[spwa4]

> How could the attestation help here?

By proving that when the user clicked "Yes, I want this loan, $X deposited on amount Y" that is actually what was on the screen then the user clicked approve. In other words, that the agreement is actually what the REMOTE party believes it is, even if the owner installed "Free coins in the bunny casino v7.0.apk" from a website.

(meaning that is not currently very provable, and exploited by scammers quite a bit. Courts have a nasty irritating habit of holding the more powerful party (ie. the bank/government) responsible for the consequences of scammers' actions. Well, at least from the viewpoint of banks/governments that is a nasty habit)

[xorcist]

That is indeed the question: How does attestation help with proving that?

From my limited understanding, I can immediately think of a dozen ways to implement such an attack, and none would be helped by Google attesting that the device is indeed a legitimate Android(tm) device.

It is very hard to understand how this would make any difference juridically. The technical difficulties of avoiding phishing aside, contracts can be contested for a multitude of reasons, including contracts being signed involuntarily.