yashsingh1/xdaforums huggingface dataset:
[Magisk] intel_core_i7:
Google seems to be more actively trying to prevent modders from passing DEVICE since the STRONG passing accident (non TEE devices can pass, too).

It's quite sad to see all the effort to stop the minority of people who just want to enjoy using their devices to the fullest, e.g. changing PI mechanism pretty much everyday, making /system RO, blocking android/data and android/obb, and so on.

I stopped modding because they just aren't that beneficial for me anymore, for now what I wanted is just a modern phone with flagship specs with a headphone jack and microsd card slot (I have to thank Japanese manufacturers still making those till this day, I'm using one of those), but I always want to start modding whenever I have enough time and passion again, and looking at the effort the big corps are making, I don't even know if it's even worth it to even look at it in the future

Anyway, best wishes for all the xda and all other Android modders out there
[Magisk] pndwal:
Of course it's relevant... In your determination to coin new words you haven't understood that the end result would be totally different if they were working against us, much worse in fact... That's the point that @osm0sis was making and I agree with; Its like they're hardly trying and are in absolutely NO rush as I've often pointed out...

Nb. the point:

For us this means practically:

I've often made much the same point here...

Eg Google could have designed this thing with attestation to the Keymaster version a device uses or many other measurements already available in key pairs analysed... That way they could easily have thwarted all spoofing attempts and enforced STRONG_INTEGRITY verdicts for Android 8+ devices while exempting older devices reliably (with minimal collateral damage among customers which is really all that''s stopping them ATM).

DEVICE_INTEGRITY with HARDWARE_BACKED evaluationType s supposed to do much the same thing, but it's a complete gift to modders!... Why, years in and with a little ingenuity we can still bypass strong (hardware backed) attestations on all modern devices easily enough, and G didn't have to make it so easy...

... Where's your gratitude man! 😜

And at least the Golgafrinchians possess an ancient and mysterious history, rich in legend and a land of sweet and sultry air heady with the scent of the perfumed springs that trickle over its hot and dusty rocks and nourish the dark and musty lichens beneath; a land of fevered brows and intoxicated imaginings; a land also of cool and shaded thoughts; a land also of steel and blood and heroism; a land of the body and of the spirit... Re-reading their poetry is all that stops me dying of boredom frankly. Marvin.
[Magisk] awarexda:
It rather becomes a disappointing attempt, we happily are ready to pay with NFC to get this ridiculous red exclamation mark and become a ridicule in the eyes of the clerk. Of course, I am exaggerating now BUT recently this has become a serious nightmare so in essence we will revert to non-rooted ROM's with those disgusting ads showing everywhere, SKValex not being able to record both parties on BT connection etc.

End of an era as I see it :(
[Magisk] immortalwon:
Many will feel and do the same as you, as expected as we move toward the New World Order technocratic system. I am sure by now people are realizing it's not just conspiracy theories anymore as multiple prominent "politicians" have boldly stated this term a few times in the past half century.

Are we able to do things to prevent this as individuals? Probably not since it requires a large scale mass awakening. Most people, unfortunately, don't see a problem with Google and other tech companies big expansion of the security state.
[Magisk] rodken:
Although, Google could have incorporated attestation of the Keymaster version. There are likely some trade-offs involved in implementing such measures with the additional security measures that sometimes often come with increased complexity and potential compatibility issues.

Google may have weighed these factors and concluded that the current attestation mechanism, while not entirely foolproof, strikes a balance between security and practicality.

Not to mention that Google's ongoing research and development could or might lead to new attestation methods or even other techniques to better detect and prevent spoofing attempts.
[Magisk] pndwal:
None that I can see....

Well yeah... Or it does enough to satisfy concerned parties while not 'completely stopping' the modding community?...

Well they've done all this already... They just haven't used it in device integrity APIs; they're once again saying "here it is, you can do it yourself!":

https://developer.android.com/privacy-and-security/security-key-attestation

🤠 PW
[Magisk] HippoMan:
But my own point is that it's irrelevant to debate the Googlefrinchians' motives. The result will still be that we modders are going to end up getting shafted, whether they might actually be intending to screw us over or not. Perhaps their motives could have some effect the time frame, but the end result is very likely to be the same.

And these are the same Golgafrinchians who decided to defoliate most of the world's forests in order to increase the value of the leaves that they were using as currency.

And irrespective of their underlying motives, today's Googlefrinchians are focusing on continuing another hallowed Golgafrinchian tradition: telephone sanitization.
[Magisk] HippoMan:
Agreed.

Now that we've identified the Googlefrinchians as the enemy regarding this particular issue, we have to take appropriate defensive measures against them.

I'm not sure that closed source will be sufficient in more than the short term, but it's better than nothing.
[Magisk] pndwal:
Motive goes to the fact that Google could have 'shafted' modders themselves, but have instead built an attestation system where if strongly attested verdicts are available and said to the banks "here you go... you can switch it on anytime you like"...

However banks are well aware that the system is designed so that they are damned if they do and damned if they don't at least until now... Also, while DEVICE_INTEGRITY verdict should equally be properly enforceable on Android 8+ devices, it remains spoof-able in userspace; no obvious loopholes have been closed at all despite the tightening (which could just be regarded as posturing).

Yeah, the end game is inevitable... But motive does go to why Google hasn't done the dirty work themselves, and also why they've deigned to buy us so much time...

People have whinged about this for years now and railed against Google for this, but here we are still playing the game... 🤠 PW
[Magisk] V0latyle:
I'm not sure how much motive I would attribute to Google beyond trying to make Play Integrity a "guaranteed" attestation API. I don't think they're necessarily trying to stick it to us modders, but think of it this way: They make money on the products they market. If Play Integrity is known to be defeatible, no one is going to use it, ergo Google doesn't make money on it. So, in a purely business sense, I think it stands to reason that they're going to keep tinkering with it in an effort to ensure that PI returns a true verdict of hardware/software state, so as to make it more universally appealing to app developers.

That being said, as @pndwal has pointed out, why would they bother? We can't spoof STRONG_INTEGRITY, so any app developers who want to use that label can. That's the unbroken piece of this whole thing. But even Google themselves doesn't require this verdict. Maybe it's due to fragmentation - a lot of users are still running pre Android 8 - but nevertheless, Google apps don't require it.

Well...Maybe. I think you and I could definitely agree that some of their motives may indeed be ulterior, such as commitment to DEI initiatives and ESG scores...even though those universally result in loss of profit. But, that's politics, not really appropriate for this discussion.

I'm not sure what you're getting at, or what benefit they'd get from doing such a thing, beyond what I pointed out above - they'd probably like to corner the smart device market so that everyone is using their services, since that's a massive revenue source. As for "santitization" I'm not sure I'd agree in a technical sense; it's entirely possible they would want to extend the censorship they've already demonstrated on Alphabet-owned platforms across mobile devices, but that's not really a discussion appropriate for this forum.
[Magisk] espionage724:
Wait, people are flashing closed-source random stuff to try to bypass a thing that protects payment methods?

Google should absolutely try harder to prevent that. I'm for control over my device, but when an entire platform can be bypassed by random people on a forum, why would I as any kind of security-conscious person even allow such devices on my network or environment? It's not a good look for Google or Android, and if I were in a position to provision devices for a business it'd be iPhones across the board.
[Magisk] MikeZh:
if Google doesn't allow me to bypass this check, so I have to ask people in the forum :)

Google works harder to protect my privacy and gives me the opportunity to decide to share (or not) my contacts and location. But in case of my bootloader or ROM creators there is no privacy and anyone can obtain this information! Perfect!
[Magisk] V0latyle:
You're oversimplifying it. A Magisk module has no use outside of Magisk, and Magisk cannot be used without root. Root cannot be attained without an unlocked bootloader, and Google does not provide rooted software.

The understanding is, and always has been, that unlocking one's bootloader and modifying firmware, or using custom firmware, means one accepts the risks therein. Google has absolutely no stake in Magisk, nor any interest in controlling what Magisk users can or can't do with their devices. Their responsibility to ensure you have a safe platform ends when you choose to unlock your bootloader. You can be reasonably expected to understand the risks involved, and choosing to proceed means you bear full responsibility for what happens next. That includes what Magisk modules you choose to flash.
[Magisk] HippoMan:
Yes, the Googlefrinchians could have been a lot worse. Considering their erstwhile watchword, "Don't be evil", that's setting a pretty low bar, because I consider "evil" to be things like rape, murder, genocide, etc., and it's easy to avoid going that far. The same goes here: I'm glad that the Googlefrinchians didn't turn all their big guns on us modders, but even without that, we're screwed in the longer term.

And I've never avoided putting most of the blame for our troubles on the app developers, not the Googlefrinchians themselves. It's just that the latter are doing little more than throwing us a few crumbs while continuing to helpfully feed those devs as the modding famine approaches.

Of course, we can't blame any developers for the recent changes that keep getting instituted against PIF.
[Magisk] HippoMan:
Agreed.

And ideally, we should be allowed to take those risks without our devices being crippled by those who claim to be trying to "protect" us against ourselves.

Instead, as time goes on we're having to jump through more and more convoluted hoops in order to try to undo this "protection" that's being forced upon us when we willingly choose to take our risks.
[Magisk] V0latyle:
Again...What makes them money?

Think of the automotive industry. How many auto manufacturers out there try to make it easier for consumers to install aftermarket modifications? Zero. It doesn't make them any money. In fact many brands try to make it HARDER to modify vehicles, or at least void your warranty if you do. Case in point would be Volkswagen and ECU tuning. The 2.0 TSI engine they use in many of their cars is capable of a lot more power with factory hardware, but the factory ECU tune limits boost and ignition timing. Before tuners like APR figured out how to break the encryption to flash a custom tune, the ECU actually had to be physically opened. Even so, the ECU still has a fusible bit that will trip if a custom tune is flashed, which the dealer can read and deny warranty based on the tune alone, even if there are no hardware modifications.

The one exception to this is the APR Plus program - APR and VW have partnered to provide a "consumer safe" tune that doesn't void your warranty, except for any accelerated wear that may be caused by the additional power.

My point here is that software companies like Google have no financial incentive to throw modders a bone, because they make all their money from people using their services as intended.

We can, for the most part. Notice that Google branded devices have always been "developer friendly" - unlocking the bootloader has always been trivial.

Note that the only circumstances where this has not been true has been due to third parties - either device manufacturers such as Samsung, Asus, Xiaomi, etc, or carriers who resell these devices and require that the bootloaders be permanently locked. Android itself by nature is open source and Google plays no part in preventing users from unlocking their devices.

That being said, what we are actually talking about here is using Google proprietary services. Yes, Google markets devices such as Nexus/Pixel that can be easily unlocked, rooted, and modded. But Google Mobile Services and apps are another story altogether - that software is proprietary intellectual property, and why should they provide any sort of compromised version of their own software for our sake?
[Magisk] HippoMan:
Of course, this is simply because of what makes them money. Those who expect the Googlefrinchians to actually help them bypass rooting and modding restrictions are having a pipe dream.

That's why I say that we modders are screwed in the long run ... actually, not-so-long run.
[Magisk] HippoMan:
One thing that *could* be done (but I know it *won't* actually be done in this world in this lifetime) is for us to be able to officially opt out of security. We could sign something which states that we willingly take all responsibility for anything that happens if we mod our phone, and that we will never hold any developers, any banks, any businesses, nor any other entities responsible for any things which go amiss because of the use of our phone if our phone is modded.

And in this ideal world, if I have signed such an agreement and have a modded phone, I could temporarily opt in to all the normal anti-modding protections and then opt back out again whenever I want. In this case, I'd be the one to control how "safe" my device is.

In other words, if I sign such an agreement and someone is able to use the fact that my phone is modded to hack into my phone and utilize it for emptying my bank account, I wouldn't be able to take any action against Google, the bank, the devs of any software that was used in the hacking, nor anyone else who is involved.

Of course, all the folks in hell will be buying winter parkas before any such thing would actually be available to us.
[Magisk] xSnowLeopardx:
Winter parkas, nice one lol.

But yeah, I agree, on both things. Would be ideal, but it will either never happen or not in the foreseeable future.
[Magisk] V0latyle:
Well no, of course they aren't going to explicitly help, beyond making their own devices unlockable. Why would they help anyone bypass restrictions in their own apps? Because that's what we are talking about here. They haven't actively prevented anyone from unlocking, rooting, or modifying their devices, nor have they tried to lock Android itself down. The only efforts we've seen have been with OEMs who make it ridiculously difficult or impossible to unlock their bootloaders - which is actually contrary to the AOSP model - or with certain American carriers who request that devices they market NOT be unlockable. It remains true that non-carrier-specific devices purchased through most OEMs are still unlockable.

You're putting me in a weird spot here because I don't like Google as a company, but I don't think they're necessarily responsible for everything you're blaming them for.

Why?

They aren't doing anything that prevents us from unlocking, rooting, or modifying our devices.

What they ARE doing is reinforcing their proprietary software to try to prevent false attestation on "compromised" devices, in the interests of their customers who use their software services.

We have NEVER had any guarantee, nor should we, that proprietary software, even Google's, would still run properly on unlocked, rooted, and modified devices. We have intentially broken our hardware and software security states, so why should we expect anything that requires a certain degree of security to work properly?

That's like installing an aftermarket head unit in your car and complaining that OnStar doesn't work anymore.

Out of respect for others in this thread we should continue this conversation here:

[Discussion] Magisk - The root-hiding and mod-hiding cat-and-mouse game

We know that Google supports root per se, while at the same time, they are engaged in ongoing efforts to keep enhancing rooting-detection and modding-detection capabilities in order to make it easier for app developers to know when to cripple...

xdaforums.com
[Magisk] espionage724:
At some point it's just easier for me to take my wallet out and swipe a card :p
[Magisk] immortalwon:
At the end of the day, the security state will have absolute power. Read George Orwells 1984 book or brave new world by Huxley.
[Magisk] HippoMan:
That's what I do, also. I refuse to use any "banking" apps (except once in a while when I'm using them solely for testing software such as PIF).

Banks don't make us jump through crazy hoops in order to be able to use their bank cards to make purchases, and it's just as easy to steal my wallet as it is to steal my phone.

Of course, nowadays, apps for non-banking services such as McDonalds, Uber, Pokemon Go, and many others also check for rooting and modding, and they cripple themselves if that's detected. More and more we're going to be affected by this "we're protecting you against yourself" nonsense, even for non-financial uses of our devices.

It will be a brave new world.
[Magisk] V0latyle:
We did when we unlocked our bootloaders. We already accept all responsibility. At that point we are on our own, and no one is obligated to support us or allow us to continue to use their software.

What you're suggesting would essentially be a partnership between OEM firmware builders and the Magisk project. I don't think either of those would be interested in working with the other. Magisk has to remain free and open source, and John Wu has made it pretty clear that he's not going to use his position working on Android to benefit Magisk or vice versa.

K, but again, what you're essentially asking for is special treatment after the fact that you've ostensibily accepted responsibility for said eventualities when you unlocked and rooted your device.

As I've pointed out before, Android in its natural form is open source and developer friendly. Google has done nothing to prevent this and even provides semi-developer ready platforms with the Nexus/Pixel line. The only entities that HAVE prevented this are third parties - OEMs other than Google, or carriers who offer Google branded devices. As for individual app developers, you can try making this argument to them, but understand that most banks do not develop their own apps - they just provide a general template of what they want the app to do, what they want it to look like, what their security requirements are, and contract a third party developer to build the app for them. I can't say why they aren't interested in providing support for "power users" like you or me but it's probably in the same sort of thinking of why auto manufacturers won't provide warranty support when you modify your car.
[Magisk] HippoMan:
Yes, I know that the disclaimer we agree to when booting up our unlocked-bootloader devices only absolves the manufacturer of the device and its OS for any issues.

I realize that the impossibility of the case I'm describing is because it depends on the cooperation of various entities who are not cooperating nowadays in the real world.

Google *could* have designed their OS to tell those who query for integrity that the device is safe as long as the owner of the device would have signed the kind of agreement that I described above. Of course they didn't do that, and in our real world, they would be very unlikely to do that.

But I have libertarian dreams.

Another such libertarian dream which will never take place in the real world is this:

That the concept of medicine prescriptions goes out the window. Doctors can *recommend* medicines, and people could buy any of those medicines over the counter.

And in my idealized world, people would have to sign a waiver saying that they take full responsibility for the use of these medicines, and will never hold the doctors nor pharmacists responsible for anything which goes wrong after taking the medicines. If they don't sign such a waiver, then most doctors and pharmacists wouldn't bother dealing with them.
[Magisk] V0latyle:
Same, but as a libertarian I'm sure you can understand why they won't do this.

Certain things obviously can't be sold over the counter. As an example, when my wife was in labor with our daughter, the epidural injects fentanyl into her spine. I'm sure you understand why this can't be freely available.

I get the point you're trying to make though. I don't think this will happen, because we live in a litigous society where recommendations mean nothing and common sense isn't so common, so I think the banks etc are trying to protect themselves from litigation by making sure that we can't use their software on rooted devices, modders be damned.
[Magisk] HippoMan:
Even in the case of your wife, the same type of agreement could apply between the patient and the doctor or medical practitioner who is administering that kind of treatment.

But most people are not willing to go that far down the libertarian trail.

And yes, in our society, these kinds of ideas will go nowhere.

But I sometimes dream!
[Magisk] makeyourself:
Hardly anyone DOES seem to use it aside from Google themselves though! The large majority of banks use their own detection techniques. I wish they would all just use Play Integrity, would make it a lot simpler to bypass one form of detection than multiple ones, the fixes of which often conflict with Play Integrity fixes and vice-versa. I guess it's arguable that the reputation of Google Pay is enhanced by Play Integrity and of course Google must make lots of money from Google Pay alone, which requires the cooperation of lots of different financial institutions. And partly I guess Google may see it as part of the reputation of Android itself to be able to say "here we've got this almost unbreakable root-type detection on our OS that anyone can use".

Incidentally some banks don't even bother with any detection, none of which to my knowledge have suffered security breaches as a result. Which would seem to suggest to me that none of this crap is strictly technically necessary.
[Magisk] V0latyle:
True, because people seem to value a sense of security over liberty. You and I are outliers in this regard - we would prefer absolute freedom because we are confident in our ability to provide our own security, and we are willing to accept the risks.

Most people however would willingly give up more and more of their freedom so that Big Brother can make them feel safe, and I agree with you that corporations including Google are complicit in this regard. We'll give you a nice convenient safe world to live in, and in return we'll spy on you, censor you, track you, even limit who you can do business with.

And, unfortunately, despite the Founding Fathers designing our Republic for the intent of the former, the voting majority of our society is the latter, because for some reason everyone thinks that giving up your freedom means you can have a utopia.

Same, brother. Same.