4 ms·

> your bank's Android app Worst comes to worst you can decompile it and take out the checks, but it is admittedly a huge hassle.

looperhacks 5y ago
Not really. Safetynet runs on Google servers and communicate with your banks servers (if they have that enabled). If a modded app removes these checks, the bank will notice because they ask Google whether your device fulfills all requirements.
danogentili 5y ago
You can't really do that with safetynet, as it relies on sending an (often signed with a hardware key) payload to the servers of the app, which then connect to Google's server for validation, before allowing access to the APIs the app requires.
- krageon 5y ago
  The checks I've seen when I have explored the possibility of doing this (in an explicitly legal way, I had permission) were easily bypassable client-side. It's not generally a good idea to assume the heaviest option was picked when a simpler one could also have been picked.
arsome 5y ago
The problem is SafetyNet uses remote attestation. And if the bank app is implemented properly that won't work because the server will check they attestation and fail your login. They very well may not bother with this though since they offer a web version anyways... which kind of makes the whole idea of putting root checking in the app pointless. Right now at least, there's no hardware attestation on many devices so you can just install Magisk and hide the fact you're rooted pretty easily from SafetyNet and still pass.
- dane-pgp 5y ago
  > Right now at least, there's no hardware attestation on many devices How long do you think it will be before a country requires that all smartphones support this? And how long before it is a requirement for laptops too?
  - blibble 5y ago
    not sure about smartphones but Windows 11 will require a TPM, presumably for remote attestation
    - dane-pgp 5y ago
      That's a good point. Anyone who suspects that the government pressured Apple to add on-device file scanning (under the guise of "think of the children") should also conclude that making TPMs a requirement is intended to lay the groundwork for a future legislative change (presumably under the guise of "cyber-security").

looperhacks 5y ago

Not really. Safetynet runs on Google servers and communicate with your banks servers (if they have that enabled). If a modded app removes these checks, the bank will notice because they ask Google whether your device fulfills all requirements.

danogentili 5y ago

You can't really do that with safetynet, as it relies on sending an (often signed with a hardware key) payload to the servers of the app, which then connect to Google's server for validation, before allowing access to the APIs the app requires.

krageon 5y ago
The checks I've seen when I have explored the possibility of doing this (in an explicitly legal way, I had permission) were easily bypassable client-side. It's not generally a good idea to assume the heaviest option was picked when a simpler one could also have been picked.

arsome 5y ago

The problem is SafetyNet uses remote attestation. And if the bank app is implemented properly that won't work because the server will check they attestation and fail your login. They very well may not bother with this though since they offer a web version anyways... which kind of makes the whole idea of putting root checking in the app pointless. Right now at least, there's no hardware attestation on many devices so you can just install Magisk and hide the fact you're rooted pretty easily from SafetyNet and still pass.

dane-pgp 5y ago
> Right now at least, there's no hardware attestation on many devices How long do you think it will be before a country requires that all smartphones support this? And how long before it is a requirement for laptops too?
- blibble 5y ago
  not sure about smartphones but Windows 11 will require a TPM, presumably for remote attestation
  - dane-pgp 5y ago
    That's a good point. Anyone who suspects that the government pressured Apple to add on-device file scanning (under the guise of "think of the children") should also conclude that making TPMs a requirement is intended to lay the groundwork for a future legislative change (presumably under the guise of "cyber-security").