4 ms·
Dumb idea, but I wonder if the underlying os can see who is asking questions like do you have root, And if an app has no need to know, it just plays dumb and re
by onaclov2000 1mo ago
Dumb idea, but I wonder if the underlying os can see who is asking questions like do you have root, And if an app has no need to know, it just plays dumb and responds...of course not. It's a bit of a chicken and egg problem, in that if you don't know what apps need to know if you have root, or not, then you can't determine that at the OS level...maybe an option for the user (popup) to tell the program, tell them we are rooted or not? (Or a settings page you can determine what apps can know root or not)
- Retr0id 1mo agoThat's exactly how modern Android rooting tools work. You select which apps you want to have root, in a manager app. No other app should be able to notice. But GrapheneOS isn't root, that's just PayPal's thing being broken.
- NoidFonsense 1mo agoperhaps but this is about device/os attestation, not rooting
- kevin_thibedeau 1mo agoHow does their web site do device attestation? The argument that apps have to be locked behind a validation mechanism controlled by Google to be secure is BS when a cookie is sufficient.
- grapheneos 1mo agoGrapheneOS isn't rooted. The issue is their flawed anti-tampering code shipped a new bug breaking compatibility with secure spawning. We have a per-app toggle for secure spawning due to seeing this with other banking/financial/government apps and it works for PayPal's app as the original poster discovered. If they want to ban arbitrary operating systems, they can use attestation and it can't be fooled the way you're describing. Apps doing this can explicitly verify GrapheneOS and we've convinced some apps to do that. We've also convinced a smaller number to stop doing that at all.