text": "Your app fetches the key ID from Keychain."}, {"start": 381.0, "text": "Your app requests your server to perform an attestation for the key ID."}, {"start": 386.0, "text": "Your server responds by vending a challenge to your app,"}, {"start": 390.0, "text": "to include in the attestation."}, {"start": 392.0, "text": "Your app calls the attestation API"}, {"start": 395.0, "text": "from the App Attest framework, providing the key ID and server challenge."}, {"start": 400.0, "text": "App Attest fetches the key pair for the key ID"}, {"start": 403.0, "text": "along with some attestation data from the device."}, {"start": 406.0, "text": "This attestation data is derived from the Secure Enclave,"}, {"start": 410.0, "text": "which contains a snapshot of the hardware properties of the device from boot."}, {"start": 415.0, "text": "It cannot be modified."}, {"start": 418.0, "text": "It initiates a server request to an Apple service"}, {"start": 421.0, "text": "which validates the device data, and returns an attestation."}, {"start": 425.0, "text": "App Attest returns the attestation object to your app."}, {"start": 429.0, "text": "Your app sends the attestation to your server."}, {"start": 432.0, "text": "Your server should validate the attestation,"}, {"start": 434.0, "text": "which we will get to next,"}, {"start": 436.0, "text": "save it, and associate it with the user of your app."}, {"start": 440.0, "text": "There are a few best practices to keep in mind"}, {"start": 443.0, "text": "when collecting and handling attestations."}, {"start": 446.0, "text": "It's important that your server control the initiation of an attestation."}, {"start": 450.0, "text": "This will help you ensure that your app stays within a safe"}, {"start": 453.0, "text": "requests-per-second upper bound."}, {"start": 456.0, "text": "Attestation failures can occur and your app should try again at some later time."}, {"start": 461.0, "text": "Implement an exponential back-off scheme to avoid hitting global rate limits."}, {"start": 465.0, "text": "You should not hard-code retry logic in your app"}, {"start": 468.0, "text": "to minimize uncontrollable spikes against the Apple attestation server."}, {"start": 473.0, "text": "Your app should collect the attestation outside of user flows."}, {"start": 477.0, "text": "Try to perform the attestation operation on a background task."}, {"start": 481.0, "text": "Finally, the attestation should always be validated by your server, and not the app."}, {"start": 486.0, "text": "If your app becomes compromised, it cannot be trusted for validating an attestation."}, {"start": 492.0, "text": "I will now go over the attestation itself,"}, {"start": 495.0, "text": "which is the object that is returned from the App Attest attestation API."}, {"start": 500.0, "text": "The attestation structure has three sections:"}, {"start": 503.0, "text": "format, attestation statement, and authenticator data."}, {"start": 507.0, "text": "The format is a fixed string that identifies the Apple anonymized attestation."}, {"start": 512.0, "text": "Next, the attestation statement"}, {"start": 514.0, "text": "embeds a cryptographic certificate chain and receipt."}, {"start": 518.0, "text": "The certificate chain"}, {"start": 519.0, "text": "proves that the attested key was generated on genuine Apple hardware."}, {"start": 524.0, "text": "Follow the Developer Documentation to validate the certificate chain,"}, {"start": 527.0, "text": "which contains the nonce, key ID,"}, {"start": 529.0, "text": "and your relying party identifier embedded in the leaf certificate."}, {"start": 534.0, "text": "On macOS 27 and later, a key access control property,"}, {"start": 538.0, "text": "known as the ACL Blob OID, is also included in the leaf certificate."}, {"start": 543.0, "text": "This represents the security conditions associated with the App Attest key,"}, {"start": 548.0, "text": "that were enforced by the Secure Enclave"}, {"start": 550.0, "text": "when the attestation was collected on the device."}, {"start": 553.0, "text": "The key access control property is available on all platforms,"}, {"start": 557.0, "text": "but is especially important on macOS."}, {"start": 560.0, "text": "On macOS, App Attest configures each generated key"}, {"start": 564.0, "text": "with a policy that requires full security mode and System Integrity Protection."}, {"start": 569.0, "text": "Full security mode ensures the highest level of security and verifies"}, {"start": 573.0, "text": "the integrity of the operating system on the user's device."}, {"start": 577.0, "text": "System Integrity Protection prevents the execution of unauthorized code"}, {"start": 581.0, "text": "and protects system paths."}, {"start": 583.0, "text": "These are both enabled by default on Mac devices."}, {"start": 587.0, "text": "By validating the key access control property,"}, {"start": 590.0, "text": "you can be sure of the security conditions that were enforced on the user's device."}, {"start": 595.0, "text": "The attestation statement also contains a receipt."}, {"start": 599.0, "text": "This is formatted similar to the App Store receipt, and you should follow"}, {"start": 602.0, "text": "the Developer Documentation for parsing this."}, {"start": 605.0, "text": "You should validate the relying party ID, attested key, and your server challenge"}, {"start": 609.0, "text": "that is contained in the receipt."}, {"start": 612.0, "text": "Your server should store this receipt for interfacing with the fraud metric."}, {"start": 616.0, "text": "Finally, the authenticator data"}, {"start": 619.0, "text": "identifies information about your app and the attestation."}, {"start": 623.0, "text": "Follow the Developer Documentation to unpack"}, {"start": 625.0, "text": "the authenticator data and validate its contents."}, {"start": 628.0, "text": "On iOS 27 and later,"}, {"start": 630.0, "text": "a new structure is appended to the end of the authenticator data, known as extensions"}, {"start": 635.0, "text": "It is formatted as per the web authentication standard"}, {"start": 639.0, "text": "for the authenticator model."}, {"start": 641.0, "text": "I will take a moment to talk about extensions"}, {"start": 643.0, "text": "and how your server should handle this section of the authenticator data."}, {"start": 647.0, "text": "Extensions describe additional security properties about your app"}, {"start": 651.0, "text": "that are collected on the device during the attestation process."}, {"start": 655.0, "text": "Two extension identifiers have been added,"}, {"start": 657.0, "text": "the launch validation category and bundle version."}, {"start": 661.0, "text": "The launch validation category"}, {"start": 662.0, "text": "helps you understand if your app is being executed in an unexpected environment."}, {"start": 667.0, "text": "The bundle version helps you confirm that a version of your app"}, {"start": 671.0, "text": "that you distributed, is running on the user's device."}, {"start": 675.0, "text": "You should monitor these properties, check for unexpected values,"}, {"start": 678.0, "text": "and factor them into your overall risk assessment for a user."}, {"start": 682.0, "text": "That's the attestation."}, {"start": 684.0, "text": "It is especially useful for detecting signs of tampering."}, {"start": 687.0, "text": "For example, you have a macOS app that is integrated with App Attest."}, {"start": 692.0, "text": "Consider a scenario where a fraudster disables System Integrity Protection."}, {"start": 698.0, "text": "They then modify your app, re-sign it with a different provisioning profile,"}, {"start": 702.0, "text": "and modify the App Attest framework in the system path."}, {"start": 706.0, "text": "The attestation received at your server will highlight the disabled"}, {"start": 710.0, "text": "System Integrity Protection state via the key access control property."}, {"start": 715.0, "text": "It may also include a modified Team Identifier,"}, {"start": 718.0, "text": "launch validation category, or bundle version."}, {"start": 721.0, "text": "Your server can reject communication with the modified copy of your app,"}, {"start": 726.0, "text": "and you can factor this into your risk assessment for the user."}, {"start": 730.0, "text": "Now that your server has validated the attestation and stored the public key,"}, {"start": 735.0, "text": "your app can use that attested key"}, {"start": 737.0, "text": "to secure ongoing communication via assertions."}, {"start": 741.0, "text": "Your app prepares itself to communicate some data with your server."}, {"start": 746.0, "text": "Your server vends a challenge to include in the payload from your app."}, {"start": 750.0, "text": "Your app fetches the key ID"}, {"start": 753.0, "text": "and calls the assertion API from the App Attest framework,"}, {"start": 756.0, "text": "providing the key ID and server challenge."}, {"start": 760.0, "text": "App Attest returns an encoded assertion object to your app."}, {"start": 764.0, "text": "Your app then embeds the assertion object into its payload"}, {"start": 768.0, "text": "and transmits the payload to your server."}, {"start": 771.0, "text": "Your server validates the assertion and accepts or rejects the payload contents."}, {"start": 776.0, "text": "As your app generates assertions,"}, {"start": 778.0, "text": "you should keep some important considerations in mind."}, {"start": 782.0, "text": "Generate them on demand as required."}, {"start": 785.0, "text": "Assertions are generated locally on the device"}, {"start": 787.0, "text": "and do not round-trip Apple servers."}, {"start": 790.0, "text": "They can be generated at the point in your app's lifecycle where you need them,"}, {"start": 794.0, "text": "to embed into your server payload."}, {"start": 797.0, "text": "Assertions have CPU impact."}, {"start": 799.0, "text": "Generating assertions involves performing cryptographic operations."}, {"start": 803.0, "text": "Be mindful of rapidly generating assertions"}, {"start": 805.0, "text": "or generating too many within your app lifecycle."}, {"start": 809.0, "text": "Your server should validate the counter property embedded within the assertion"}, {"start": 813.0, "text": "and ensure it is strictly increasing."}, {"start": 816.0, "text": "Your server should track the counter from the assertions associated with a user."}, {"start": 822.0, "text": "This provides anti-replay attack protections."}, {"start": 825.0, "text": "Each time your app embeds an assertion,"}, {"start": 827.0, "text": "the counter value in the assertion object should increase."}, {"start": 832.0, "text": "If you observe a steady or decreasing counter value,"}, {"start": 836.0, "text": "it may indicate a compromised copy of your app,"}, {"start": 839.0, "text": "that is unaware of the recorded counter value at your server."}, {"start": 844.0, "text": "Now, I will briefly talk about unpacking the assertion object."}, {"start": 847.0, "text": "The assertion is a structure that contains two sections:"}, {"start": 851.0, "text": "signature and authenticator data."}, {"start": 854.0, "text": "Follow the Developer Documentation"}, {"start": 856.0, "text": "to validate the signature using the authenticator data,"}, {"start": 859.0, "text": "server challenge, and public key from the attestation object."}, {"start": 863.0, "text": "Similar to the attestation,"}, {"start": 865.0, "text": "the authenticator data in the assertion object"}, {"start": 868.0, "text": "identifies information about your app at the time of assertion."}, {"start": 872.0, "text": "On iOS 27 and later,"}, {"start": 875.0, "text": "a new structure is appended to the end of the authenticator data,"}, {"start": 878.0, "text": "known as extensions."}, {"start": 881.0, "text": "It should be handled in the same way as the extensions"}, {"start": 884.0, "text": "in the attestation object's authenticator data."}, {"start": 887.0, "text": "That's the assertion and that wraps up the core parts of App Attest."}, {"start": 891.0, "text": "The assertion is especially useful for ensuring server requests"}, {"start": 895.0, "text": "from valid copies of your app."}, {"start": 898.0, "text": "Next up, some common pitfalls worth calling out."}, {"start": 902.0, "text": "Your server should cautiously handle"}, {"start": 904.0, "text": "suspicious activity scenarios from your app."}, {"start": 907.0, "text": "Consider the case of handling new attestations for an existing user."}, {"start": 912.0, "text": "Don't reject new keys outright as legitimate scenarios such as"}, {"start": 915.0, "text": "app reinstall or device restore can cause key rotation."}, {"start": 919.0, "text": "This also means"}, {"start": 920.0, "text": "do not invalidate keys from previous attestations for a user immediately."}, {"start": 925.0, "text": "Coupled with the fraud metric, your server's map of attestations"}, {"start": 928.0, "text": "for a user can be used as a fraud or abuse signal."}, {"start": 932.0, "text": "If your server rejects an attestation or assertion,"}, {"start": 935.0, "text": "your app should gracefully handle this."}, {"start": 938.0, "text": "Degrade functionality tied to App Attest for the user."}, {"start": 942.0, "text": "Allow limited access for the user with heightened monitoring."}, {"start": 946.0, "text": "Avoid blocking the user directly without a comprehensive risk assessment."}, {"start": 951.0, "text": "I will take a minute to highlight what I mean"}, {"start": 953.0, "text": "by a risk assessment for your users."}, {"start": 955.0, "text": "This will vary based on your business, the type of app you distribute,"}, {"start": 958.0, "text": "and the implications of potential fraud in your app."}, {"start": 962.0, "text": "If you suspect fraudulent activity for a user based on App Attest,"}, {"start": 965.0, "text": "follow your business' guidelines for user deactivation or suspension."}, {"start": 970.0, "text": "Remember, blocking users without proper evaluation can erode trust,"}, {"start": 974.0, "text": "and may impact legitimate users."}, {"start": 977.0, "text": "Always follow a well-defined risk assessment process."}, {"start": 981.0, "text": "You now have a broad and deep understanding"}, {"start": 983.0, "text": "of the core flows of App Attest, and how to best interact with them."}, {"start": 987.0, "text": "The last part of App Attest to cover is the fraud metric,"}, {"start": 990.0, "text": "a tool for detecting suspicious attestation activity."}, {"start": 995.0, "text": "A compromised device could still pass attestations and act as a broker,"}, {"start": 1000.0, "text": "by generating valid attestations on behalf of modified app instances"}, {"start": 1005.0, "text": "running on other devices."}, {"start": 1007.0, "text": "These modified apps can send compromised requests to your server."}, {"start": 1012.0, "text": "The fraud metric"}, {"start": 1013.0, "text": "provides an approximate count of unique attested keys"}, {"start": 1016.0, "text": "associated with your app, on a particular device over the past 30 days."}, {"start": 1022.0, "text": "You can use this as part of your risk assessment profile for a user,"}, {"start": 1025.0, "text": "by determining if they are associated with attestations"}, {"start": 1029.0, "text": "from a potentially-compromised device."}, {"start": 1032.0, "text": "The fraud metric is accessed between your server"}, {"start": 1035.0, "text": "and the App Attest data server."}, {"start": 1037.0, "text": "Your server retrieves the receipt from an attestation associated with a user."}, {"start": 1042.0, "text": "It then sends a POST request to the App Attest data server,"}, {"start": 1046.0, "text": "using the retrieved receipt."}, {"start": 1049.0, "text": "The data server then returns a receipt to your server,"}, {"start": 1052.0, "text": "containing the fraud metric, which you should use for subsequent receipt fetches."}, {"start": 1057.0, "text": "The receipt is structured similar to an App Store receipt."}, {"start": 1061.0, "text": "It has three sections:"}, {"start": 1062.0, "text": "a signature, certificate chain, and receipt payload."}, {"start": 1067.0, "text": "The signature signs the receipt payload."}, {"start": 1070.0, "text": "The certificate chain roots to the Apple certifying authority."}, {"start": 1074.0, "text": "The receipt payload contains information"}, {"start": 1076.0, "text": "about the attested key associated with the metric"}, {"start": 1079.0, "text": "and the fraud metric itself."}, {"start": 1081.0, "text": "Follow the Developer Documentation"}, {"start": 1082.0, "text": "to verify the different parts of this receipt payload."}, {"start": 1086.0, "text": "The risk metric field defines the fraud metric count."}, {"start": 1090.0, "text": "The receipt must also be refreshed."}, {"start": 1093.0, "text": "The not before field outlines the earliest point at which you can refresh it."}, {"start": 1098.0, "text": "The expiration time field describes when the receipt expires"}, {"start": 1101.0, "text": "and it can no longer be refreshed."}, {"start": 1104.0, "text": "Consider the following when working with the fraud metric."}, {"start": 1107.0, "text": "Any user steps that involve App Attest key rotation"}, {"start": 1111.0, "text": "will contribute to the fraud metric."}, {"start": 1113.0, "text": "For example, reinstalling the app or restoring the device"}, {"start": 1116.0, "text": "may force key generation and reattestation within your app."}, {"start": 1121.0, "text": "These can contribute to the fraud metric."}, {"start": 1123.0, "text": "Avoid using the fraud metric to block users from your app outright."}, {"start": 1127.0, "text": "Treat the fraud metric as a fraudulent activity investigation signal."}, {"start": 1132.0, "text": "You should monitor its value, analyze it for a baseline,"}, {"start": 1135.0, "text": "and identify spikes as indicators of suspicious activity."}, {"start": 1140.0, "text": "Now you have everything you need to protect your app's workflows with App Attest"}, {"start": 1144.0, "text": "keeping your users safe and your app secure."}, {"start": 1147.0, "text": "To continue your journey,"}, {"start": 1149.0, "text": "start off by re-building your app against the latest SDKs,"}, {"start": 1152.0, "text": "so you're accessing the latest features from the App Attest API."}, {"start": 1156.0, "text": "Identify areas of your app"}, {"start": 1158.0, "text": "that may benefit from the security of an attestation,"}, {"start": 1161.0, "text": "such as authentication flows, or sensitive payloads for premium content"}, {"start": 1166.0, "text": "that can be strengthened with assertions."}, {"start": 1168.0, "text": "Set up your server to validate attestations,"}, {"start": 1171.0, "text": "store receipts, and track assertion counters."}, {"start": 1174.0, "text": "Incorporate the fraud metric into your risk assessment pipeline"}, {"start": 1179.0, "text": "App Attest gives you the tools to verify your app's integrity,"}, {"start": 1182.0, "text": "secure the communication between your app and your server, and detect signs of fraud"}, {"start": 1187.0, "text": "all backed by the security of Apple hardware."}, {"start": 1190.0, "text": "Now go put these protections to work for your users."}, {"start": 1193.0, "text": "Thanks for watching!"}]}