[Magisk] pndwal:
Tech = Spy-Biz, HippoMan​

FWIW, I'm answering this here (might be the best place...):

Well, seems that's a popular option here, but it's also a highly subjective one...

And you're going to need to do better than that... Even if banks themselves didn't persue these initiatives (ostensibly to protect their interests / bottom line) they're being driven by many other powerful entities...

The Open Mobile Terminal Platform (OMTP) first defined TEE in their "Advanced Trusted Environment:OMTP TR1" standard around 2007, and for some 15 years Hardware implementations for a hardware isolation mechanism with a secure operating system running on top of this along with an associated "hardware root of trust" have been progressively adopted and implemented not just in/by mobile devices / ARM SOCs (TrustZone, first iterations in 2008, but not much further development/excited customer till 1012, and more), but also by Apple (Secure Enclave is a hardware feature found in most versions of iPhone, iPad, Mac, Apple TV, Apple Watch and HomePod), AMD (Platform Security Processor, PSP, 2013, and more), IBM (IBM Secure Service Container, 2017, and more),

Intel (Trusted Execution Technology / Management Engine, 2008 and more),

RISC-V SOCs (MultiZone™ Security Trusted Execution Environment, 2018, and more)...

The aim of tee on SOC is to to reduce the attack surface... Typical applications include DRM functionality for controlling the use of media (ie. media security) and preventing any unapproved use of a device (ie. device/data security)...

And it's not just banks who are interested in this; Service providers, mobile network operators (MNO), operating system developers, application developers, device manufacturers, platform providers and silicon vendors are the main stakeholders contributing to the standardization efforts around the TEE in SOC and implementation...

Banks are simply impatient as, at least in Android, secure TEE implementation for device security is un-developed, flawed, lagging, arguably broken even... unlike in iOS (iOS Secure Enclave) ... And that's a problem, not just for Google...

So banks do their own security checks... Simply because Android Verified Boot doesn't work for them... I mean attestation to it in the usable deviceIntegrity verdict can't be trusted... I mean it's hardly 'verified', is it?... It's 'chain of trust' can't be trusted because components can be spoofed so Verified Boot can't be trusted, and all because of TEE not being usefully implemented (ie. to allow detection of tampering with a runtime environment along with either a hardware based attestation to the device model or to a working implementation of keymaster for enforcing hardware evaluation type)... And it's not useful presently because the simple implementations of both SafetyNet evaluationType and Play Integrity strongIntegrity will necessarily fail all devices using Android 7 and below as well many OnePlus and other devices with broken keystore implementations if adopted (because attestation doesn't include the information in parentheses above) making this option largely impractical...

Don't expect that banks won't adopt PI strongIntegrity verdict use sooner or later however... they're only waiting for a certain critical mass of compliant devices (which only they will determine)... or for a better solution (read: more useful hardware based attestation to a trusted, non-tampered runtime environment)...

Moreover, the efforts banks are making in persuing their own detection of tampered runtime environments as an interim measure only highlights their own interest/ stake in TEE in SOC implementation of keystore/keymaster attestation for device security and standardization...

But as I've told you before, and as the above should make abundantly clear, TEE and other, especially hardware backed, means to detect tampered execution environments for an application developer's code are here to stay in mobile devices, and are arriving in PCs also... cos like banks, Google and iOS etc, Microsoft is doing the maths also...

https://www.microsoft.com/security/...for-windows-11-will-help-protect-hybrid-work/

https://www.hpe.com/us/en/insights/...with-trusted-execution-environments-2102.html

And Microsoft are already spruiking Windows 11 as a "Zero Trust" solution for PC advanced security needs...

https://www.microsoft.com/en-us/windows/business/windows-11-secured-core-computers

Anyway, as I see it, we are able to have a bit of fun beating the system, or really subverting mobile OS's security models only because these have been slow to implement proper / useful "zero trust" protections... The fun's sure to end sooner or later however cos we live in the real world!... And being real, you and I both know 'bank devs' will NEVER convince their bosses to abandon these advances either! (...ok, ok... advancement, regression, it's your call... or is it?... Who do we think we are???)...

Eh guys?

... The only way you'll get your wish is by cobbling together enough funds to buy the banks, Google, the SOC makers and the OEMs you love ... Then you'll have a fighting chance. 🙂...

Wish you luck... PW