4 ms·

I was quite happy to use LineageOS for my Nexus 5X and it worked great up to the point where my bootloader was now unlocked and certain apps, like for the bank

I was quite happy to use LineageOS for my Nexus 5X and it worked great up to the point where my bootloader was now unlocked and certain apps, like for the bank or remote access apps, did not work anymore, as they considered the device unsecure. Do other phones allow you to flash the bootloader checksum, so you can lock it again?

mehdix 7y ago
Make sure to check out Magisk.
h4waii 7y ago
There are a few AVB 2.0 devices that will allow this, including the Pixel series, and the OnePlus 5T, but it can be risky. GrapheneOS works seamlessly with it, allowing you to relock the bootloader and only accept signed-OTA updates. You may be interested in the Magisk [0] project which allows your device to pass Google's "SafetyNet" and present as an unmodified device to apps using that API to detect if they should refuse to run for "security" reasons. 0. https://github.com/topjohnwu/Magisk https://github.com/topjohnwu/Magisk
- zozbot234 7y ago
  Note that Google SafetyNet is now (as of mid-March 2020) requiring hardware-based remote attestation in order to pass their "CTS" check. This check will fail if the bootloader is not in its default "locked" state, and cannot be feasibly bypassed by Magisk. https://github.com/topjohnwu/magisk_files/blob/master/notes.md https://github.com/topjohnwu/magisk_files/blob/master/notes.... Magisk (and even its 'hide' component) will still be useful for many purposes, but we should not be expecting it to pass all such "safety" checks.
ppseafield 7y ago
As a sibling comment suggested, using Magisk Hide lets you conceal your rooted status from those apps. Had this happen with my banking apps, and can confirm (on my Nexus 5x) that Magisk Hide did allow me to use those apps. As for reflashing, you have to have a copy of the original image, for the device which you can download from various places, but once you have it, you may reflash it back to factory and relock.
neurostimulant 7y ago
Aren't those banking apps usually simply check whether root is available on the device and bail if they found it? You might be able to circumvent it using magisk to hide root, or simply don't install root support when installing lineageos (that's what I do as I don't need root anymore these days, and I haven't found any app that complains about insecure rom yet, Safetynet status is also passed).

mehdix 7y ago

Make sure to check out Magisk.

h4waii 7y ago

There are a few AVB 2.0 devices that will allow this, including the Pixel series, and the OnePlus 5T, but it can be risky. GrapheneOS works seamlessly with it, allowing you to relock the bootloader and only accept signed-OTA updates. You may be interested in the Magisk [0] project which allows your device to pass Google's "SafetyNet" and present as an unmodified device to apps using that API to detect if they should refuse to run for "security" reasons. 0. https://github.com/topjohnwu/Magisk https://github.com/topjohnwu/Magisk

zozbot234 7y ago
Note that Google SafetyNet is now (as of mid-March 2020) requiring hardware-based remote attestation in order to pass their "CTS" check. This check will fail if the bootloader is not in its default "locked" state, and cannot be feasibly bypassed by Magisk. https://github.com/topjohnwu/magisk_files/blob/master/notes.md https://github.com/topjohnwu/magisk_files/blob/master/notes.... Magisk (and even its 'hide' component) will still be useful for many purposes, but we should not be expecting it to pass all such "safety" checks.

ppseafield 7y ago

As a sibling comment suggested, using Magisk Hide lets you conceal your rooted status from those apps. Had this happen with my banking apps, and can confirm (on my Nexus 5x) that Magisk Hide did allow me to use those apps. As for reflashing, you have to have a copy of the original image, for the device which you can download from various places, but once you have it, you may reflash it back to factory and relock.

neurostimulant 7y ago

Aren't those banking apps usually simply check whether root is available on the device and bail if they found it? You might be able to circumvent it using magisk to hide root, or simply don't install root support when installing lineageos (that's what I do as I don't need root anymore these days, and I haven't found any app that complains about insecure rom yet, Safetynet status is also passed).