Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Tragically, Google is gradually moving to hardware-backed attestation, which is nearly impossible to bypass in most cases: https://www.xda-developers.com/safetynet-hardware-attestatio...

SafetyNet is, of course, anti-user and unacceptable. Random developers on the Play Store have the audacity to demand that you use a Google-approved OS on your phone if you want to use their apps. But "Google-approved" just means "proprietary". For example, GrapheneOS is leaps and bounds more secure than any Samsung ROM, yet Samsung's ROMs are Google-approved, and GrapheneOS is not. Google also releases vanilla AOSP builds for Pixel phones without Google apps, but these are not "Google-approved" according to SafetyNet, either.

Besides, no corporation should get to influence what OS you choose to run on your device. As the user, you should make the decision whether to trust a custom OS or not on your own. That's how it works on PCs. You are warned of the risks at every stage of the process of installing a custom ROM, from the moment you enable "OEM unlocking" in developer settings. You're even greeted with a non-hideable warning to remind you that the OS is not OEM every bootup [1]. (I think this is good, by the way. It also protects those buying used phones, which is another silly argument I've heard in favor of SafetyNet. IMHO, if you continue using a phone that warns you every bootup that it's unsafe, you deserve to be hacked.)

Google says they're doing all this for the sake of user security, but I find it very suspicious that it also happens to make de-Googling your phone much harder (if you rely on apps that rely on SafetyNet, like most Android banking apps).

[1] https://source.android.com/security/images/boot_yellow1.png



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: