> Should the bank allow people to put up a fake front for the ATM recording the customers card and PIN? This is a false dichotomy. The hardware attestation fo

> Should the bank allow people to put up a fake front for the ATM recording the customers card and PIN? This is a false dichotomy. The hardware attestation for SafetyNet is orthogonal to being able to use hardware attestation for e.g. session/user keys, or even chain-of-trust down to the fingerprint sensor level. Keys can be kept secure using secure enclaves even if the OS is rooted. Blocking rooted phones with SafetyNet is just spite. Not to mention, an ATM is property of the bank and is shared-use. The user is not the owner. The phone belongs to the user.