yashsingh1/xdaforums huggingface dataset:
[Magisk] Barkuti:
All banking apps working you say? :unsure:

Could you please try DB Secure :poop: Authenticator? Even if it's just for fun, of course. A few months ago I had to deal with this @#$% on a friend's rooted Android 9 smartphone. Versions prior to 4.x would complain about the device being rooted, but work; but since 4.x, the application straight out crashes. I installed the workarounds described here until ApplistDetector would show everything good or only complain about TWRP, but to no avail.

Of course I told my friend to keep using the older 3.x version of DB Secure Authenticator.

Note: the quote was corrected.

Of course, even if I cannot look at Google with good eyes because of what it is doing to Android, Google is not stupid in this regard. And yes, what these banks and their apps are doing is an abuse. In fact, it is a form of discrimination (like hate crimes), because using a rooted or modified Android system only means that we are making use of our administration rights by running as administrator or super user; and this is not against law or bad in any way! This is completely lawful and is our right to do so.

It's them who are wrong and have demonized this by looking at it with fear instead of embracing the fact that users can run rooted Android systems. Period.

This, in fact, is liable to be presented as a complaint in a court of law; and it's a guaranteed win for us, rooted Android users.

What is more, the list of offenders is quite large, doesn't it? Many banks, for example; so big pockets, big pockets which need some slimming because of this abuse… :unsure:
[Magisk] HippoMan:
Some apps will report that they won't run (or won't run properly) merely if the bootloader is unlocked, and even if Magisk is not installed.

And I think that sometimes the error message is ambiguous in this case and might *seem* to be saying that the device is rooted, even though only indicating that the device has been modded.
[Magisk] HippoMan:
I'm not sure whether this would fit the legal definition of abuse on the part of the banks, but it does indeed fit the definition of stupidity.

These same banks allow us to access their services via rooted devices such as desktop computers running Windows, Linux, and MacOS. And yes, these OS's come rooted -- out of the box -- in the same way that Android can be rooted.

And many of these banks freely issue us totally unprotected and unrestricted devices for accessing our money, and these devices are just as easy to steal as our mobile phones. These devices are called "debit cards".

But these banks stupidly go out of their ways to block access on rooted Android devices which are used by a small percentage of Android users and an even smaller percentage of the banks' customer base.

And anyway, given the existence of software such as NSO, mobile devices can be easily hacked even when they are not rooted.
[Magisk] gorman42:
Hi (ciao)! Could you be so kind as to describe in detail what you did in order for MPS app to work with root?
[Magisk] pndwal:
I certainly don't have all working, even on Alpha w/ U beaut NB-Zygisk!...

Seems to work with Alpha / NB-Z:

It's "bad" according to their security model...

Not Google's view... They believe App owners have the right to determine that their code is run in an uncompromised/trusted runtime environment... Their efforts with device integrity hardware backed and cryptographically attested API verdicts is simply an natural response to modders 'subverting their security model' by manipulating (spoofing) proper (expected) values, especially as they relate to Verified Boot and the later Android Verified Boot response keys...

Why?...

Google accommodates modders by allowing us to unlock and root. (Further, they've really been allowed us to play the cat and mouse game far longer than necessary as I've repeatedly pointed out... A device integrity API simply delivering device Keymaster version, which is already embedded in key responses, along with the current mechanism, could easily have given banks the ability to switch on strongIntegrity enforcement without making customers with old devices collateral damage as they could then be exempted from strong verdicts on the basis of keymaster... So who's benefitted from the all-in approach they implemented really?!)

They accommodate Banks by offering means (however weak or fraught) to determine if operating environment is 'secure' and thereby make the Android environment 'acceptable' for running/developing their code on...

They also ensure Android remains at least as competitive on the secure Mobile OS front as it needs be to remain relevant and viable, which benefits all of us... Sure, it must be quite a balancing act, but we should see the 'big picture'... Who likes the locked-down IOS model around here?

We all get to have our cake and eat it... Just don't expect to get all the cherries...

That reminds me... "You can have some of the cherries some of the time..." - Sorry... I digress.

To be clear, the abuse I spoke of was only the misuse of 'applist' data and other signals that should NOT be used in determining device compromise... Eg Google have taken measures to combat rogue 'improper' use of or application for permissions like QUERY_ALL_PACKAGES, and tightened requirements for other potentially compromising permissions in later Android...

They've never said properly detecting unlocked bootloader or even root constitutes an abuse however... (It's frustrated modders who feel that way.) 🙃 PW
[Magisk] gorman42:
Nobody, surely not me. On the other hand, reading this thread it's like a continuing horror story where monsters are betas, alphas, forks, modded versions and so on and so forth. All to be able to access the bank where I store lots of money? And they make *my* life difficult? The problem I have is not with Google. It's with the banks and with all other actors that, on Android, are exploiting the possibility to dictate how I should be using my device. It's not Google doing it, it's everybody else mostly.

Video streaming companies do it, only to have ALL their content in torrents available instantly worldwide. Banks do it, while they allow access through browsers on whatever OS the user prefers to use, on whatever level of security on the machine involved (that's the most laughable part).

And for this we see a life jumping through hoops. I am finally raising white flag. They have won. Life isn't long enough to waste so much time chasing alphas, betas and whatever else. I'm just saddened by seeing this state of things normalized by statements like "you want your cake and your cherries too". Sure I do. I paid hard earned money for both the cake and the cherries.

End of the rant. I'll be switching phone soon and, for the first time, I will do without root. I'm officially fed up with all of this ****.
[Magisk] pndwal:
That's the issue right there... and it's not just your issue...

Banks install vaults... And they lock em up...

Sorry about that chief...

I think John got this right years ago however... It was only ever a game... And a matter of time...

You won't be the first to retire from it early either... 😶 PW
[Magisk] J.Michael:
What confuses me is the reference to "apps that think your device is rooted when it's not" as an explanation for why, after installing Magisk, which incidentally "roots", he then installed some modules needed because of those apps.

I was looking for some explanation like "my device was not rooted, but some apps thought it was, so I was forced to root my device so that I could install extra modules to placate the stupid apps."
[Magisk] Lughnasadh:
Speaking from a U.S. legal perspective, a case like this would likely be dismissed very early and would never see its day in court. There is no law that I know of (State or Federal) guaranteeing users the right to root/modify their devices which would prevent banks from implementing security measures in their apps, even if those security measures prevented the app from working properly on a rooted/modified device.

It may be a moral wrong in some eyes, but it's not a legal wrong, civil or criminal.
[Magisk] HippoMan:
... and then they issue us unprotected debit cards for accessing our money in their (virtual) vaults.

... and they allow us to access our vaulted money via rooted OS's on our desktop computers, while not hindering nor preventing us from using root on our desktop machines.

... and all the games and businesses and government entities that we deal with from our rooted desktop machines do not give a flying f**k about the fact that these desktop machines are rooted.

... and we can mod our desktop machines to our hearts' content without that affecting our ability to access these banking and other services.

But rooted Android devices get special treatment with regard to being modded and rooted.

I'm waiting for someone to invent a "dual Android device": two complete devices in one case which share the screen, the buttons, the network software, the USB port, some shared storage (via an externally installable sdcard), and the SIM card.

There would be a manual hardware switch (without utilizing any software) which would be used to choose which of the two devices is accessing the SIM, network, buttons, screen, ports, and shared storage at any given time.

One device could contain a pure, pristine, virginal, non-rooted and non-modded stock OS with a locked bootloader from which we could do our banking, etc., and the other device could contain a Modded, Rooted, Sinful, Evil, Satanic OS with an unlocked bootloader for doing everything else.

I'd pay the extra cost for such a device, so that I don't have to end up being another person who ultimately abandons Android.

Of course, I doubt that I'll ever see such a device in my lifetime.
[Magisk] J.Michael:
Since you don't specify the extra cost you are willing to pay, buy a second phone. And hire someone to walk behind you so the second phone doesn't spoil the drape of your slacks.
[Magisk] HippoMan:
It's easier to just not do any banking, game playing, McDonald's hamburger buying, etc. via my mobile device.
[Magisk] J.Michael:
Or use a browser on the phone. As you have pointed out, that pathway is not subject to such stringent concerns about the Trustworthiness of the Execution Environment.
[Magisk] Barkuti:
Then their security model sucks, and 🖕 it. Period.

I am not speaking from a U.S. legal perspective, and neither from any “merchant law” or positive law perspective unless it is of service (as a being of Light, son of God and avatar of a wondrously elevated consciousness I only recognize Natural Law, if anything); I am speaking from a view of Light and discernment between good and evil, and I understand why things are the way they are. Googl€ is only interested in making sure their sales platform works, and as usually happens with these evil companies which are part of the evil control system in which society is (unfortunately) embedded, not only I don't give a dime for them, but I'd straight out destroy the control system in a blink if I were able (about this you can check this and that, if you will).

Next, I don't plan on writing up any kind of denunciation at least in a short timeframe; but if in the future I were to decide to take action, rest assured I'd “weave the subtle fabric of reality” in a way to ensure my victory.

Playing the cat and mouse is unnecessary; there is no need to make war with users with administrator privileges, although my guess is that they “know no better” (cough!). Plus, they don't allow us, it's us who allow ourselves. When for example you truly believe in your safety and the safety of your devices and OSs, nothing else is needed (no storage encryption, locked bootloaders, and etcétera); whereas if you don't believe in this or alternative equivalent ways and you also hold negative programs in your mind out of which you attract nasty experiences concerning these matters, then it's only time until your safety is @#$%, your device broken, stolen, etcétera. We're projectors of reality, we co-create it; so, I advice all of you to reprogram your minds and purify yourselves. Thanks and thanks for taking back your power.
[Magisk] HippoMan:
Exactly. And I indeed use a browser on the phone, at least for any occasional banking issues that I might once in a long while find necessary. That's equivalent to using a browser to access banks on our rooted desktop machines.

Of course, the browser on the device won't help with games or with purchasing McDonald's hamburgers.
[Magisk] spicediablo:
May I know if your setup works with the latest RHB app version 2.12.2?

Thank you.
[Magisk] pndwal:
There will always be those who'll look a gift horse in the mouth...

Personally, I like Android and find the emotive bashing of the company behind our moddable (by design) mobile OS (an 'evil' company??) that some post here distasteful.

I don't wear rose coloured glasses and I've called out Google for bad decisions relating to Android from time to time (on XDA), but i recommend being informed about whats real in order to avoid the disappointments encountered when our expectations are simply not...

AOSP is a fantastic free gift AFAIC, but be real folks!... It's for OEMs (who might not even let you unlock... c'mon Nokia!), for app developers (who might work for banks etc and want strong attestations to device security/integrity, or for streaming companies and might require TEE in hardware for secure DRM content decoding), for consumers (who generally want assurances of security and reliability), and lastly, for (a relatively small group of) modders (who want everything!... of course they do; they've been spoilt for too long. 😬)

For those who haven't already judged the company charged with keeping these four groups with their diverse interests happy while meeting their own commercial objectives (including remaining competitive and being perceived as a secure mobile OS) harshly, I put a few details about Open Source Android, it's production and proprietary GMS here a couple of months ago:

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-88810503

Here's something on Google's willingness to accommodate employed modders who 'play by the rules':

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-88740649

And a response to a member a year ago about Google's relationship with/view of modding community etc:

https://xdaforums.com/t/discussion-...ding-cat-and-mouse-game.4425939/post-87403921

👀 PW
[Magisk] mar.aimn:
To use HMA just install or need prerequisites? I'm maybe too old for a complex setups
[Magisk] zgfg:
You need LSPosed, you need to enable HMA in LSPosed, you need to configure in HNA which apps you hide and from whom apps

So please, find the thread on XDA, read OP post #1 there, find the link to GitHub and follow the Guide on GitHub
[Magisk] HippoMan:
With every new release, the Googlefrinchians make Android more and more difficult to manage.

Nothing like "strongly attested device integrity" is tested for on rooted desktop devices which run Windows, MacOS, nor Linux. God help us if that ever starts occurring, but I highly doubt we'll ever see it on those kinds of devices (hoping and praying!).

I, for one, absolutely do **not** want any kind of device upon which "strongly attested device integrity" is enforced. I am more than willing to take responsibilty for my own security and to pay the price if my efforts happen to fall short. But I'm stuck with Android now, so I have to hold my nose and continue to use my strongly-attested-device-integrity-checking-enabled Android device.

Modded and rooted Android is only in use by a minority of Android users and an even smaller percentage of banks' customer base. Going after rooted and modded Android devices is low-hanging fruit for the banks which has no effect whatsoever on the vast majority of fraud which occurs and which will continue to occur. It just looks like a good "security measure" to the banks' stockholders, most of whom are quite ignorant about these details, and it's much cheaper and less unpopular for banks to implement than any kind of meaningful security that actually *could* be effective against a significant amount of fraud.
[Magisk] sawdoctor:
I'm not a lover of Google or any big tech I'm FOSS wherever possible. But Google hasn't and probably never will force strong integrity on any of their apps. They have provided the ability probably requested by app developers. It is the app developers who enforce strong integrity that are the issue, Google isn't all though Google has done plenty of shady things
[Magisk] HippoMan:
I never said that the Googlefrinchians are forcing strong integrity on any of their apps.

Putting aside the discussion of strong-integrity considerations for just a moment, keep in mind that Windows, MacOS, and Linux OS's don't require encrypted system partitions that cannot be backed up and then restored to upgraded devices or OS versions. The Googlefrinchians are indeed responsible for *that* so-called "feature" (ha ha!), which prevents us from performing nandroid-like backups and restores in recent Android versions.

And back to strong-integrity considerations, the following is just my personal opinion: I consider it to be a misguided effort to offer strong-integrity checking in the first place. Windows, MacOS, and Linux don't offer anything like "strong integrity checking" for application developers to misuse like an increasing number of Android app developers are now misusing.

And yes, it's the application developers themselves (such as the banks I mentioned) who have most of the blame for destroying the usefulness of Android. If no strong-integrity enforcement was possible to begin with, it would be much more difficult for these app developers to destroy Android.

And to be clear, I'm not claiming that those developers are *trying* or *wanting* to destroy Android's usefulness. Most of them probably believe that they are doing something good and worthwhile. But those who think this way are (IMO) misguided, and they don't realize how much damage they are actually and unintentially causing.
[Magisk] Barkuti:
I completely agree with this. They are pestering a minority of empowered users (the users of rooted or modified devices) for unnacceptable reasons. Many years ago there were no handheld computers (smartphones) which could run applications and be connected to the internet easily; and back in these times we would access our banks via websites and make banking operations with ease. Now things seem to have turned out unnecessarily complicated, even to the point that certain banks require the use of a mobile authenticator application (example: the Deutsche Bank and their DB Secure Authenticator) for their users to be able to operate on their banking website. THIS IS RIDICULOUS. I am not a customer of Deutsche Bank, but a friend of me and his family are and this is the reason I know this. Also, their validator has a rather poor rating (2.2 out of 5), so you can guess it causes quite some havoc or difficulties.

Then, there is Revolut, a financial technology company which does not have an operational website. They just make an application to access their services (they have a website, but it is crippled and cannot work without validation from their application. This is another PATHETIC approach.

I know who I am, and I am fully responsible for my own security and the security of my own money. So, the bank(s) in which I am placing my trust in is/are only a projection of this related energy of me. Period. This also applies to anyone else, whether they are aware of this or not.

Having said this, in my lightful perspective the best approach is the classic one of accesing a bank via a website. The website of the bank runs on a server, and so it is responsibility of the bank. It also can be accessed using a web browser, which means that it is accessible from any device running a compatible web browser (the vast majority of computers, including tablets and smartphones). This is flexibility for the user.

Having said this, all of you who are using banks which enforce these kind of pestering false security solutions should retrieve all your money from them, and put it somewhere else where you are treated with dignity and without the need of @#$% devices or related pesterings. And if you feel like you can't do this or are unwilling to do so, please reprogram your minds or change your minds and co-create a better reality in respect.
[Magisk] HippoMan:
I'm sure you already can guess that I agree wholeheartedly with you.

Thank you!
[Magisk] Barkuti:
You can also read what I just appended. 😇
[Magisk] HippoMan:
Yes, just read it, and I agree with that, as well.

Sadly, most people will not follow that advice, however.
[Magisk] J.Michael:
I think there is some effort in Windows and Linux to discourage me from installing any software that is not "properly" signed.

Like Windows' Secure Boot, it hasn't been a problem for me because I can turn it off. So far. I have heard of Windows devices where the user does not have the option to turn off Secure Boot. I just haven't bought one.
[Magisk] zgfg:
Just one comment (I'm not going to write daily essays here and participate in these religious fights):

System partitions on Android are not encrypted - only Data is encrypted.

However, System partitions are read-only - of course, Data partition is not

Eg, if you can have TWRP on your new phone, boot to TWRP, do not enter your pin:

- on the /data and Internal memory, you will see scrambled file names and if you transfer files to PC (MTP works in TWRP!) you will not be able to open them

- on the /system, /vendor, /product, /system-ext you'll see all the files and you can read then (ofc, not binary but various Android textual and XML configurational files)

You are the Linux guy. You have root, install MiXPlorer, open /vendor/etc/fstab-*

and you will precisely read attributes for all your filesystems.

You'll see that /data is encrypted by FBE and that the mentioned System partitions are read-only (but not both or vice versa)
[Magisk] HippoMan:
I used lower-case "system" as a general adjective describing partitions or directory trees that are used for OS-managing programs, and I wasn't specifically referring only to the Android "/system" partition.

And I agree that I wasn't clear about "read only" versus "encrypted". My point, however, was that we are now unable to remove or modify files and directories within certain partitions.
[Magisk] HippoMan:
Even when there are some linux utilities that are signed, I can always write my own version of the same utility and replace the original. And I can delete any file I want from any directory in linux.

I haven't used Windows very much over the past several years, and so I haven't encountered any Secure Boot instances. But as long as Windows might be moving in that direction, this just means that Windows is following the same kind of negative path that Android is on.

But at least so far, I don't know of any banks that prohibit or cripple users' access if they are not running on a Windows device with Secure Boot, or if they are not using some kind of signed Linux software to connect with the bank.