[Magisk] pndwal:
Actually 'root' (including simply unlocking bootloader) does break L1 for many (most?) devices, including, notoriously, OnePlus (although @Event_Horizon confirms his late rooted OOS 12.1, OnePlus 10 Pro Device has L1 Widevine security). See below. 😉

Also, OEMs are not charged for this certification. They are not required to enroll for Certified Widevine Implementation Partner training either, which may account for varying security / attestation implementations between OEMs and models:

https://www.widevine.com/

More:

https://www.androidauthority.com/widevine-explained-821935/

I can confirm that for my RN8T also, neither failing Basic integrity and CTS profile match nor Device is not certified Play Protect result is detected by the Widevine DRM content protection system and security level remains at L1, but perhaps it should be detected...

Re. Benefits of adding Netflix to Magisk DenyList [Edit: none since 5.0... should read:] of Passing SafetyNet

Apparently some late Xiaomi devices do lose L1 security on unlocking / rooting etc (or sometime later) eg. Mi Pad 5:

https://xdaforums.com/t/guide-xiaom...p-by-step-pass-safetynet-widevine-l1.4412555/

Mi 9:

https://xdaforums.com/t/relock-bootloader-for-widevine-l1.3956099/post-80043225

Poko F3:

https://xdaforums.com/t/k40-gaming-widevine-l1-certificate-does-not-exist.4425049/post-86673291

It seems that for many devices Widevine is detecting 'root' (really means attesting that TEE is broken, ie. [Edit: wrong terminology here] a non-Trusted Execution Environment) however (Oppo, Realme, OnePlus, many Pixels etc), Widevine security drops to L3 and therefore Netflix will no longer handle HD content, meaning that passing SafetyNet is in fact important for many devices including Xiaomi (see above, and various custom ROMs, eg: https://xdaforums.com/t/root-widevine-l1-for-neflix.4181651/post-84763863 )

Things were different for Netflix users before v5.0, when NetFlix app apparently directly polled SafetyNet. Now SafetyNet only seems to affect users who's device specific Widevine implementation itself is polling SafetyNet API. Netflix said:

Some (eg OnePlus users) have restored L1 security level by flashing late EU region ROMs, spoofing an EU device fingerprint, or by other tricks. Some only need passing SafetyNet w/ Magisk:

https://xdaforums.com/t/widevine-level.4256479/post-84800477

I'm not sure if Widevine implementation is actually broken on our Xiaomi models, or if proper attestation to TEE in Widevine is simply not required by Google... This does seem to be inconsistent with Google policy however.

Some devices not only lose L1 security status with bootloader unlock, 'root' etc, but apparently restoring all images and relocking doesn't restore Widevine attestation to TEE or L1 security status. There are solutions in many cases however. For instance, many Oppo users with locked devices are able to restore L1 by running a special apk from an Oppo service department. Here's one an XDA member uploaded that works for many:

https://xdaforums.com/t/fix-for-widevine-l3-to-l1.4115977/post-82989917

Other users in that thread only had success after obtaining an apk from Oppo specifically matched to their IMEI...

On some devices flashing stock persist or vendor partitions may restore L1, but in many cases, incl. where users have flashed persist from another (same model) device, keys and L1 security are lost and a device-specific backup is apparently the only solution:

https://xdaforums.com/t/android-terminology-you-must-know-before-toying-with-your-android.4286651/

So whether DRM keys are retained with bootloader unlock or not seems very much to depend on the OEM / model. Eg many Sammy users will be fine, many OnePlus users won't...

A recent issue with late Pixels falling back to L3 has just been fixed with Android 12L updates also:

https://www.androidpolice.com/android-12l-feature-drop-update-fixes-widevine-l3-issue-for-many/

Supplementary - More on Widevine DRM:

- https://developers.google.com/widevine/drm/overview

- https://source.android.com/devices/drm

Regarding TEE = an OS in ARM Trustzone (runs on the same processor as the Android OS, but isolated from the rest of the system by both hardware and software), here is Google's Trusty TEE (a 'Secure but open source TEE'). Nb. OEMs are free to implement various TEE OS's:

https://source.android.com/security/trusty

-------------​

For @Event_Horizon on OnePlus 10 Pro w/ L1 Widevine security, this is all immaterial however; Still seems to me he has a network access / blocking issue. 😜

👀 PW