points by yaro330 1 day ago | 0 comments
Nah SafetyNet offloaded a huge chunk of security on Android from app makers to Google/AOSP, it's an excellent system that works great for 99.99% of uses. It's what allows safe and fast banking on Android in general.
[–] SkiFire13 1 day ago
It's an excellent system that forbids up-to-date open source systems, but is completely ok with systems that are several years behind in security patches.
It's just a way for app makers to point their finger at someone else.
[–] yaro330 1 day ago
It's a system that allows even those old systems to still use banking reliably and securely, so yeah I'd say it's an excellent system. As far as GrapheneOS goes - now that they're partnered with Motorola they might actually get some certification, along with a proper security audit from Google. Not sure what the details of the supported functionality are gonna be there.
[–] SkiFire13 1 day ago
> It's a system that allows even those old systems to still use banking reliably and securely
No, Play Integrity labels those old systems as secure, _even though they are not secure_ due to lacking years of security patches.
Play Integrity does not prove that something is _secure_, only that the OS that is running _was approved by the phone maker_.
[–] yjftsjthsd-h 1 day ago
> It's a system that allows even those old systems to still use banking reliably and securely
This is the crux of your entire argument, so you kind of need to actually substantiate it. Does Play Integrity catch an app from to Play Store using an exploit against a comically ancient vendor kernel to do anything it wants? How?
An immutable OS install and app sandboxing by default provide a lot of security. Those are present on third-party Android distributions that don't pass SafetyNet. Some users of those add root access so they can let a handful of apps out of the sandbox, but I'm willing to bet most of those are tech experts with better security habits than the average person.
Show me examples of actual data breaches and account takeovers SafetyNet would have stopped if you really want to defend this position.