Pretty soon SN won't matter, google is deprecating it in favor of the Play Integrity API.
True...
Which can be spoofed to a degree. That is, until they start requiring hardware backed attestation on all devices, then it's game over.
But nothing has really changed with PI re. device integrity...
Whereas SafetyNet was simply a device integrity API, Play Integrity API adds Application integrity and Account details attestations to a revamped Device integrity attestation engine.
A strong device integrity verdict was available since evaluationType was added to the labels available from S/N... Banks now had the capacity to demand passing ctsProfileMatch in combination with evaluationType=HARDWARE_BACKED, BASIC, essentially the same as PI strongIntegrity pass...
None did that with S/N and nothing has since changed...
And why should root be considered a security risk?
Because it is!... As Shawn Willden said, 'it weakens Google's security model'...
Linux distros come with it enabled by default. Good luck doing any admin stuff on Linux without it. Android uses a Linux kernel, Linux filesystems, alot of other concepts from the open source community which have been around since Unix/Linux.
Yup... But Android is Linux adapted as a
mobile OS!... It has to complete again IOS in the secure mobile OS space, and it's already losing... Google are really being as good to us modders as they can afford to be while they play 'catch up'...
And yet, somehow, having root access on Linux is deemed ok, but on Android it's a no no. That's retarded, backward thinking.
No, Google support root... They
never said it's 'not ok'!
Really they've given you that cake (IOS never will) but have said their banking partners can decide if you can have the cherry they provide on top...
This is only right if you believe like Google that they have the right to determine that their code runs only in an unmodified trusted environment that's CTS/VTS compliant per the rules even OEMs must play by... Both unlocking and root break CTS/VTS compliance and we are already resorting to subterfuge (spoofing expected signals) to enjoy our cherries...
Keeping our moddable OS both competitive and viable in the eyes of app (including security centric ones) makers really is
good for this community long term... Samsung's Knox based 'enterprise' security enhancements are an example of an OEM trying to claw back market share already lost due to the perception of IOS as the only properly secured mobile OS...
Only if Google's chosen mobile OS can remain relevant in this arena will we continue to be able to have our cake and eat it to... Cherry or no cherry.
I'll tell you what it's really all about, it's about money and power.
Of course it is! Google is like any other big corporate player... It must make sink-or-swim decisions...
They want to control both the hardware and the software, so they put a taboo on anything the user can do to exercise more control.
Nah... They've made Android unlockable and rootable by design!... No need for a 'Jail Break' even... except where some OEMs excercise their
own right to block OEM unlocking...
When you buy the device, their mindset is that it's still theirs regardless.
Sorry, thought we were discussing Android... Who's mindset; Google's? The OEM's?...
In most instances both entities allow (and don't block) unlocking and rooting...
And don't even get me started on the locked/unlocked bootloader thing. Look at PCs, the concept is practically unheard of. If I want to install Linux alongside Windows, or replace it, I can. No bootloader unlocking BS. But if I want a custom ROM on an Android-powered device, unlocking is required. That's BS.
Nah... The concepts here are merging even if PC's are behind mobile OS's.
To install late windows you need to circumvent hardware TPM 2 requirements... And already you must disable Secure Boot in order to run Linux or even non compliant hardware!... And thankfully, as with Android/Google allowing running without AVB (Green state), Windows/Microsoft allow running without Secure Boot!

PW