4 ms·

I treat use of SafetyNet or attempting to detect root as actively malicious and give apps that do that 1-star ratings on Google Play. I realize there's a theor

by Zak 4y ago

I treat use of SafetyNet or attempting to detect root as actively malicious and give apps that do that 1-star ratings on Google Play. I realize there's a theoretical risk the OS could be compromised or malware could have superuser permissions, but my previous attempts to find any significant data breaches or user harm caused that way have come up empty. If anybody knows of one, I'd be interested to read about it.

BLKNSLVR 4y ago
SafetyNet doesn't protect me from having my personally identifiable browsing data sucked away and sold off, and that happens daily to all users of their devices. Google can't even sanitize their own ad platforms. What are you attempting to protect me from then SafetyNet? Oooh, I get it, you're trying to protect apps created by companies that collect and store sensitive data to minimise the chances of said companies being sued for, and having to publicise, a data breach. Ok, why didn't you just say that? Yeah, you're right, it doesn't play anywhere near as well to the great unwashed. SafetyNet sounds like shit to me: > requires Google Play Services to be enabled on the device for the API to function smoothly. > SafetyNet works in combination with the snet service on Android devices which collects data about the integrity of the device and constantly ping Google about the safety status of the device. > Google offers many other options like application sandboxing, encryption, app-based permissions and so on to secularize apps but none of them are considered as an all-inclusive solution. (GPS permissions required for wifi scanning? Fix your basic shit first!) > By identifying devices which are currently in the non-tampered state the API provides an assurance that the device on which the app is running is neither rooted nor using a custom ROM. (cough Magisk cough) Above excerpted from an article admittedly with rose-coloured glasses view of the subject: https://www.hexnode.com/blogs/safetynet-android-security/ https://www.hexnode.com/blogs/safetynet-android-security/
- JTbane 4y ago
  I could not get Magisk working, so for me I cannot use rooted Android as I like to be able to access my bank accounts and credit cards.
  - BLKNSLVR 4y ago
    Hide the app, then setup the Configure / Enforced DenyList things. Mine also has Zygisk enabled. I don't use my phone for banking, but I do have a crypto wallet that refuses to run on a rooted device, but Magisk solved that for me.

by Zak 4y ago

BLKNSLVR 4y ago

SafetyNet doesn't protect me from having my personally identifiable browsing data sucked away and sold off, and that happens daily to all users of their devices. Google can't even sanitize their own ad platforms. What are you attempting to protect me from then SafetyNet? Oooh, I get it, you're trying to protect apps created by companies that collect and store sensitive data to minimise the chances of said companies being sued for, and having to publicise, a data breach. Ok, why didn't you just say that? Yeah, you're right, it doesn't play anywhere near as well to the great unwashed. SafetyNet sounds like shit to me: > requires Google Play Services to be enabled on the device for the API to function smoothly. > SafetyNet works in combination with the snet service on Android devices which collects data about the integrity of the device and constantly ping Google about the safety status of the device. > Google offers many other options like application sandboxing, encryption, app-based permissions and so on to secularize apps but none of them are considered as an all-inclusive solution. (GPS permissions required for wifi scanning? Fix your basic shit first!) > By identifying devices which are currently in the non-tampered state the API provides an assurance that the device on which the app is running is neither rooted nor using a custom ROM. (cough Magisk cough) Above excerpted from an article admittedly with rose-coloured glasses view of the subject: https://www.hexnode.com/blogs/safetynet-android-security/ https://www.hexnode.com/blogs/safetynet-android-security/

JTbane 4y ago
I could not get Magisk working, so for me I cannot use rooted Android as I like to be able to access my bank accounts and credit cards.
- BLKNSLVR 4y ago
  Hide the app, then setup the Configure / Enforced DenyList things. Mine also has Zygisk enabled. I don't use my phone for banking, but I do have a crypto wallet that refuses to run on a rooted device, but Magisk solved that for me.