According to Google SafetyNet documentation
The default quota allotment (per project) for calling the SafetyNet Attestation API is 10,000 requests per day across your user base.
Does it also count towards our daily limit when bad players create DDoS attacks of our app, where the users device does not result in a succesful SafetyNet response (ie. from rooted device or emulator) ?
What if it is a succesful request, like a real phone where attackers playback a recording of clicks which repeatebly resets app-data and navigates app to point where it contacts safetyNet?
We are trying to prevent abuse of our Phone number validation service, where it appears attackers have automated app-reset and click to phone-validation. I'm wondering if adding SafetyNet just gives another layer which becomes succeptible to DDoS attacks. We would prefer to avoid an annoying Captcha, if possible. If its a real device it has a unique hardware id, which we can use to prevent spam.
