yashsingh1/xdaforums huggingface dataset:
[Nexus 5 Q&A, Help & Troubleshooting] jasondclinton_google:
I don't want to derail the thread as this is a bit offtopic but we do hear you on this and we've been working really, really hard on improving battery life. I'm running an internal build of Marshmallow and I get two full days on a single charge on my Nexus 6--and that's running a with a fairly large set of apps. Personal experiences may vary, of course, and seeing is believing. I hope that your experience will be the same.
[Nexus 5 Q&A, Help & Troubleshooting] ajm786:
Acknowledged; thanks for jumping in on this too. I really do hope it gets fixed, because it's the single cause of massive pain for so many of us.
[Nexus 5 Q&A, Help & Troubleshooting] VerticalCobra:
Agreed:good:...It has been a learning experience and helpful reading this thread...feels good to know that at least someone with Google (jasondclinton_google) is listening. Thank you :good:

Would be a great compromise if Google Wallet was allowed to continue as it is :)

GW for the rooters and Android Pay for the stock ROMs.
[Nexus 5 Q&A, Help & Troubleshooting] thedodus:
Getting shut out of our own money though.

Jason: I understand the security concerns and do appreciate you coming here to share your perspective and engage with your users. However, I do think that there's been a gigantic oversight on how this app, and the dichotomy of our choices, are being presented. It's a little more complicated than Android Pay being out of the reach of power users who root.

This is exactly the dichotomy I'm talking about. It's not just about choosing root or Android Pay. Google Wallet, as it used to exist, was a repository for loyalty cards, gift cards, AND virtual credit cards. Many people, myself included, who had root proceeded with their lives as though Google Wallet, as a useful tool, was safe to use. This meant trusting it as a safe keeper of actual money in the form of storing our loyalty and gift cards in the app and ditching the plastic.

Now, for the rooted user, we have lost access to our own money, because we can no longer even enter the app until we pass the security check on uploading a card that we can't pass. Google still has a responsibility to those users, whose money they've now locked up in a now-unusable app. I'm fine with choosing root over Android Pay, and not having an app to double as a credit or debit card. I never used Wallet as a substitute for my bank cards anyway. But I'm not cool with having access to my loyalty and gift cards taken away without so much as a choice because Android Pay wants to be a secure credit card payment app.

Loyalty/gift cards need to either be accessible by giving root users a way into the app, and move the security check to actually uploading a bank-affiliated card, or they need to be given over to Google Walletv2, which seems to work alright, pointless though it currently may be.
[Nexus 5 Q&A, Help & Troubleshooting] brianK2:
I apologize if I drove us off topic. My intention was simply to say that if Google were to authorize or implement certain features in their OS that currently require a rooted device, then I would not have to root my device in the first place. Thus the trust chain would not be broken. I think anyone on XDA would say that titanium backup is an absolute must in today's Android world. Even on a Nexus device.
[Nexus 5 Q&A, Help & Troubleshooting] Joshmccullough:
Don't want to derail the thread? Eh, it's a bit late for that, it's already been done :) You checking in from time to time and keeping us up on what's going on behind the scenes, as you're able to, is greatly appreciated!

Nice humblebrag on the N6 and battery life, btw ;)
[Nexus 5 Q&A, Help & Troubleshooting] Stryke_the_Orc:
No argument here, TB is an absolute necessity in my toolbox, but again, that's not what the debate was about. And the thread was well on its way to being derailed prior to your post.
[Nexus 5 Q&A, Help & Troubleshooting] segv11:
I think the debate has also diverged into how to hack around Google's obnoxious restriction, and use Android Pay on a rooted device anyways. And this of course is a totally expected direction. Since when do XDA users accept being told what they can and cannot do with their devices...
[Nexus 5 Q&A, Help & Troubleshooting] papertreeprophet:
Holy mother of entitlement Batman! I can't believe some of the B.S. I've read in this thread. Google isn't telling you what you can or can't do with your device, they are telling you you can't use their APP which is closed source and you have no fundamental right to use anyway. Not even getting into the argument of how secure you are as a root user (and you are fundamentally more unsecure when you root), the fact is they make the choice who can or can't use an app.

Acting like a bunch of kids who didn't get a turn with the new toy.
[Nexus 5 Q&A, Help & Troubleshooting] Stryke_the_Orc:
Ok, lets clear this up a bit.

No one is trying to quash any form of development, whether it's bypassing this "lock" or any other development. As [MENTION=3200478]Woody[/MENTION] already stated, everything we do on this site is based on vulnerabilites. What we have been repeatedly trying to explain is the reason that it stopped working "out of the box" for rooted users, from the standpoint of a business that has to make their business secure. Instead of listening to why it stopped working, everyone with an opinion (and we all know what an opinion is like) has chimed in with why it should work for them, or how their "rights" are being stripped away. None of which is beneficial to the progression of development nor is it constructive for Google employees that are monitoring these threads.
[Nexus 5 Q&A, Help & Troubleshooting] psu90:
If I remember an article I read recently Google does not get any part of the transaction fee. Apple does for the next couple of years, but with the change in the laws as soon as their current contract runs out they won't get a piece of the pie either.
[Nexus 5 Q&A, Help & Troubleshooting] TheQman121:
You're kind of missing the point. This isn't about not being able to play with the new toy. This is about google stripping functionality away that worked just fine beforehand with no warning. One day I can make mobile payments, the next day I can't. Does Google have that right? Sure. But that doesn't mean people wouldn't complain if google disabled wifi on rooted devices. Google needs to know that many rooted users care about Android Pay, because that will definitely influence my decision for my next phone.
[Nexus 5 Q&A, Help & Troubleshooting] papertreeprophet:
It's their decision, and in this case it's also a decision out if their hands in some ways. They didn't just strip functionality, they completely changed it. Android pay is not the same as what Google wallet did, and with wallet Google took the responsibility themselves.

With how widespread they hope a system like android pay will get, do you really think Google wants all the responsibility for potential fraud? Would you?

I've heard people say that give them the choice to take that responsibility, up until their **** gets stolen and they now owe thousands and will try so hard more than likely to get out of it.

You also need to remember that you are in the minority. Hell I don't even root anymore, and I doubt the vast majority of android users even know what that term implies, let alone means.

You and everyone else here are asking Google to change what's been made, as well as somehow convince the banks this would be an OK thing to do, for the minority. The very vocal minority, for sure, but the minority nonetheless.

I will be the first to chastise Google for handling this piss-poorly, but the fact is if you think about it from a security standpoint with what's actually happening at point of purchase, it makes sense you wouldn't want to run the risk that allowing rooted phones would present. Sure YOU might be safe and follow best practices, but do you think every person who roots does? Have you SEEN some of the **** that gets asked here by the some people?

Don't just think about yourselves, think about the whole overall picture.
[Nexus 5 Q&A, Help & Troubleshooting] AndroidDeveloperLB:
Well if it's Android that can't be in control of root, let it be part of the kernel itself (Linux). Add something that even root access can't change.
[Nexus 5 Q&A, Help & Troubleshooting] noutoo:
I entered a review of 1 star and added my reason of it not working with custom roms. If enough people who follow suit maybe it might get some media attention. Last thing Google wants is another slow start with Apple Pay gaining momentum and Samsung Pay coming out.
[Nexus 5 Q&A, Help & Troubleshooting] AndroidDeveloperLB:
I didn't go into details as to how to enable root. It could even be using the same method you use for OnePlus One (or even easier - via the bootloader itself, by just enabling it with a password or something). Really doesn't matter. Just that it should be official and available for all devices in the same way.

It might even be that if it becomes official, some manufacturers will use a different method anyway, but still have it official.

And, there shouldn't be any exploits. Those should be considered as huge security holes, as they can actually get root without the user even knowing about it.

I was quite surprised to see how popular those tools became, and I hope that they are at least a bit open sourced, to have some kind of secure feeling about it for those who use it.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
You are totally missing the point. Root can do anything. If someone has root access, you don't need an exploit. There is also no guarantee you'll be notified about a root request since an app can just start adding the sui bit all over the place.

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] Piero512:
The compromise

The very thing Google has to do is lookup on his gigantic stadistical data of every phone (i'm talking to you, Play Services) to see the actual amount of people rooted and then, balancing within the amount of devices able to update or to download this app, and then, if root is a deal breaker , then simply ignore us. Although a compromise could be made; modifying the very basic layer of Android permissions and adding those permissions that the apps needs to "optimize Android" but then, every app would have access to it. As with the behavior of others accounts, only let Google authorized apps on the market to use such permissions. Since MOST of then are open-source, it would work ok, but it would require the money needed to make another version of Android.
[Nexus 5 Q&A, Help & Troubleshooting] RaymondPJR:
Naw, we are so provincial in or thinking in the US. If paying by phone is supposedly so risky, why not look first at some other country, like Japan, where paying by tapping phones has wide use amongst the general population. Just how is it handled over there. Has root been a barrier to tap-n-pay systems in this high adoption country or anyplace else? I've always felt perfectly safe using the old Google Wallet and think it was allowed to work on rooted devices because root did not make it any less safe than on an un-rooted device.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
You don't know anything about hacking do you? Root can install the kernel or anything else. Come on man, think. You aren't a Linux user huh?

Taglines suck. https://eddon.systems

---------- Post added at 10:13 PM ---------- Previous post was at 10:12 PM ----------

Oh no! A one star review that will show them. FYI, Samsung Pay won't work on rooted devices either.

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] Stryke_the_Orc:
Ok guys, let's keep this thread from devolving any further. Stay on topic here.
[Nexus 5 Q&A, Help & Troubleshooting] RaymondPJR:
I think the figure that's been thrown around here of the number of root use vs non-root is 5%. Of that percentage, an even smaller number will use Android Pay. Of that number a still smaller number may fall victim to some sort of exploit. Now, Google would be on the hook since that we are moving to more secure cards and more secure mobile payment methods (It's ironic that banks insist on tokenization to come on board with Android Pay as for years they've just been passing the costs of fraud on to consumers in the form of higher fees while refusing to follow Europes example and using chipped cards! Europe saw a tremendous drop in fraud and it's related costs years ago. Anyone think fees will drop once the savings from chipped cards is realized? I digress...) Where is this great risk, those numbers are small!

Anyway, sir, what I'd like to see is a feature of Android pay that would restrict the amount I could spend because I'm rooted. Message: Root detected, in order to use AP, you must set a spending limit and not hold Google liable for that amount. This feature would only show up on rooted devices. I could set an amount I'd be willing to lose if I were a victim of a root exploit and I could not hold Google liable for it. I'd virtually sign an agreement and that would prompt a second layer of security via a text message or email where I'd have to use a 'capcha' or some other method to prove I was a live human (my banking app does double layer security already). I then could happily use AP up to that amount during a set period (month), spending anything greater would fail. If I wanted to spend more I'd have have to go through another two layers a security again proving I'm a live person to make that payment. That's a compromise I could live with.

I only used Wallet for small purchases anyway rarely exceeding about sixty dollars/month. That had more to do with the few vendors using NFC not having their equipment enabled (after three years-Macy's, Best Buy, etc) and the general lack of NFC terminals. I could set my limit at sixty dollars and be totally happy.
[Nexus 5 Q&A, Help & Troubleshooting] tylerdurden83:
Can't the api calls made by Android Pay simply be overridden with an xposed module?
[Nexus 5 Q&A, Help & Troubleshooting] wing_addict_usa:
Goodbye pay, hello root
[Nexus 5 Q&A, Help & Troubleshooting] Sgtmack:
I really liked using Wallet to tap and pay. But I'm not going back to stock for Android Pay. And it sounds like they won't miss me.
[Nexus 5 Q&A, Help & Troubleshooting] WhosAsking:
Some of the calls are made by SafetyNet, which isn't downloaded as an APK or the like.

And your idea of overriding the APIs are exactly the reason Android Pay doesn't trust anything but a pristine environment. And like I said, it's not like Google's doing this of its own volition. They're being pushed by the new PCI rules going into effect which make Google liable for fraud if they don't take the steps they do now with Android Pay.

PS. As for Apple Pay working on jailbroken phones, IIRC, Apple Pay also requires a Secure Element as well.
[Nexus 5 Q&A, Help & Troubleshooting] niteh@wk:
Regarding the limit dollar amount on AP, Citi has been doing something similar to that for years and I do think that's an innovative solution to reduce frauds. Citi has Virtual Account Number. Basically you run the VAN app, downloaded from Citi site, to generate a random credit card number (a virtual number) with a limit amount and expiration date you define. The merchants or fraudsters would only have access to this virtual number, not your real credit card number. Each VAN can only be used for one merchant. I have used these VAN numbers on numerous online merchants, and also Wallet without any issues.

I understand this time Google is driven by banks, just as I was afraid this might happen as it did with Wallet when it was driven by carriers. Google came up with HCE to combat that. Google employs the brightest and smartest people, you can do better.
[Nexus 5 Q&A, Help & Troubleshooting] Chuonglepham:
It's ironic that Google defend Android Pay (AP) with a security excuse while totally ignoring their flimsy LVL that is easily bypassed by a third-party cracking app (Lucky Patcher and the likes). Loss of income for developers is as great as liability issues incurred from unsecured/exploited electronic transactions via AP. Google is cherry-picking what they deemed are "security" issues with the Android platform. I don't know about everybody else, but LVL security is just as important as AP. Of course, Google might argue that LVL is open-sourced; whilst AP is closed-source. Still, security is security, regardless of which business model Google deal with: developers vs. financial institutions.

If root is such a major concern, why don't Google build this feature into Android itself, with a toggle option that can only be activated by the owner of the Android device via a two, or even three-step security approach- like what Google did with Gmail sign-in with a mobile verification code? Then, it would be much harder (though not totally impossible) to hack via an exploit that could cause liability against AP.

I don't fathom all these defence posturing Google has adopted regarding rooted vs. unrooted Android mobile devices in relation to AP. Google Wallet work, and it's not broken, so why fix it?! What are, if any, liabilities Google have incurred from Google Wallet? Publish these figures, if any, so we can judge for ourselves whether Google Wallet was successful or not. The creation of AP sounds suspiciously like: I (Google in this case) want a share of that billion-dollar-pie, card-less, electronic market. For those who have quoted here that Google don't get a dime from AP, well, companies, Google included, don't create software just for the fun of it. They do it for money, fullstop.

And, oh, don't even get me started about why Google removed Flight Mode and Mobile Data toggle functionality from unrooted Android firmwares due to "security".
[Nexus 5 Q&A, Help & Troubleshooting] RaymondPJR:
Yes, I hope that Google engineer will come back and chime in on this idea. Maintaining root as a prerequisite of running AP would make the "banks" happy! A restricted use feature within AP (with no liability for Google) for root users would make us happy!
[Nexus 5 Q&A, Help & Troubleshooting] jasondclinton_google:
I can't speak for Google or our partners and I'm certainly not going to get into discussion of anything legal or liability related. I'm just an engineer, anyway.
[Nexus 5 Q&A, Help & Troubleshooting] ajm786:
THANK YOU. I was kinda waiting for you to respond; you did, and hit it out of the park. This is pretty much exactly what I wanted to say (technically). :)
[Nexus 5 Q&A, Help & Troubleshooting] Stryke_the_Orc:
Thread is re-opened.

Sadly, I have had to remove a great deal of information that is quite informative and useful (though not directly related to the topic of this thread) because of the context of the conversation. I am loathe to remove anything that can be used to teach, for development purposes or otherwise is just good to know, but if it's laced with venom, belittling to others or in general delivered in an unfriendly manner, the post loses its value and constructive turns to destructive.

Let's try to keep things civil and be respectful of others ok?
[Nexus 5 Q&A, Help & Troubleshooting] RaymondPJR:
I thought you were here to take ideas back to Google? That's all we're asking. I'm a little bit mystified why you won't discuss our idea, from your own perspective of course. But, that's fine, thanks for listening?
[Nexus 5 Q&A, Help & Troubleshooting] jasondclinton_google:
I have relayed your idea (and variations on it mentioned earlier in the thread like the "power user bit"). Again, I don't want to falsely get your hopes up so please know that anything in this vein would--hypothetically speaking--be a huge undertaking lasting on the order of at least a year. I don't know whether it's even possible.
[Nexus 5 Q&A, Help & Troubleshooting] jt_04:
I'd like to know why mobile devices are held to such a different standard than laptops and desktops. What is it about a phone that justifies restricting my rights as the user and owner? Is it because it transmits over the FCC-regulated air waves? My laptop is continuously connected to the internet at home and whenever I have a wifi connection. But I would never even consider purchasing a laptop or desktop where I would not be allowed to have root access or reinstall the OS. And I use my laptop to access my bank accounts, manage my little money, and conduct transactions with merchants where I type in my credit card information unencrypted, all with the protection of a mere password or pin (at least at my level) while keeping my fundamental right to exercise ownership over the device I have purchased. Why can't I do the same on mobile, protected by a password or pin? Why are my abilities as the owner restricted and we are accepting this (as a society) without even questioning it?
[Nexus 5 Q&A, Help & Troubleshooting] jasondclinton_google:
It comes down to this: https://www.google.com/search?q=CDCVM . EMV and contactless payments are "cardholder present" as opposed to the "card not present" that occurs when making an online purchase. The former are considered much more secure and treated as such by the ecosystem when authorizing a transaction. Not sure if "cardholder present" as a name will stick.
[Nexus 5 Q&A, Help & Troubleshooting] gunslingerfry:
I'm interested to know, and you may or may not know this, how a fingerprint sensor (which is variably secure based on software implementation), trusted device, 4 digit pin, or a 4 dot pattern lock on a 3x3 grid is considered more secure than any cloud based password authentication system.

Why is Android Pay held to a higher standard than POS terminals on Windows? I've answered my own question here. POS terminals are required to support EMV or the retailers assume the risk.

I kind of wish Google had failed with their push for HCE and secure elements (a la Softcard) had stuck around.
[Nexus 5 Q&A, Help & Troubleshooting] lionelhuts:
How do OEM's submit their ROM's system image signature to Google's database of known valid signatures?

Would developers be able to submit their ROMs for CTS verification in a similar way?
[Nexus 5 Q&A, Help & Troubleshooting] lionelhuts:
EDIT - Double post, sorry.
[Nexus 5 Q&A, Help & Troubleshooting] Robalboa:
first of all i wanna say thanks for your presence here with us. we appreciate you.

secondly

when they (google) see the drop in sales on the AP app they will make a move. money is the motive!

and when they see samsung just launched samsung pay (which does work on rooted devices thank the lord) in the US

and did 30 million in sales the first month.

http://www.businessfinancenews.com/...nd-google-by-launching-samsung-pay-in-the-us/

the old samsung wallet didnt work on knox free or tripped devices, but This new one does

its just not yet out for the older devices yet but will be according to sources " with in the month we are adding a huge list of devices for compatibility"

its still hard to believe we can access our financial institutions including banks, bank transfers, stock buying and selling, etc all within a basic browser and its secure (to an extent)

yet cant use AP app to buy lunch (not secure enough? )

hopefully when they see the Numbers they rethink the plan, before they lose the customers.

funny thing I cant recall one security issue that had ever happened with the old (flawless) wallet app was there some large breach or something? Not that i can recall all i remember was bragging how great wallet was.

anyway when they see the decline in revenue they will make a move. they are in the business of making money not losing it.

"The Numbers Mason" -Black Ops 2 2012