yashsingh1/xdaforums huggingface dataset:
[Nexus 5 Q&A, Help & Troubleshooting] Yaz75:
I might be able to make the point that many do not know what they're doing based on the years and sheer number of threads on XDA where folks rooted, started screwing around and bricked their phones because they didn't know what they were doing and didn't want to learn.

But that's the way the world works. You buy a car and modify it, then you void the warranty and anything that happens to you is on you. If you buy a house and do renovations without permits or inspections, then you can face fines and have trouble selling the house down the line. They are including the app and intend it to work in a very specific environment. You want to change the environment then that's perfectly fine, you don't get to use the app. You don't get to have your cake and eat it too.

Does anyone know if Apple has the same requirements? Can you jailbreak an iPhone and still use Apple pay?

---------- Post added at 01:41 PM ---------- Previous post was at 01:38 PM ----------

But again, you're discussing the tech, Google is dealing with the liability. They could spend all kinds of $$ trying to get super specific and change the programming, or they can just do what they did. It's a blanket that covers all potential liabilities with one fell swoop. It's the faster, easier, and cheaper solution.
[Nexus 5 Q&A, Help & Troubleshooting] lionelhuts:
Yes. Still safe because Apple uses a secure element.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
No. detecting root doesn't detect the exploit that gives root. They are patching perceptions rather than real security. potentials are Not covered

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] trickinit:
That doesn't mean Apple allows it though. Devs have just figured out a way to circumvent Apple's security. That's why it's a game of cat and mouse with them. Apple will plug the exploit and it takes a while before a new one is discovered and a new jailbreak released. I'm sure we'll see the same type of scenario with Android Pay. It's only a matter of time before the apk is modified to bypass Google's security checks.
[Nexus 5 Q&A, Help & Troubleshooting] Yaz75:
But perception is the (legally) most important part. They can always claim that they in no way allowed it to be used on an "unsecured" device by not allowing anything but a bone stock ROM to officially run it. That is what will legally cover them now and into the future. The technical argument whether that's the best method hardware/software wise really doesn't matter in court if you're being sued for losses. Intent or perceived intent is everything.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
I don't agree. If someone were to compromise the system via an exploit such as StageFright on a non-rooted phone, I think that Google could still be held responsible.

If even root can't screw it up, then you are covered.

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] WhosAsking:
You can use Apple Pay on a jailbroken phone, but then again, NFC-capable iPhones use Secure Elements, too. I hear Samsung Pay can be used on a rooted phone as well, but not on a Knox-tripped phone (since it would appear Samsung Pay uses Knox).

---------- Post added at 06:03 PM ---------- Previous post was at 06:00 PM ----------

Thing is, as seen with the original S4 and other early-adopting Google Wallet phones that carried Secure Elements, they're very touchy things that not even root can muck around with without risking a broken chain, which basically bricks the element as far as they're concerned. Maybe in future all NFC-capable Android phones will again carry Secure Elements that not even root can risk tampering.

---------- Post added at 06:06 PM ---------- Previous post was at 06:03 PM ----------

The trouble is that, with any kind of VM setup that isn't hardware-based, root can do anything. That includes peek into the VM as it has a hypervisor position relative to it. Basically, anything the Android OS can see, root can see. Only something that exists outside the OS's scope, like maybe a Secure Element, can possibly remain out of root's reach.
[Nexus 5 Q&A, Help & Troubleshooting] Yaz75:
OK, I'm going to put my lawyer hat back on. If you root your phone and get your info and money stolen, then Google is off the hook. Because the minute you rooted, you took ownership and voided your warranty and rights. HOW someone manages to hack in at that point is going to get lost in the arguments. All those Terms of Service contracts that no one reads? That's where it's spelled out. 99.9% of people click the box and move on (guilty), but it's there. And Google's policy as it pertains to Android Pay is staying consistent with their need to cover their butts. And they're also appeasing banks who are slow to adopt new tech and new transfer methods. They have fears and this makes them happy. And the more banks you make happy, the more customers will potentially use the service. Again, it's about the lawyers and the money. Every one of those entities are looking to absolve themselves of liability. Period.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
No, you missed the point. If the system is exploitable on purpose (to gain root) then it is exploitable for malicious purposes. Stagefright can allow a remote attacker to compromise your phone and you don't get root. In this case, Google is responsible.

Therefore checking for root is not the end of security nor responsibility. I believe a more secure solution would allow rooted users and prevent legal liability from Google when their own code is compromised.

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] Yaz75:
Ok. I can't get you to see any other side of this so this is clearly futile. You seem unwilling to see another perspective. Again, I'll leave you with this re-statement:

It's not about the tech, it's about the law. Which doesn't have anything to do with the tech. The 2 can and are often mutually exclusive.

Have a good day.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
No, I already agree that its about legal issues, but I don't agree that 'no root' will absolve them of responsibility. I specifically mentioned an exploit on a non-rooted phone and you said started talking about how it doesn't matter how someone got root, so its not that I don't see what you mean, your responses show you didn't read what I said at all.

If my phone is hacked due to Google carelessness, and my phone has not been rooted, then are they not still responsible? So, a better security solution not only helps us, but lessens Google's responsibility as well.

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] WhosAsking:
Trick is, whatever this solution may be, it probably won't be possible to implement in any phone on the market at this time. First, Google's gonna have to wrest underlying control of the OS from the carriers. Now that Android's the top dog in the phone world, Google finally has some muscle in that department. Marshmallow's new security model (closer to Apple's) is a hint Google's flexing. With more control, Google can stratify the Android OS better, allowing them to push necessary or even mandated security updates regardless of what the carriers do on top, allowing them to avoid what's happening with StageFright and StageFright II now: millions of unpatchable phones prone to pwning from a basic phone function.

But ultimately, to allow more user control and keep a clean chain of trust at the same time will require a real degree of separation here, and that probably means a return to the Secure Element or some other kind of cryptosystem black box (in terms of Android, that is).
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
Agreed. Real SE would seem to be the solution and should work even rooted.

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] CKD Publishing:
You hit the nail right on the head there, mate!

All this fuss about root and rooting being an exploit is total rubbish. If administrative privilege is an exploit, then all Microsoft system admins of many businesses / companies would leave in droves, or the individual users would ditch Windows and find better alternatives.

If manufacturers are afraid that root might screw up their Android devices or Google afraid that Android Pay (AP) might be exploited due to root, then rebuilt the hardware to include a secured partition where the default Android firmware shipped with the mobile device is untouchable, while creating another [unsecured] partition to allow users to install custom firmwares, official firmware updates over FOTA and / or root kernels they like. And, should they stuff up the firmware installation or rooting process, then allow the users to revert back to the default firmware via a recovery method to fix the broken installed firmware- like overwriting it with the default firmware. Then, we don't have an issue with devices being bricked for once and / or root being a security issue as AP can run in the secured partition (like a dual-boot environment).

All these defence posturing from Google, device manufacturers and uninformed individuals about root being evil is frankly getting on our nerves. Instead of locking everything down, rethink the design architecture of Android + hardware + firmware installation procedure + rooting process + dual-boot environment [that is lacking in Android].

Just a thought.
[Nexus 5 Q&A, Help & Troubleshooting] Stryke_the_Orc:
Last I checked, unlocking your bootloader allowed you to flash a new OS or kernel, and as many people have tried to use as a defense in this very thread, those ROMs do not come with root, you must flash the root package to gain system level privileges.

That being said, the average user was never meant to have administrative rights on an android device, and unless you have a nexus device, correct me if I'm wrong here, unlocking the bootloader involved using an exploit.

I'm not perpetuating any "false myths", I'm simply stating that this was not the intent of the Android project, just as iOS was never intended to be jailbroken.

To the others debating rights:

As for the open source and rights argument, the only thing open source that you have a right to, is the kernel, licensed under GPL. The Apache license allows for proprietary elements and those you do not own, or have rights to, even if you own the device. Which means, root is not a right. Read the terms of the licensing of your specific devices OEM. They are not required to open source their ROMs, only the kernel.

Slithering from the nether regions of a twisted mind and tarnished soul
[Nexus 5 Q&A, Help & Troubleshooting] Robalboa:
well heres the new vulnerability for android that has access to all android pay info and use. actually they gain remote control through androids media meta data. this is present on over a billion, yes a BILLION devices the majority "non rooted" devices. they are vulnerable. but not all rooted devices are because alot of us use a modified media lib and meta data for our sound mods etc

so Again Rooted users are more secure from this remote control exploit. yet Cant use Android pay.

funny thing we'll have a patch before google.

http://www.csoonline.com/article/29...illion-devices-at-risk-of-remote-hacking.html
[Nexus 5 Q&A, Help & Troubleshooting] Stryke_the_Orc:
This makes zero difference, again because of the chain of trust. The banks and other institutions that put the pressure on Google and the legal red tape associated with this kind of service, don't give a damn about if you have a patch. If it not 100% from Google, it's not trusted. In their eyes this is like having a convicted bankrobber guarding a vault. You have already "hacked" your device by rooting. They aren't going to hand over the keys to a hacker, plain and simple. And I can tell you with 100% certainty,they don't know the difference, nor do they care, between you rooting and someone exploiting the CVE you posted. In the enterprise world, hacked device is a hacked device, period.
[Nexus 5 Q&A, Help & Troubleshooting] WhosAsking:
Which now raises a very serious question. Given the pervasive and highly-unpatchable nature of StageFright v2, the card companies might be feeling pretty nervous right now about Android Pay, given that nearly every device out there is vulnerable, including quite a few (like S3s, S4s, and such) that have the NFC capability needed for Android Pay's EMV system to work. To evoke an image, Google right now looks like the guys caught with their butts in the breeze: a big, fat, total-ownage exploit in the wild and they'll be able to, at best, reach a very tiny fraction of this population. How are you going to clean up a mess like this? As I noted before, Google may be forced by the twin pressures of StageFright and the credit card companies to withdraw Android Pay for some time and only re-implement it under much-tighter restrictions, at least some of which will be based in hardware not even root can mess with. Not to mention Google will have to wonder if now's the time to wrest more control of the base Android OS from the carriers so they can better handle something like StageFright in the future.
[Nexus 5 Q&A, Help & Troubleshooting] Stryke_the_Orc:
The security checks (SafetyNet) deal with the possible breaches, or at the very least, remove liability from Google in the event that Stagefright is exploited. The major concerns that deal with this thread, are rooted devices. They deny access for the reason I stated above,

a hacked device is a hacked device.

This is the major concern for banks as well, because in the event of a breach using an "unknown or unpatched exploit"

Google can't be held liable for zero day exploits, it's unknown to them so they can't defend against it

Google is patching and pushing security updates monthly, if there is a viable patch put out by them, they aren't responsible if it is used against your device because the manufacturer or carrier bottlenecked it

Bottom line is, you'll never be fully secure, and as long as you root your device, it will never fall into that chain of trust.
[Nexus 5 Q&A, Help & Troubleshooting] Surge1223:
This thread is so embarrassing. We had the chance to work with Google, instead people decided to have a pissing match and use this thread as a forum to vent their frustrations with the "limited" ability of root. Then many go on to site their experience in the Linux or security research community only to provide credibility to their opinion....

All while no one actually tried to discuss how the security checks take place, what they do, and why they fail, what widevine is, how oemcrypto works to check system properties, or even how through all of this a scm call is made in secure context to the trustzone.

Also these petty differences on semantics just make us look like more of a idiotic crowd. I know I can't request for a thread to be closed, but if I had one "close this thread because it's embarrassing" card, this thread would hands down be what I'd use it for.
[Nexus 5 Q&A, Help & Troubleshooting] Stryke_the_Orc:
Agreed. Wish Granted.
[Nexus 5 Q&A, Help & Troubleshooting] Joshmccullough:
I tried using Android Pay at the local McDonald's yesterday; Google Wallet via NFC has always worked, but Android Pay gave me a message to the effect of "[Credit Union Debit Card] is not available for use through Android Pay at this time...." I assume that message is different than "your phone's rooted, sux to be you" since I'm able to open the app, add cards, etc. Can anyone confirm this, that my Android Pay is otherwise working, save for my credit union just not being on board yet?

I'm using the downloaded Android Pay app vs. the actual 'upgrade' from the old Google Wallet, btw.
[Nexus 5 Q&A, Help & Troubleshooting] luigidk:
That is the same problem we are all having
[Nexus 5 Q&A, Help & Troubleshooting] Joshmccullough:
Durrrr, that's what I get for not reading more closely at the thread posts. If I could give you those 5 seconds of your life back, I would. My bad :)
[Nexus 5 Q&A, Help & Troubleshooting] Citizen_Snips:
No I still had the issue of it not letting me add any cards. I enter the 3 digit security code as promoted and then I hit accept. From there it loads for another few seconds then tells me it cannot verify the OS I am using is android or android compatible and that android pay cannot be used

Edit: I got this email today. So maybe soon? :D
[Nexus 5 Q&A, Help & Troubleshooting] ratflinger:
Just used the OPs method for my root but otherwise stock rom Nexus - worked just fine. Accepted my AMEX & got the confirm email. Like the OP said, under SuperSU setting uncheck the 1st box and that unloads SuperSU, setup Pay & reclick on SuperSU. It comes right back up rooted.
[Nexus 5 Q&A, Help & Troubleshooting] dcwiker05:
I have an LG G4 And even rooted I could get to the point where I was able to add a card, but I get this error every time I try... Even did what the op said disabled root cleared data etc

Request failed

An unexpected error has occurred please try again later.

Been trying for days :/
[Nexus 5 Q&A, Help & Troubleshooting] Citizen_Snips:
Tried dozens of time, literally. Does not work on pure nexus project no matter what.
[Nexus 5 Q&A, Help & Troubleshooting] Joshmccullough:
Same here, Cataclysm ROM, no dice. It teases me by not tossing up an error while setting the whole thing up, but i can't use it to pay.
[Nexus 5 Q&A, Help & Troubleshooting] zymphad:
Twisted ROM. No dice. Stock DPI and disabled SuperSu. Old Wallet worked fine, this is annoying.
[Nexus 5 Q&A, Help & Troubleshooting] Citizen_Snips:
Extremely annoying. The old one worked on any custom ROM just fine. Why did they even split the apps? Seems counter productive to me. I was using NFC to tap and pay in 2011/2012 with my galaxy nexus yet I can't use it today with my N5 lol. What gives, Google?
[Nexus 5 Q&A, Help & Troubleshooting] dcwiker05:
I was wondering the same thing, why can't they integrate wallet into pay and have it be one app, why ha e a separate app just for p2p money transfer. I also thought the same thing when they split docs/slide/spread why not have one app like office suit pro etc. And breaking street view out if maps, if you're gonna take it out of maps, integrate it into earth, it doesn't need to be it's own app. I like having the lest amount of apps possible on my phone and Google has slowly taken 3 apps and split them into like 10 -__-
[Nexus 5 Q&A, Help & Troubleshooting] ozzmanj1:
I went into my Superuser app and unchecked superuser access fired up Android pay and it work without any problems then I went back to superuser checked it again to allow root rebooted my phone for good measure and all is good. I have root still and Android pay access
[Nexus 5 Q&A, Help & Troubleshooting] silvertrain78:
Which ROM?
[Nexus 5 Q&A, Help & Troubleshooting] ozzmanj1:
Apologies, I guess it would have been helpful if I mentioned it. I am running stock
[Nexus 5 Q&A, Help & Troubleshooting] silvertrain78:
Thanks... Yes, the ROM is important. Android Pay is working for stock users (who temporarily unroot); we're trying to figure out a solution for custom ROMs.
[Nexus 5 Q&A, Help & Troubleshooting] zymphad:
Android Pay is crapping on AOSP.
[Nexus 5 Q&A, Help & Troubleshooting] msgfromside3:
Are you able to make a transaction with root on? My chase card gave me a crap and I am wondering if it is because I made the transaction with root enabled or chase card's problem like others are saying. I haven't tried again, but wondering.

But yeah, Google broke the experience completely. Wallet worked just fine and now AP is broken.
[Nexus 5 Q&A, Help & Troubleshooting] HTCore:
For all banking and credit stuffs, it seems that entirely different entity than Google controls Android Pay. It might be the reason that they separated from Wallet. Though, I think in near future we will see both in one single app.
[Nexus 5 Q&A, Help & Troubleshooting] Joshmccullough:
Found this article while browsing through Reddit:

https://koz.io/inside-safetynet/

If I'm reading correctly, this is the reason why APay's not working for custom ROM users? It's all Greek to me, I was scrolling down through this like Wayne in 'Wayne's World' reading the contract he signed:

"Yes...uh huh...yes....mmmm, I like what you've done here....yes....."
[Nexus 5 Q&A, Help & Troubleshooting] baknblack:
Sounds pretty darn tough to bypass.
[Nexus 5 Q&A, Help & Troubleshooting] niteh@wk:
Google is giving root/custom AOSP ROM users the finger on AP. How is AP ever gonna take off with these restrictions. They initially did similar with Wallet, that didn't go so well. So they introduced HCE (host card emulation), it was working perfectly. Now they messed up again.
[Nexus 5 Q&A, Help & Troubleshooting] Joshmccullough:
Agreed. If they want adoption to take off, maybe making it accessible to the earliest of adopters would be a good idea. For a company that's made its fortune off advertising, they did a horrible job of advertising Google Wallet to begin with. I'm constantly explaining what the Google Wallet card is to restaurant staff, people at stores, etc.
[Nexus 5 Q&A, Help & Troubleshooting] WhosAsking:
Just my two cents, but perhaps Google didn't have a choice in the matter. Remember that new PCI-DSS rules go into effect in October, which among other things requires the enabling of CHIP cards (which are intended to block replay attacks in a similar manner to how NFC transactions work). Given the fact that the banks now have a say in whether or not a card is accepted into Android Pay, perhaps Google is required by these new PCI-DSS standards to include higher degrees of security or face fines and possible legal penalties should they be sued. This may also be why Android Pay was split off of Google Wallet: Android Pay includes all the mandated stuff.
[Nexus 5 Q&A, Help & Troubleshooting] iamxaq:
My experiments

So this is what I have discovered on my Nexus 5 (using Cataclysm) regarding Android Pay.

-will not work at all if xposed is installed

-yes, unrooting via SuperSU allows the entrance of a card, however...

------if the phone has been rooted at any point following the entrance of the card, it will no longer work to pay at a terminal

-----------this holds even if you unroot before you pay; you have to unroot, add card, and pay without having ever rooted while the card was registered to your phone

No workarounds, apps, or xposed modules have had any success in my experience. Basically, they broke Android Pay for power users in much the same way Google Wallet was initially broken. Hopefully they'll fix it. Maybe not. I enjoy paying with my phone, particularly at vending machines, but I am at a place where I can no longer do so.
[Nexus 5 Q&A, Help & Troubleshooting] WillJitsu:
Good info. Thanks!

I am also running Cataclysm on my Nexus 5. I was able to add my cards by un-rooting via SuperSU. However, I was not able to make a payment because I had re-rooted (re-checked the box in SuperSU). I also found that un-rooting just before making the payment did not work. It's good to see that it would have worked if I had never re-rooted after adding the card. Hopefully Google makes some changes regarding rooted devices, or the community figures out a workaround.
[Nexus 5 Q&A, Help & Troubleshooting] iamxaq:
I'm lucky in that we have a vending machine at my internship that sells bottles of soda for $1.10, so if I randomly buy a bottle of soda, no big deal, and if my experiments didn't work, no big deal. But yeah. I can't use AP now because there are too many things with Tasker, AutoApps, and GMD Gestures that I use that need root. I honestly don't understand how someone could use a phone without root, I am so used to those things.
[Nexus 5 Q&A, Help & Troubleshooting] Joshmccullough:
Good point, never considered all of that.....

You're definitely lucky, I couldn't tell you the last place I saw a bottle of soda for $1.10! :)
[Nexus 5 Q&A, Help & Troubleshooting] dcwiker05:
My work has them for a buck! I was shocked lol.