yashsingh1/xdaforums huggingface dataset:
[Magisk] majorfigjam:
Given Google's reported intentions with Wallet, and the possibility that a spoofed A8 or A8.1 Oreo fingerprint will no longer be enough, can anyone confirm that there are still working A9 prints that are usable with PIF or PIF fork modules?

No details needed!
[Magisk] osm0sis:
Yep, working ones remaining go from 5.0.2 to 12 last time we checked. But hopefully Wallet's version-gating will be unrelated to the fingerprint used and just check the actual ROM it's running on.
[Magisk] zgfg:
Currently using an A11 and A13 custom prints instead of Griffin (on my A13 phone).

There are good A9 and A10 prints, too

However, once G uplifts the requirements to A9 for Wallet, they could go further and start requesting Strong Integrity (and they will no more need to ban the prints)
[Magisk] mugendon:
I made an interesting observation:

My Pixel 7 was on the February update until yesterday (there were some problems with calling and thus I skipped some updates.). I used the Xiaomi pif (with integrity fork v6) that I got from PixelFlasher (so a motorola FP) after the first great purge this year (IIRC) and it worked fine. Then I flashed the May update yesterday and today my integrity check didn't work anymore after all those months.

Maybe you can fiddle something with that info.

I hope this is not old news, since I didn't read the last 300 pages of the thread beforehand.

Nothing to see here, it was just Magisk not having Zygisk after the update...
[Magisk] zgfg:
To be precise, that is not Xiaomi fingerprint - it is Motorola FP used for spoofing by Xiaomi.eu injector (Xiaomi.eu is custom ROM, and the name of the corresponding development group and their Forum)
[Magisk] majorfigjam:
Maybe try erasing playstore and play services data and cache, then try again. ( Unfortunately that may delete any wear os devices from your phone.). Also, update to PIF fork v8.

I messed up an earlier update on a Pixel 6 and had problems until I deleted Services data.
[Magisk] zgfg:
Those who know and will understand:

If you have custom <removed> A11 prints - please test does it still work for you.

I've been paying with on Sat, now it shows No Integrity (YASNAC still passes CTS Basic)

I just retested, all other custom prints that I have still work fine for me

---

Don't know what it was (?!) but that prints work now properly again for me
[Magisk] mugendon:
Yes, it is a Motorola FP but the button is called "get Xiaomi pif". Still I could have been more precise.

Edit: You were right: Magisk just couldn't enable Zygisk anymore after the update and thus the pif module of course wasn't active...

Sorry, after all I didn't find something interesting.
[Magisk] pndwal:
... For Pay/Wallet, devices w/o working Keymaster 3+ running A9 plus (assuming they don't bump STRONG requirement which I still think is very doubtful)... I think many LV sub A8 devices and many OnePlus models run A10 (eg Pixel has official A10) and may even have custom A13,14, no?

... Doubt Google intend to throw the switch themselves, but also doubt even banks will be willing to put the kibosh on A6.x and 7.x LV devices where customers are happily running A9 and 10 (or with OnePlus devices running A13) just yet... 🤠 PW
[Magisk] rodken:
I don't think that Google will explicitly block bootloader unlocking on all devices, but it does make it more difficult on some models as they will prioritize security measures like hardware attestation.

Some folks might believe that Google discourages unlocking to push users towards buying new devices instead of extending the life of their current ones and/or backup devices, but the argument might lean towards it could be a tactic to increase sales.

I'm not certain, but even with quantum computers, completely bypassing hardware attestation might be difficult.

At the end of the day, unlocking may or may not become more complex, but there's no guarantee it will be completely eliminated.
[Magisk] HippoMan:
Managing unlocked devices has already gotten annoyingly complex.
[Magisk] dlads:
If unlocking the bootloader and rooting became a thing of the past and android got locked down, I would have zero reason not to buy an apple phone.

That's my personally

The trade off with android is in efficiency, they've got to throw some serious hardware at the OS to get it anywhere close to iPhone, if the software ended up on an even playing field (both locked down) then I see no point staying with android..

Hopefully that never happens... Personally I don't think it will.
[Magisk] zgfg:
Vendors may also harden the options to unlock BLs. I remember when Huawei made it almost impossible to unlock BL (rooting Huawei phones was popular before that and before the Trump's tech ban, later extended by Biden's Administration) - after that Huawei went their own route by replacing GMS with HMS (running on their home-grown Kirins), etc. Now, very few users are interested in rooting Huawei phones (those who want that do not buy Huawei)

Now Xiaomi follows a similar path with devices released with HyperOS (A14+) - be aware that restrictions are mainly imposed by CN Govt, to force their users to use stock ROMs with the stock apps

Complications for Global users:

https://xdaforums.com/t/unlocking-bootloader-on-xiaomi-devices-with-hyperos-good-news.4654382/

and the barrier & hacking workaround for CN users (there are already intl buyers crying out who bought new Xiaomi phones from AliExpress or Temu and didn't pay attention):

https://xdaforums.com/t/how-to-unlock-bootloader-on-xiaomi-hyperos-all-devices.4654009/post-89311595
[Magisk] plsugg:
View attachment 6102650

Hi, Iwould like to know

If google wallet stopped adding credit cards,

I'm using modules

playintregrity fork and play curl.

I'm passing security checks

but when I go into my bank's app and click to add gpay wallet it loads and gives an error, try again.

This started almost a week ago and was normal

to add cards directly from the bank app,

I already changed my Google account

I already deleted the wallet app cache and nothing.
[Magisk] dlads:
Add your bank and wallet to the deny list in magisk, needs to have zygisk on too
[Magisk] Androiduser2390:
Anti root / anti bootloader unlock measures are NOT security features. They are designed to keep the user from not install custom ROMs as it would be bad for the phone manufactors as their sales would go down. What would happen if Microsoft removed the run as administrator button or forces "Secure Boot" to be undisable? Customers would be angry, but because Android has users who don't know anything about how computers work Google can just justify these measures as "protecting user security and privacy".
[Magisk] Androiduser2390:
Aren't those restrictions for Xiaomi on the Chinese models only because the CCP does not want people to install ROMs that get rid of their spyware inside Mainland China.
[Magisk] majorfigjam:
Seems like this message is being forgotten, yet again.

There are better places to discuss Google's (and others') motives.
[Magisk] pndwal:
Play Store already states A9 is required for Pay/Wallet (as of May 2)... My devices all say "works on your device" but all launched with A8+...

Anyone with PI DEVICE_INTEGRITY on a device launched with A7 or earlier, do you see "works on your device"?... 👍 PW
[Magisk] zgfg:
Yeah, I know why you state LAUNCHED with A9, but they don't state like that, they say on the Playstore:

...Required OS Android 9.and up

That's on two places (screenshots below)

And few lines above it still reads😁:

...Google Wallet is available on all Android phones (Lollipop 5.0+)

Btw, your devices were launched with A8+ (plus could even mean A14) - but what's your upgraded version you're running?
[Magisk] dlads:
Tbh it is all linked in some way..
[Magisk] pndwal:
🤔 Don't think I did... Said:

and

Yeah, of course... Like I said above:

... Obviously I think we needn't assume an API level above Android 8 (26) required means STRONG requirement will be bumped, but there's been some conjecture here and it seems some are panicking...

I mentioned Play Store already seems to require A9+ (from May 2), so if they are actually quietly bringing in STRONG_INTEGRITY prerequisite we should already be seeing LV A7 and less failing requirements to install (even if Wallet isn't disabled on devices till June 19)... I commented that my devices all launched with A8+ simply to make clear that I can't check this*, but asked if members "with PI DEVICE_INTEGRITY on a device launched with A7 or earlier" could check...

For those checking, the older device could be stock/locked or unlocked with working spoofs for DEVICE_INTEGRITY...

[*as you'll know, A8.0 introduced Keymaster 3 (added ID attestation), that version was also mandatory and (while key attestation arrived w/ A7.0/Keymaster 2) key attestation was used by default in DroidGuard to acquire SafetyNet measurements for all A8+ LV devices shipping with Google Play unless an exception caused a fallback to BASIC-only attestation due to bad OEM implementations]

...So guess they've bumped the Play Store requirement but haven't revised the "About App" text yet?...

Didn't mention cos it's irrelevant, but FYI have RN12-5g LV A12 MIUI, RV A14 HyperOS (not yet unlocked) and Mi Pad 4 LTE LV 8.1 MIUI, RV A11 unofficial LOS, rooted...

👍 PW
[Magisk] zgfg:
IMO it was relevant, if the latest Wallet (as stated) REQUIRES Android 9 or up, and you said that it worked on your device, so I wanted to check are you still below A9 or not - I thought that you still maybe have your old Mi 8 (wasn't it) that was launched with below A9, so I was interested can it work there. But yeah, I think you wrote once that the phone was gone

---

But users with below A9 cannot probably even update Wallet to our latest version (update requires A9 on Playstore), hence Wallet still works for them with the older versions.

But as G announced, they will block the older Wallet versions, and only the new Wallet versions will work, where users with below A9 won't be able to update the Wallet app - hence they will be pushed out of the game

Then, Wallet app (once installed) may go further with checking (?) things like Keymaster version, etc, and asking users to contact the G support if their devices are not ready. That way they will likely pave the road for mandatorying Strong Integrity in the future
[Magisk] beeshyams:
This is my concern... Once this checks are insidiously introduced, banks will be the next to fall in line. Already it's become tough to keep ahead of banks, especially if you have 2 or 3 of them, with some checking things like USB debugging enabled or boot loader state... Phew.. almost decided that my next device will be unrooted after a decade plus of rooted devices
[Magisk] pndwal:
Actually, just said Play Store says "Works on your device" for both, but I've never had it on Mi Pad 4... Perhaps it wasn't clear... Had RN8T previously, launched with A9 (as did all A-only SAR devices which were "Ramdisk=No" devices; you'll recall interesting discussions about B/L compatibility for ramdisk in boot) so even that device was very much in the HKA for DroidGuard camp... (Only said A8+ to indicate all my devices 'opportunistically' use HKA for DroidGuard anyway, not that any launched with A8.x.)

Stands to reason...

Personally, I doubt Google will resort to Key Attestation model to check Keymaster etc... I've previously mentioned that they could easily have done that for proper hardware backed evaluationType enforcement for DEVICE_INTEGRITY (rather than user-space based/spoofable props/fields but have refrained) and that banks have been equally slow on the uptake... I don't think Google wants to preempt this (thankfully) either... They'll continue to use their PI API because that's what they're spruiking (happily for modders), and will stalwartly rely on their (patently flawed) DEVICE_INTEGRITY verdict until the banks finally take Google's STRONG_INTEGRITY white elephant gift (that they asked for) down from the shelf (only once the critical mass of customers who would be disadvantaged is deemed to be sufficiently insignificant/expendable) in my opinion... Let's see...

Banks that don't use the alternative I've hinted at will just continue to harden their custom integrity tests simply because Google designed S/N and PI DEVICE_INTEGRITY to allow passing verdicts with purely user-space based signals... Until they can justify putting Google's the white elephant (see comment above) to work that is... Regarding the 'critical mass of customers who would be disadvantaged', this:

🙃 PW
[Magisk] V0latyle:
Completely false. Google devices have always been developer friendly. Google services on the other hand are proprietary.

Hardware attestation depends on the bootloader lock because the bootloader is responsible for verifying the partition images are genuine and untampered. Hardware attestation is only supported when the OEM key is used, because custom/self-signed keys cannot be verfied as authentic, genuine, or uncompromised.

The fact that hardware backed attestation depends on a locked bootloader with OEM key does not prevent the ability to unlock the bootloader. It is a prerequisite - if the bootloader is unlocked OR if the bootloader is locked on a custom key, hardware backed attestation is simply not available as boot integrity cannot be verified in a secure, trustworthy manner by Android Verified Boot. It is all working as designed. Google had always made their devices to be easily unlockable. It's a choice - either you can keep your bootloader lockd on the factory firmware, and enjoy hardware backed attestation, or you can unlock your bootloader (or relock it on a custom key) and bear the consequences thereof, including certain security features no longer working because you broke the chain of trust.

I think we should be really careful what sort of baseless accusations we make simply because we don't like something. Correlation does not equal causation, and while I definitely have issues with Google in terms of data privacy and attempting to shape the sociopolitical climate, I think their history thus far has proven that they are very developer friendly, at least as far as Android and devices are concerned.
[Magisk] plsugg:
already did that

Google Wallet hasn't added cards for a week

both directly entering the application

or in the option that the bank app offers

I have zygisk activated and the bank app is in the deny list and in the wallet

this still happens

I'm using Moto One

or g42

one has android 10 and the other has android 13

This started on May 2nd

I can't add any card to any bank's wallet.
[Magisk] zgfg:
In your yesterday post 14824 I see only YASNAC screenshot (SafetyNet test) - that doesn't matte (more precisely: that is not enough(, relevant is Play Integrity.

Sorry if I missed, but you must make sure that you pass Play Integrity (as in the name of this thread): Basic and Device Integrity

Did you test Play Integrity and what are your results?
[Magisk] plsugg:
OK

now that I tested the Play Integrity check api

and I'm not passing the last "Meets_strong_integrity" test

This module that I'm using "playcurl" to automatically change the fingerprint is already obsolete...

I have to search manually then correct?
[Magisk] Brouware:
Sorry for the noob question, but is there a chance the BASIC and DEVICE integrity can be passed with an unlocked bootloader in the future? From what I understand the thing that makes this module work is that it spoofs an older device that cannot pass the checks, but is allowed to pass because it can't do so legitimately. If I understand that correctly, there will probably be a time when it stops working.
[Magisk] zgfg:
From the Wallet perspective this should be ok, you cannot pass Strong with the unlocked BL, etc

What did you mean by update May 2 - Wallet 24.16.63013?

I have that latest Wallet, no Strong and NFC paying works fine (but frankly, I didn't try to add more cards)

Have you tried to clean Wallet Cache?

Generally, Wallet complains right away when opened if not meeting Security, but for adding the card it must also cooperate with the bank (like your banking app)
[Magisk] pndwal:
Yup... Why not?...

Nah... Devices that can pass both (but some spoofing would still be needed for DEVICE_INTEGTITY if unlocked, ie. Adjust sensitive props and hide root from DroidGuard process)... Generally the spoofed devices can't pass STRONG_INTEGRITY however...

Doubtful, but the time will certainly come when apps start requiring STRONG_INTEGRITY however, with much the same effect. 🙃 PW
[Magisk] plsugg:
Yes, I already cleared the cache

wallet and banking app

I've done everything and even reset the devices

I tested it on both phones

1 with Android 10 and the other with Android 12

moto one and motog42.

If you're going to take a test

It's best to do this with another card because you may not be able to add more.

This was after the May 2nd update

I just can't add any cards

I'm using

Magisk-Kitsune 27001(D)

zygisk activated

Ramdisk enabled

remembering that the bank application has not been updated.
[Magisk] zgfg:
Strictly speaking, what you asked is not related. Griffin prints (that you most likely use) are A11 prints. I tested yesterday and I still have 45 prints, A9 and above that pass Device Integrity (Griffin being one of them)

However, Wallet will now require A9 or above. Latest version on Playstore already does (but you are not obligate to update and older versions still work)

In that context A9 means your real Android OS version - spoofed prints take effect once you test Play Integrity

However, when/if G blocks the older versions of Wallets, everybody will have to upgrade. Those who don't have A9 will not be able, and won't be able to use Wallet anymore

What would then be the next step, and when, who knows. But getting rid of users with the not modded but old phones, not applicable for Hardware attestation make them ready to start requiring Strong Integrity in the future

Till then, as long as they just require A9 for installing Wallet amd still allow only Device Integrity when using Wallet, and do not ban remaining custom prints passing Device Integrity, we are ok
[Magisk] Brouware:
So I'm probably right to be worried if I understand you correctly. Even if Google Wallet would never require the STRONG_INTEGRITY, the app will require later and later Android versions until this fix stops working, right? The same goes for any other app.
[Magisk] zgfg:
No, that's not what I wrote.

There are still A12 and A13 prints that pass Device Integrity and they cannot kick all of us who don't have A14 phones yet

But starting to require Strong Integrity sometime in the futute is another matter. And your phone can be A9, doesn't matter.

If/when they would require Strong Integrity, you could trash the prints passing Device Integrity. When attesting Strong, it goes on TEE and your spoofed prints are NOT USED at all
[Magisk] Brouware:
I'm sorry, I have a hard time wrapping my head around this stuff. I thought that only prints from devices that launched before Android 8 could be used. Those devices do not get new Android versions forever, so that's why I thought that at some point apps will require an Android version that those devices never received.
[Magisk] zgfg:
Since I have couple of cards that I don't pay with them (not even by plastic, eg, credit card to my name but paying off my wife's account), I just tested and successfully added one more card

From my mobile banking app I chose a card, pressed on Add to GPay (literally, although it's Wallet), scrolled though n pages of small prints and Confirmed

Then received push notification' that the card was successfully added to the Wallet. Accepted View in Wallet, it opened and indeed that new card was added there

Device Integrity (not Strong) and the latest Wallet (just checked on Playstore)
[Magisk] osm0sis:
Until they do it we're not going to know how they'll do it.

It could just be blocked for download in the Play Store (so sideloading the correct Play Services and Wallet app could still be a possibility), or it could be blocked from opening in-app via those as well, or it could even block at attestation time using the print info since they showed us they could do that when they tested RCS blocking the other month.

We won't know until we know, so there's no point freaking out and/or belaboring it all right now. We'll see what we can do when the time comes.
[Magisk] plsugg:
I understand... What model is your device? what name and version of magisk are you using? which module? I'm going to buy one like it, I can't, I tried everything... an error appears, try again I click try again and I don't get the push notification that the card has been added.
[Magisk] pndwal:
I saw you set a new Google account and only cleared cache... You'll probably need to clear Pay/Wallet data to force it to properly accept new details. May need to set stuff up again although current cards may be preserved... 👀 PW
[Magisk] Androiduser2390:
The bootloader unlock stays on Pixel phones, but Google is starting to enforce hardware attestation to cripple the functions of the phone.

Hardware attestation is just one example of how companies are beginning to lockdown devices to make it so you either have to buy a new phone or have a custom ROM with tons of apps not running to get a new secure operating system. It is pathetic to see that companies are treating a OEM Android Nougat as secure, yet it has not recieved patches in years while with a rooted Android 14 it is considered "insecure"

If these trends continue Android phones will become like iOS, where when you stop getting updates you can't install a custom ROM to update the phone.

The minimum android version requirements on apps will be going up much higher now since phones are starting to get stock updates for 7 years now.
[Magisk] trevtdogg:
no, just in the earlier days of fingerprint mining a useful starting point was to look for ROM's from devices launched with Android 8 or earlier. this is because none of those devices can use hardware attestation, so it helped in reducing the short list of prints to test.

passing fingerprints from android 6-13 have been found for a long time now, and even though 95% no longer work some of the remaining ones that do work are from a9 or above. griffin of course is the most obvious example of this (edit - or maybe not! see below discussion around android version of the griffin print).
[Magisk] majorfigjam:
Am I missing something? I thought the Griffin was 6.0.1.
[Magisk] ashish1989:
Still can not pass device integrity on my A8.1 device, I think there is no workaround for A8 to A9 devices to pass device integrity, still searching for solutions
[Magisk] pndwal:
Yup... Maybe he just meant 'example of passing fingerprints from android 6-13 found'... 🤠 PW
[Magisk] majorfigjam:
Maybe, but @zgfg also said a bit earlier:

"Strictly speaking, what you asked is not related. Griffin prints (that you most likely use) are A11 prints."

I guess it's not that important in the greater scheme of things.
[Magisk] trevtdogg:
yep, I was just assuming @zgfg was correct with their a11 statement.

I haven't bothered to check what griffin actually is...
[Magisk] pndwal:
Don't know how it could be... Moto Z was only updated to 8.0 according to GSM Arena, so could be 8.0 print... I'll check later (easy enough folks)... Motorola is great if really updated from A6.01 to A11 but! 🙂 PW
[Magisk] intel_core_i7:
Only Pixel devices. The Chromecast with Google TV is not that fortunate. If I want an unlockable Android TV device from Google I would have to buy an ADT, which is unavailable for average consumers.