[Magisk] micfogas:
I think that a lot of people who want to root their devices, especially their primary devices, don't quite understand security or the true risk of a rooted device in the hands of people who don't understand security.

The banking apps, etc, have root detection for a reason. They aren't trying to be dicks. They are trying to protect themselves and the user. Bob has a rooted phone. He's downloaded all these cool modules and lsposed and etc etc. If it's a module for magisk or lsposed, it MUST be safe, right?? 😬 so he's managed to get malware on his device which has modified and replaced a system app, because Google is the devil and we must not trust them! This system app malware can do all sorts of neat things thanks to its lsposed zygisk extension. Bob logs into his bank and maybe the module captures the POST URL or something. One day, Bob's login credentials don't work for his bank account. That's odd. Little does Bob know that he's transferred his money to multiple places which were transferred multiple places and then he bought crypto. Bob insists he didn't do this and opens a claim with the bank. The bank has to investigate this deeply, they have to involve the authorities, they have to make a claim with their insurance, they have to reimburse Bob because clearly Bob didn't do it. Bob just cost the bank's insurance $10k, the bank has to pay whatever their arrangement is with the insurance, the personnel to do all the investigating and such, just to give Bob back the same amount he lost. Meanwhile Bob's money is out there and funded some blackhat or hack group who just bought 3 hookers and a ball of blow, and an RGB toilet. The entire thing. The tank, the seat, is entirely RGB. It even plays club music while you're ****ting.

Bob doesnt deserve his money back for being so careless. But the bank wouldn't know that he compromised his account by installing malware on his phone and basically handed someone access to his bank account.

Bob is also the guy that needs to ask 5 different questions to root his device because he doesn't understand it. He definitely doesn't understand the security risks. But he heard rooting is cool. He wanted to be cool and show off to his friends. Now some hooker is coked out on the other side of the world and getting railed by a goat because of Bob. Poor goat.

The warning message on Pixel devices that tell you that your phone is not secure and not to store sensitive material on your device, is very accurate. Your phone is not secure. I do always like having a rooted device though to have access to special toys while I'm out somewhere, or for when bugjaeger or droidetch or something isn't enough. But that device shouldn't be used for secure or sensitive operations until the data, system, vendor, persist partitions have been wiped and stock rom fully reflashed, then relocked. When possible, do a full repartitioning so nothing is left behind. Make sure to get a and b.

Bob is the reason these protections exist, and realistically, there aren't any apps that have those protections in them that should be used with active root anyway. I'm not going to make an exception for the edge case person who truly knows what they're doing because they aren't going to listen anyway. So if your app won't run because your device is rooted, you shouldn't be using it on a rooted device. Because security.

The key difference is that with the exception of APTs and zero days, getting control of your PC requires intentionally installing software and if antivirus detects malware, it's blocked. There's multiple levels of safeguards to stop it on a per-threat basis.

Android root, you're trusting the rom or the rootkit. Even magisk, lsposed .. we're trusting that they don't do something shady. Still, a module could, let's say, get compromised. We trust everything on GitHub because most people assume GitHub means it's safe. Even every honest dev could get their repo compromised and infected. You'd need active code auditors on every repo 24/7 to catch everything. And sometimes, that behavior is intended. PoCs and whatnot. Once you give something root access on your android device, thats basically it. It has root access. It can start its own process chains, modify files etc. And using default settings, you only had to authorize it the first time. Or not at all if you installed a module.

In short, windows PC admin is essentially like sudo. Except you don't have to run it as root. It'll ask you if it needs admin permissions. Which is safer than using sudo anyway. Because you don't know if something needs sudo unless you run it first and it fails. Windows also has active threat protection built in to keep most people safe from most threats. So even if you download malware and try to install it, your PC will catch it and say "nope!"

Android/Linux, if you are logged in as root, you can do literally everything. Including rm -rf / . Sudo is per command but still no protection. It figures if you're using sudo, you intend the command to be run as root so it does. Linux wasn't designed for idiotproofness. Android addresses that with it's security measures. Defeating those security measures enabled god mode on your device. Not a lot of rooters even know Linux cli, let alone the power of root. They don't understand the power they enable. Some precautions still exist to try to protect those people, and for example their bank, from themselves. An app running as root can do and access anything unless the app has some built in protections. But even those can be disabled by disassembling the app and rebuilding it, at the most extreme.