[Magisk] pndwal:
mmm

I know I'm going to get bashed by some here if I simply appear to be defending the corporate giant that is Google, but I'm simply interested in being real / separating reality from conspiracy theories and misinformation etc... So here goes anyway...

Firstly, I certainly didn't intend to infer that you meant Google has "increasingly creating their apps to be non-functional or crippled in rooted/modded environments"... I simply pointed out that 'Google has clearly been in no great rush to fix' the attestation banks etc wish was foolproof and useable today... Of course it is the 3rd party Devs who are adding detections to prevent non-sanctioned use of their apps and not Google...

Yes, but where's the evidence Google has been supplying tools for this??

There is evidence (from crash logs etc) that banks have been using published Momo, Magisk Detector and similar code / methods... This means that vvb2060, Rikka and other Devs who contribute much to Magisk as well as modern hiding techniques have also certainly aided banks*, but any suggestion Google has done this beyond providing attestation through S/N and PI is, AFAIK, anecdotal at best...

* Momo's stated purpose may also be enlightening:

Sure we do... That's always been what the game of cat and mouse entailed, only efforts by Google have recently been focused more and more on strengthening hardware evaluation type and now strongIntegrity which are as yet unusable or unenforceable by banks for practical purposes, meaning Google has become a somewhat sleepy cat and that banks have been forced to assume the role of Cat themselves...

Moreover, with John's growing disinterest in things 'hiding' (going back some years now) as well as his relatively recent tenure w/ Google and it's clear implications, he has also quit the role of mouse, but other devs had, by this time, already been ducking from the new Cat on the block and these and more have thus responded to John's "heads up to the community so those who are still passionate about hiding can start "doing their job" 😉"

www.twitter.com/topjohnwu/status/1445598600143073287

... This has made both other Devs as well as enterprising users passionate about the hiding game the new Mice on the block...

Yup... This will always necessarily include some apps for good reason.

However as my citations in posts above show, not only does John consider the 'MyMaccas' root detection situation 'ridiculous', an abuse of Google's attestation service and one that 'creates a hostile ecosystem against hobbyists', but Google are themselves "brainstorming solutions on how to deal with the "root detection abuse" situation"...

I guess we can hope they succeed in what John advocates, that android Devs "restrict hardware-backed SafetyNet evaluation to "real" security sensitive apps" and that "Developers should go through an application process to qualify this level of API access", or some other effective means to stem such abuse / hostile actions...

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-87541365

I certainly share your concerns on this matter but clearly all is not yet lost... Seems more checks and balances may well be introduced before these apps try to shut out modders by means of strongIntegrity response...

The point I'd like to make is that with what Google has introduced so far, we're still in the game. 😉 ... strongIntegrity is simply to onerous to implement as yet for banks...

Yes, these are getting inventive and going well beyond the means Google provides or endorses, but w/ deviceIntegrity we can still use Bank apps with a high rate of success...

What's more, I believe that Google could easily have offered an attestation service that combines proper HKA to device model along with device integrity responses in PI API. This would have enabled banks to shut out most modders already as they would then be able to enforce strongIntegrity on a per-device basis (and we couldn't spoof a different device) as they could also exclude devices w/ broken keymaster implementations and pre-Android 8 devices from such enforcement if they wish...

I'm not using the word 'easily' lightly here either; I see no reason why this wouldn't be a trivial thing to implement and the banks would love it!...

This begs the question 'Why have Google not really improved on the old S/N API very much at all when they could have made PI a useful and foolproof alternative to the bank's custom detection methods so easily?'.

Seems to me Google is actually acting to prolong the Cat and Mouse game (as long as possible?) when they could easily have ended it for most of us years ago if they really wanted to... Could this mean that they don't really want to?... Perish the thought!

Either way, it seems Google is still fighting to keep Android's advantage as the only established moddable mobile OS safe... In this sense (even if only for commercial reasons) they're batting for us surely...

This said, we also need to accept that some tough corporate decisions that will likely lock us out of apps with legitimate security concerns will be made... I wouldn't be surprised to see tangible proof that they've been stalling however...

-----​

Anyway, that's my dose of reality / take on it... Bring on the insinuations and innuendo guys...

Actually I'm tiring of that...

I have no problem at all with dissenting views, but do everyone a favour and state plainly what you mean... And include some respectable intelligent reasoning... 🙄

(To be clear, the last remarks are not directed to the member I'm responding to... at all...)

🤠 PW