this post was submitted on 04 Apr 2024
1018 points (98.8% liked)

linuxmemes

21047 readers
1639 users here now

Hint: :q!

Sister communities:

Community rules (click to expand)

1. Follow the site-wide rules

2. Be civil
  • Understand the difference between a joke and an insult.
  • Do not harrass or attack members of the community for any reason.
  • Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
  • Bigotry will not be tolerated.
  • These rules are somewhat loosened when the subject is a public figure. Still, do not attack their person or incite harrassment.
    • 3. Post Linux-related content
  • Including Unix and BSD.
  • Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of sudo in Windows.
  • No porn. Even if you watch it on a Linux machine.
    • 4. No recent reposts
  • Everybody uses Arch btw, can't quit Vim, and wants to interject for a moment. You can stop now.

    • Please report posts and comments that break these rules!

    founded 1 year ago
    MODERATORS
    [email protected]
    [email protected]
    [email protected]
    1018
    Why don't banks like root on Android? (lemmy.world)
    submitted 6 months ago by [email protected] to c/[email protected]
    188 comments fedilink hide all child comments
     
    you are viewing a single comment's thread
    view the rest of the comments
    [–] [email protected] 13 points 6 months ago

    SafetyNet is dead.

    They rely on Play Integrity API.

    That covers:

    App Binary signatures App source corroboration - Was it actually installed from the Play Store? Android device attestation - Is it a genuine device powered by Google Play Services Malware detection - Google Play Protect is enabled and has not seen known malware signatures.

    They can choose to ignore any number of those but they do not. It's part of their security reporting requirements to use attestation I expect.

    Beyond that - a device that doesn't meet Play Integrity is more likely to be a malicious actor than it is to be a tech enthusiast with a rooted phone: One of them is far more prevalent than the other in terms of device usage.

    Android apps are trivial to reverse engineer, inject code into and generally manipulate. That lets apps like ReVanced work the way they do... but that also means that blue team developers have a lot more work to do to protect app code.

    Source - Android App Developer, worked on apps with high level security audits (like banking apps).