Could Newton begin to explain how this small device did all that? Although he invented calculus and explained both optics and gravity, he was never able to sort out chemistry from alchemy. So I think he would be flummoxed, and unable to come up with even the barest coherent outline of what this device was. It would be no different to him from an embodiment of the occult — something that was of great interest to him. It would be indistinguishable from magic. And remember, Newton was a really smart dude."
It’s a well designed page (except for the now usual atrocious low contrast Google text font) with lots of good information about this program. It really is a significant increase in security that ordinary users can choose to activate, and yes, it’s free (except for the cost of purchasing the required physical security keys, which are available from a variety of vendors).
But back to that question. Should you actually sign up for APP?
With the perception that security has no financial returns, coupled with the opinion that "nobody can stop the hackers, so why even bother", what can actually be done to get businesses to have an actual focus on security. The only "security" I see is mainly protection from "jailbreaking", so legal owners of a product can't use or upgrade their devices. True security from other attack vectors are all but ignored.
In fact, I have seen some development environments where someone doing -anything- about security would likely get the developer fired because it took time away from coding features dictated by marketing. I've seen environments where all code ran as root or System just because if the devs gave thought to any permission model at all, they would be tossed, and replaced by other devs who didn't care to "waste" their time on stuff like that.
One idea would be something similar to Underwriters Labs, except would grade products, perhaps with expanded standards above the "pass/fail" mark, such as Europe's "Sold Secure", or the "insurance lock" certification (which means that a security device is good enough for insurance companies to insure stuff secured by it.)
There are always calls for regulation, but with regulatory capture being at a high point, and previous regulations having few teeth, this may not be a real solution in the US. Is our main hope the new data privacy laws being enacted in Europe, China, and Russia which actually have heavy fines, as well as criminal prosecutions (i.e. execs going to jail)?
This especially applies to IoT devices where it is in their financial interest to make un-upgradable devices, forcing people to toss their 1.0 lightbulbs and buy 1.0.1 lightbulbs to fix a security issue, as opposed to making them secure in the first place, or having an upgrade mechanism.
Is there something that can actually be done about the general disinterest by companies to make secure products, or is this just the way life is now?
Rewarding the purchase, in particular, is an explicit and egregious elimination of any claim to fair play: "For example, if the player purchased a particular weapon, the microtransaction engine may match the player in a gameplay session in which the particular weapon is highly effective, giving the player an impression that the particular weapon was a good purchase. This may encourage the player to make future purchases to achieve similar gameplay results."