yashsingh1/xdaforums huggingface dataset:
[Magisk] Didgeridoohan:
Restoring from the app is easier (as long as it works, there are instances where it doesn't)... That should be about it.
[Magisk] HippoMan:
This situation with John provides a good illustration of the "single point of failure" problem. Whatever might or might not occur in the future concerning John, we are pretty much at the mercy of fate unless we spread out the knowledge about Magisk and have more than one person working on it.

I wish I had time to be one of those people, but issues in my personal life make that prohibitive right now. I'm hoping that some more people might be able to contribute. vvb2060 is one such person who might be able to help, and I hope that there are others.
[Magisk] dd805bb:
Oh that wasn't the only thing said. Other tweets are deleted too. You really think there isn't a conflict of interest now? You don't think Google knew what they were doing? Think about it. They hire the one guy that still has an app bypassing their security, you dont think they did this without knowing they were gonna shutdown Magisk? I think John thought he was going to be able to, right when I saw that I knew. Guarantee when they hired him he signed work agreements that stop him from working on magisk. Also his Twitter no anything since being hired. I know he has said more behind the scenes, but the end is near, Google will put it like this, paycheck or Magisk? Which do you think he will choose? Tank a possible career for a huge company, or save magisk for a couple thousand people for free? It isn't rocket science.
[Magisk] J.Michael:
@73sydney Have you tried using a browser?
[Magisk] Didgeridoohan:
The only conflict of interest would be with MagiskHide. Google have stated several times that they have no interest in preventing root...

And the future of MagiskHide would have been with zygote injection anyway, so it would be perfectly suited for an Xposed/EdXposed/LSposed project if it no longer can be a part of Magisk.

But all of this is speculation before we hear anything from John...
[Magisk] 73sydney:
What for the digital card thing...yeah they trust the browser less so the digital card is not available for viewing on there...

I'll just have to go into another bank on monday, and then transfer all my money across, bar enough to keep living on, until their card comes in the mail :)
[Magisk] HippoMan:
Could you use the digital card in GPay, once you receive the new card, and then use the browser version of the banking app?

My card worked for me in GPay with my particular bank, subject to the issues I reported in the past concerning GPay. Those issues were the same for me, irrespective of whether or not I had that bank's Android app installed.

But perhaps your bank is different, and it sounds like a good idea to get rid of that bank, anyway, given the problems you've had with them.
[Magisk] 73sydney:
Yeah, no you cant, once Banks app rejects the card, then Google Pay does too

In fact the easiest way to spot that root has been detected by the bank app is when you have set fingerprint security for the app, and then open later and find youre back to a username/password login....you just know youre not having a good day that day

And yes, ive had enough, ill move to another bank.
[Magisk] dd805bb:
That is the most wrong statement. If Google didn't has no issues with having root, there would not magsikhide. Just that statement alone conflicts with itself. MagiskHide hides root... Google has a problem with hiding root and not root, then why hide it? Why is there basic attention and cts profile check? Now a hardware check? Root, on Android is what they don't want, or else there would be no need for a modified kernel, we would all have root like on Linux desktop... Any terminal on desktop has root instantly, Android doesn't.. They did pretty damn good job of taking something away they wanted to have all along right? Wow.
[Magisk] dd805bb:
Security risks with modified (rooted) Android versions - Google Account Help

Google provides device security protections to people around the world using the Android operating system. If you installed a modified (rooted) version of Android on your device, you lose some of the

support.google.com

Google doesn't even want you using a "modified system" to access your Google account. Google has major issue with root.
[Magisk] HippoMan:
I believe that Google does this because banks and other app providers are asking for this level of security. These app providers don't want to be responsible for security breaches with their apps on mobile devices. Google has decided to support these app providers and to tell them whether a machine is rooted. Then, some of these providers decide to restrict or totally block functionality if they discover that these devices are rooted or otherwise modified to be non-standard.

What's ironic about this is that most (all?) of those same app providers (especially banks) don't do a thing to keep people from accessing their sites via our desktop machines that you mention (all of which have root). I and every Linux and MacOS user has a "sudo" utility and a root account that the user has control over. Banks don't try prevent their customers from accessing their sites via the web on all of our rooted desktop machines. I'm not very familiar with Windows, but I believe there is a mechanism there which is also similar to sudo.

In my opinion, it's not so much that Google themselves are trying to prevent root, but that they are giving tools to app providers to allow these providers to restrict app functionality on rooted devices, if they so desire. And in chosing to do so, Google is giving a much higher priority to these app providers than to users like us who want to run rooted devices.

Of course, Google and their app providers all have the right to do this. However, we also have the right to try to bypass this security.

In my idea of an ideal world, Google would allow us to opt out of SafetyNet and all other such security measures that they might offer. In return, we would have to sign a release which says that we will not and cannot hold Google nor any app providers responsible for any security breaches which could be shown to be due to our running a rooted or modified OS. I realize that it will be a cold day in hell before anything like this is offered to us ... but at least I can dream.
[Magisk] DiamondJohn:
I dont normaly join speculation, but a couple of points that just scream in the back of my head.

The discussion of what google wants is misleading to me as google is not one single consciousness. There will be conflicting thoughts (probably in fighting) within google and some of that conflict & contradiction will end up in the final product or even just the public presentation. eg "google says they dont wish to disable root" yet they also need to ensure banking financial apps are not compromised.

I also think that we now have to assume what topjohn says publicly will now be measured by the fact that he is working for google (and I wish him all the best in this move), and he would understand his future career prospects could be limited if he says the wrong thing or makes internal private google information, public.
[Magisk] ipdev:
Having access to root has nothing to do with Google.

Android itself has a root access.

The link you point to states nothing about not using root.

It only points out that root and/or a modified system is a security risk itself.

So, Yes, Google's security may be less secure because of it.

This is also why some apps error on the side of caution when root/modified system is detected.

I just reread Google's Terms of Service, I did not read anything about root access.

I might be in the minority but, I do read the ToS before I agree to follow them.

There is no mention of restriction or not being able to access your Google account if your device is rooted.

Cheers. :cowboy:
[Magisk] ipdev:
You have the option to not use Google Services. :)

As for signing a waver, Google is only the middle man between you and your bank.

You would have to contact your bank to wave liability between you and them.

Your bank will probably refuse since you would become a security risk to them every time you connected to them.

There is a difference how su is controlled on BSD, Linux and MacOS.

Yes you have sudo access and also a specific root user.

There are also securities in place for different groups like wheel, sudoers, ...

If Android implemented su the same as BSD, Linux and MacOS then it might be a different story.

Cheers. :cowboy:

PS.

MacOS is based on BSD.

MacOS/iOS kernel is darwin.

Apple - GitHub - darwin-xnu - Link
[Magisk] dd805bb:
Mac the specific sudo user is you, when you type your password. There is no special user. You elevate your own privileges to root. Linux is the same way. You can create a new user specifically with only or without root privileges, but you don't need to make a sudo user on Mac. These are some of the most bogus claims. And yes Google can lock you out of your account for root. "Compromised" read that part again. And this is only their answer to security risks involved with root. I am pro root, but to say Google doesn't care, then why have all this security to check for root? Sounds kind of weird if they don't mind root, they prebuilt a system that has no root access. And no Android doesn't have root either. That is another falsehood. You can't just flash a GSI and have root. Doesn't work that way. SU is non existent in Android at system/kernel level. You can't just open a terminal and type su and or sudo or anything like that. Please explain to me where instant root access is in Android, I will wait....
[Magisk] dd805bb:
How to enable the root user or change the root password on Mac - Apple Support

Mac administrators can use the root user account to perform tasks that require access to more areas of the system.

support.apple.com

Simple process. Scroll down to change password. Instead when it says change password greyed out, enable yourself root acces. No need to create a new user. Close it all, terminal and system preferences, then open terminal and type su, instantly in the root directory. Been a few years since Linux desktop and Windows but almost same process. There is no extra binary to install, no extra flashed boot image, no need to create sudo user because they think it will compromise(there is that word again) your system and don't want the main user using su and or root. Darwin is its own when compared to Linux kernel, but same logic between desktops. I have never heard you need to create a specific user for Mac and I have been using root for Mac for years. Never ran into an issue where I needed a specific root/sudo user.
[Magisk] HippoMan:
The security policies for wheel, sudoers, etc. are totally controlled by me on my machine. No third-party app has any choice in the matter, nor do any such third-party apps that I know of make any effort to see which user ID's are part of the wheel, sudoers, or any other groups. Also, no banking sites that are accessed via browsers from our desktop machines make any effort to try to check anything about these security policies. My browser could be running as root for all the banks know when I access them via my desktop browser,

Furthermore, I could be holding some bank-account-related info on my machine in files with "ugo+r" permissions ("ugo+rx" for directories), thereby making it visible to any processes. The banking site being accessed from my desktop browser would have no knowledge of these kinds of things.

Also, people's desktop machines can be hacked, and many security breaches are due these hacks. We run antivirus software, because we know that these kinds of breaches can be harmful. Anti-virus on Android would be no less and no more useful.

Google could pass on to any app provider proof that any given Android user has opted out of all security and has legally promised not to hold any app providers responsible for any security breaches. Of course, the app providers could still ignore this if they want.

Anyway, as I mentioned, I don't expect this kind of opting out to ever actually be offered. Again, it's just a pipe dream of mine.
[Magisk] dd805bb:
Might want reread their terms of service. Anything they feel is abusive, which does cover having root, lists third party harm too.. root access is part of that. Please stop the misinformation, it is there in black and white. And if you scroll further they can lock, delete, suspend of they feel it has harmed a third party app. They get pretty butt hurt over root.. just saying..
[Magisk] dd805bb:
{Mod edit: Quoted post deleted}

And the need to create a new user like you said doesn't exist unless you want to run su/sudo as another user. Root access is still available without the creation of a user like you said. The option to create any user and give root is still there which your pictures prove, but point about needing to create one isn't not a needed step. And still brings me back to Android, the "su" is taken out which brings me back to my OP that it is a huge conflict of interest John doing both, working on Magisk and working for Google. All this back and forth really has proved nothing except what I originally said, Android doesn't contain root like Linux, Mac, Windows or anything other desktop. Root bypasses security which is how MagiskHide works, at root level. Without root, there would be no Magisk, without Google's security policies, there would be no need for MagiskHide. This knit picking is really unreal to end up back at the my original statement. "No this or that." Total BS. This is why for me, it is an easy decision between a paycheck or helping people that really do not know what they are taking about. How many falsehoods claimed here by how many? When Magisk does end, this is why, too many people know it all but don't actually research what they say. Simple Google searches,(irony), have proven everything told back to me very wrong. Even trying to quote policies lime I won't go read them. Wow. This is why the root community gave up before Magisk when SuperSU was a thing. Too many know it alls. A lot of the original devs for popular root apps to this day left this community, tired of this nonsense. And in today's world, a simple search proves most wrong. Me personally, I don't like giving out false information. Seems to be the way of XDA the past few years. And remember bottom left button to report. LoL. Goodluck.
[Magisk] F308:
Well.

It reminds me Matrix movie, where was said that I am not enjoying of idea of not to be master of my own life, in this case phone.

I paid what was requested but got 100-150 applications which consume my Gigabytes for which I pay and I cannot remove them and am forced to watch crap I don't want to watch.

I understand that companies protect people from themselves as they, if they could, would destroy whatever possible then come with warranty and require company to repair their mistakes.

However I am not average user, I don't agree with above then I hack my phone and I know I am responsible for final effects, unwanted ones included.

Yes, other companies refuse to run their apps in such environment and this is completely OK.

Live and let live.

That would be fair enough for me.
[Magisk] Wolfcity:
Just an info if it hasn't been discussed yet.

As you can see in the post above I tried to update my testing device from Magisk 20.4 to 22 (or now to 23).

I had a lot of help by @pndwal but couldn't find the problem at that time.

Now I found out that my main fault was the way I copied my patched boot.img from the mobile device to my desktop PC.

I did that by MTP and after flashing it I ended up hanging on the bootscreen everytime and the device was only able to boot into fastboot mode.

So that's what I did this time:

Extracted the boot.img from my actual ROM.

Disabled all modules.

Unhid Magisk app and uninstalled it.

Installed Magisk 23 (former called app).

Patched my boot.img.

All these steps were done inside Magisk.

Now used the ADB pull command instead of MTP connection to get the patched boot.img onto my desktop PC

Boot device into fastboot mode:

adb reboot bootloader

Flashed the patched image by fastboot:

fastboot flash boot name_of_patched_boot.img

Done.

Device booted to OS, Magisk 23 was up and running, root working.

Activated my modules one by one (activate - reboot).

Edit: Later I tried to upload the patched image to Drive and download on PC. That worked too but I recommend the method using the adb command!

Thanks againg to @pndwal for his help!
[Magisk] pndwal:
Can they? Do they? I've seen no evidence they lock out!

I know SafetyNet will trip for non-verity (unlocked bootloader) etc, but this only triggers SafetyNet / Device certification, affecting not much more than GPay among their own proprietary apps, as mentioned above. PW
[Magisk] pndwal:
Glad you caught the wily fox!

ADB pull is prescribed in John's instructions:

Shows he knows his stuff.

He also says:

... But he put that in the Sammy section. 🙄 😛 PW
[Magisk] Stillhard:
Good news to all of you using MomoHider (well, i am) 😊

canyie updated his module's readme to be mooreeee friendly to understand here
[Magisk] Wolfcity:
Yes, we tried a lot to catch that creature!🦊

And I knew I heard/read to use adb pull instead of MTP somewhere....

Now I feel a lot more safe to update other devices.

Thx again!
[Magisk] Didgeridoohan:
This whole discussion took a bit of a turn, and I'm not gonna get further into that. But, you might want to reread what I said again: "Google has no interest in preventing root". That statement doesn't say anything on how Google think about root in security terms (and I'm talking about the Google security team here, which John now is a part of).

We're talking about different things, I believe...

You're talking about the security aspect, which Google cracks down on (since generally, rooting a device compromises the systems security), and I'm talking about just being able to root your device regardless of if SafetyNet triggers or not.

If they wanted to, Google could make it so much harder (impossible?) to root your Android device... From statements I've seen from Google security team members, that's not on their agenda. But of course, beefing up the security on Android in general might have the unfortunate side effect of accomplishing the same thing.
[Magisk] pndwal:
What's wrong with it?

You can have root without MagiskHide, even in Magisk. Just switch it off!... And you have to switch it on. it's off by default!

But that's exactly what was said: Hiding root (MagiskHide) may be a conflict of interest!

But are you thinking MagiskHide is simply to hide root from Google? ... One hides it so ANY app checking SafetyNet API can run!

To attest to TEE; Trusted Execution Environment... But Google doesn't stop much more than GPay running with SafetyNet!

There's another 'most wrong statement'!

They allow you to unlock bootloader an modify kernel, or anything else if you wish, BY DESIGN! Only OEMs like Huawei try to prevent this; Google don't. Google simply implement a series of flags to attest to bootloader status etc, warn you about security risks, and then say 'go for it!'.

And how have they taken root away? That's Apples domain! As I see it, Android is a still completely different ecosystem.

It's a given that they view spoofing, circumventing security model, and most likely MagiskHide as abuse... But isn't that what was said?

Don't forget that many ROMs use the same spoofing techniques as MagiskHide WITHOUT root to pass SafetyNet etc. Root is NOT the issue here, neither is having an environment with weak security. But altering Google's built in attestation to that environments status (non-verified boot, etc), is, of course. And Google don't want ROMs doing this any more than a root solution.

In any case, John has described MagiskHide as just a bit of fun and not the main purpose of Magisk. And many here will see the removal of MagiskHide as no great loss.

Others won't. PW
[Magisk] timofonic:
Does Magisk work with BBVA Spain app? I want a Dr.Ketan ROM but able to use my bank app too.
[Magisk] 73sydney:
A quick search (gentle hint: you could have done it) tells us that no one has mentioned it before, so you get to try and see, which is what many of us do here.
[Magisk] timofonic:
I understand, but I can't have a bunch of phones to try and I use my mobile extensively enough. I only have this one and the old one. I understand this is a volunteer community, anyway. Thanks for your reply.
[Magisk] 73sydney:
Nothing is guaranteed, if you look at my last few days posting you'll see ive had issues with my own banking app, that two weeks ago had no issues, but now fails....theres no guarantees. magisk is designed to be reversible...you can remove it and revert to the way it was before if needed...
[Magisk] digger16309:
I don't post in this thread often, but I follow and read it even though most of the technical discussion is way over my head.

Even though Magisk is currently used for both rooting and also to pass Safetynet, there is a BIG difference between the two. Surprisingly, I don't have a need to pass Safetynet at the moment, nor hardware attestation. I don't even check it or try any known solutions to do so. But I do want my device rooted for many reasons.

I get why people are wringing their hands about Safetynet, but John himself said it was only a matter of time before hardware attestation would become difficult if not impossible to overcome once Google hit the accelerator on it. With or without John, that alone was and is going to be the biggest challenge for apps detecting root.

Rooting with Magisk or Magisk Lite, or Nagisk , or Pagisk, or whatever a fork will be called, is not going to be shut down by Google. Detecting root is completely different and was/is going to be an uphill climb with or without John.
[Magisk] dd805bb:
I think there is a lot that don't get, Google is not Android. Google blocking root is them blocking services. I never said Android AOSP was blocking root. This is where knowing the difference between Google and Android helps people. Yes Google(their plays services and all services) can block you from your account for root. No they can't block someone rooting their phone and that I never said. There is a lost and in translation here. My references towards the simplicity of su/sudo to Google and their services that don't work with root. Google doesnt care for a desktop having root and using their services but on Android it does. That is what I was pointing out, then it went into left field you need to do this or that to gain root on a desktop, no crap, you can not gain root the same way on Android, you must Magisk now or old way SuperSU zip. There is no extra on desktops to gain root. The notion AOSP has root already is a falsehood that was stated. No Android doesn't care if you have root, Google does and it's services which a lot of apps outside just Google can detect root. MagiskHide doesn't work without Magisk being installed with root. Magisk and MagiskHide are one in the same. There is no separate apps. That is my point lost here. The conflict of interest from Google's stand point,(Magisk and MagiskHide are the same app). So the pin they only care the Hide app is moot because literally they are the same app. And again I stated the conflict of interest is there, whether you want to knit pick at what part of the app is conflict, they look at the app as a whole. There is no different parts for them. I am still waiting for the steps on a GSI to just have root like the claim here is or proof Google(their services) doesn't care about root. All these things and mechanisms they have for detecting root but they care about it is a little weird for them to do. And again know the difference between Google (not Android ( and AOSP. Two completely different things people on here keep bundling together. Google is what I always said. Never have I said they will block your OS/AOSP modified system or even their own on their devices. Google blocks it's services. Google is not an OS. Android is.