For those of us with unlocked or rooted devices, I have some bad news to report. Some very, very bad news!!!
John Wu, @topjohnwu, the creator of Magisk, just confirmed that the current SafetyNet CTS Profile error issue is probably permanent, and that it's unlikely to be fixed anytime soon because Google has significantly strengthened SafetyNet. He's confirmed that Google is now utilizing hardware-backed cryptography, specifically hardware-level key attestation, leveraging the device CPU's Trusted Execution Environment (TEE) for additional security.
John Wu's Twitter Post on SafetyNet Failure Issue
If you know a little about cryptography, you will appreciate that, if properly implemented, hardware-backed cryptography is almost IMPOSSIBLE to break. This means that all of our previous SafetyNet fixes will now be obsolete since Google will now be rigorously checking the validity of the source of our cryptographic keys.
What is Android Keystore Key Attestation
Google is now verifying that the cryptographic keys it relies on to validate our devices are kept in a secure, hardware-backed keystore on each device, making key extraction near-impossible, and nullifying all our previous validation hacks. This will, for example, prevent spoofing of device certification (CTS Profile) as we currently do with our custom ROMs, and our devices will now appear in the Play Store app as "not certified."
What this means is that the unrestricted freedom we once enjoyed with our custom ROMs has now come to an end. It's easy for us hobbyists to feel victimized by Google, but we're not the target since we're a very small minority of the more than 2 billion Android users worldwide. The aim, instead, is to protect the security of the Android platform by restricting the activities of hackers and criminals who use rooted or otherwise-compromised Android devices to perpetrate their criminal activities.
Unfortunately, it's no longer business as usual. I don't know how this will end, but I don't see it ending well for us in the custom ROM community. To repeat John's final words of his twitter post, "Let's face it. Fun is over guys."
John Wu, @topjohnwu, the creator of Magisk, just confirmed that the current SafetyNet CTS Profile error issue is probably permanent, and that it's unlikely to be fixed anytime soon because Google has significantly strengthened SafetyNet. He's confirmed that Google is now utilizing hardware-backed cryptography, specifically hardware-level key attestation, leveraging the device CPU's Trusted Execution Environment (TEE) for additional security.
John Wu's Twitter Post on SafetyNet Failure Issue
If you know a little about cryptography, you will appreciate that, if properly implemented, hardware-backed cryptography is almost IMPOSSIBLE to break. This means that all of our previous SafetyNet fixes will now be obsolete since Google will now be rigorously checking the validity of the source of our cryptographic keys.
What is Android Keystore Key Attestation
Google is now verifying that the cryptographic keys it relies on to validate our devices are kept in a secure, hardware-backed keystore on each device, making key extraction near-impossible, and nullifying all our previous validation hacks. This will, for example, prevent spoofing of device certification (CTS Profile) as we currently do with our custom ROMs, and our devices will now appear in the Play Store app as "not certified."
What this means is that the unrestricted freedom we once enjoyed with our custom ROMs has now come to an end. It's easy for us hobbyists to feel victimized by Google, but we're not the target since we're a very small minority of the more than 2 billion Android users worldwide. The aim, instead, is to protect the security of the Android platform by restricting the activities of hackers and criminals who use rooted or otherwise-compromised Android devices to perpetrate their criminal activities.
Unfortunately, it's no longer business as usual. I don't know how this will end, but I don't see it ending well for us in the custom ROM community. To repeat John's final words of his twitter post, "Let's face it. Fun is over guys."
