Great, the worst of both worlds.

JackGreenEarth@lemm.ee to Android@lemmy.world – 548 points –

I can't root my phone because I don't have an image for it (Moto G73) although I'd like to, but for some reason my banking app thinks it's rooted and refuses to work. This happened just after I updated it, it wasn't happening before.

Edit: I'm regretting not getting the Motorola Edge 40 Neo, which also costs £250, but is slightly better in multiple ways, and seems like it has better root support.

106

Fucking DRM.

This happens because "normie" Android devices has a proprietary shit called SafeNet Attestation API

SafetyNet is the old thing. It's all about Play Integrity now. Magisk & friends have already moved on to a new method of fingerprint spoofing.

More and more every day, I wish the Firefox Phone had survived.

Firefox had a phone? I wish Firefox would try again.

They did. It was a project initially called "Boot to Gecko," about a decade ago; and the idea was to make a Linux kernel OS so lightweight that you were running web apps as close to bare metal as possible. There were intended to be no binary apps, only web apps running on open standards; though that didn't necessarily carry through as originally intended.

I agree. I think it was before its time and would be a real boon today.

I can't remember much about it but I seem to remember that the actual hardware itself was very entry level which was part of the problem. It really would have done better to appeal to enthusiasts.

I get that it was marketed at third world countries, but I still think they would have done better had they had a western version with more up-to-date specs as well, if only to get the kind of market share that would encourage app developers.

Yeah, I read a retrospective written by one of the developers, and it sounds like they had the trouble that they could only get development partners for low-end devices (which kind of meant that they had to target developing countries) but they couldn't get companies like WhatsApp to make web apps that would run on Firefox OS (which meant that it was kind of a non-starter in those developing countries).

Couple that with some questionable priority decisions at the top of the project, and a major reshuffling of Mozilla's organizational aims near the end of the project, and it all just sort of fell apart. I do kind of wonder if it would have done better today, or maybe as a tablet or a Roku competitor.

It kinda did survive. KaiOS is forked from Firefox OS, though it's more designed for Kinda-Smart feature phones in developing countries.

Yeah, and that's cool, but it is significantly different from the original implementation (or at least the original idea) since it is a keypad-based device. You couldn't really flash it onto an Android handset, for instance, as I understand it.

Just FYI, rootkit malware does exist for phones

What is that and how does it relate to my issue?

Spyware that roots your phone.

Well how could it do it if I can't?

A lot of exploits exist to root a phone. Bad apps can abuse those exploits.

You don't actually need an image to root a phone, that's not what rooting is... It's just gaining full administrative privileges over the device

There are exploits out there either kept secret by malicious/proprietary parties, or not practical for consumer desires to get a proper rooted experience.

Pretty much the only method to fix it if you're affected that I can think of is to factory reset your phone with a manufacturer provided image, and even then it's not 100% guaranteed if the bootloader is compromised.

1 more...
1 more...

Did you unlock your bootloader? Some apps just scan for Google Play SafetyNet or in some other way to check whether you unlocked your bootloader or rooted and if they think you do they will vaguely state you are rooted.

Other's concern about your phone being infected are justified and I recommend you to try whether a dedicated root checking app thinks your phone is rooted. These usually don't lie.

Regarding your rooting situation I always rooted the lazy way. Renamed magisk.apk to magisk.zip, flashed it and it always worked for me. But I rooted only 2 phones in my life really and this is not the recommended method by magisk developer.

Does that really work? Because if that works and I can't find an image file, that's the only way. I can still factory reset it after it messes up my device, right?

Uodate: no, it doesn't

Device platform: arm64-v8a

  • Installing: 27.0 (27000)
  • Processing zip file ! No boot image found ! Process error ! Installation failed

Did you flash a custom ROM? Maybe it will work with a custom ROM.

EDIT: Your phone uses Mediatek processor, so it's not going to be well supported. I recommend you to stick to locked bootloader and just live with the phone as it is.

I've had a banking app think my phone was rooted before. Had to basically switch banks.

Online banking has always been a disaster.

I remember when I got a new phone and I could not figure out how I was supposed to get the banking app on my phone so I called the bank and they said oh you just have to remove the app from your old phone.

Weird but ok.

Thing is, what if I don't have the old phone what am I supposed to do then banking app people? The rep really couldn't get her head around the idea that the phone was in at the bottom of a lake.

Then I had to go through this carry-on where I had to send in all sorts of bits of info and then the video of me waving just so they let me install the app again. And that's on top of all of the other security the banking app already has.

Then I had to go through this carry-on where I had to send in all sorts of bits of info and then the video of me waving just so they let me install the app again.

That sounds good. Otherwise anyone could steal your bank account by saying "I lost my phone."

They would still need my password to sign in so really they're just adding unnecessary layers of complication but they're not actually adding any security since anyone who can know my password can fake all the other stuff as well.

Lineage OS user here, my banking app got an update a while ago that stopped trusting my finger scanner because I'm rooted. Luckily it still allows passwords or else that would be a deal breaker.

*Edit, now that I think about it I'm not even rooted, just an unlocked boot loader.

Is your system software fully updated?

Are you running a Beta version of the system software?

Adjacent topic... Do you use a credit union? Because fuuuuuuck banks.

My bank just merged with another and released a new app. Immediately when trying to log in it said that the app can't be used with developer mode enabled.

With developer mode enabled? I have that enabled, although my error message is about root. With a degoogled stock ROM, you have to have adb to backup system data, it's crazy your bank was blocking that.

I hate my bank and I was planning on switching. The next day I tried again and it worked fine. I'm still planning on switching though.

Credit unions are better but that doesnt mean their app will work on a rooted device
Source: My credit Union app doesnt work on my rooted devices 🙃

Nationwide is a building society, which I think is kind of similar.

For the unaware, here's a concise explanation of the difference from chatgpt:

Banks and credit unions both offer financial services, but there are key differences. Banks are for-profit institutions, owned by shareholders, while credit unions are nonprofit, owned by their members. Credit unions often offer higher interest rates on savings and lower loan rates, but banks typically have a broader range of services and more extensive ATM networks. Your choice may depend on priorities like fees, customer service, and community focus.

Stop using AI to 'explain' stuff which may or may not be accurate

I'll stop when people stop using Google for the same reason 😂. Nobodies lives will be harmed over this explanation, you may relax.

But Android is open source! Oh, until you actually do any fucking thing with it. Be gone, Google.

This happened to me once when I updated Android. The bank software had a check for a specific version and my version was higher so it thought I was running something weird. I had to wait for the bank to update the app to support the newest android version

maybe a stupid question: But doesn't android sandbox every app? If every app is running in a sandbox, it shouldn't be too hard to pretend your phone isn't rooted.

If they check for a specific version number, like @RagingRobot mentioned, it also shouldn't be a problem. Just set that specific sandbox to return whatever version you want.

I am aware that 'just configure the sandbox' is not really an accessible solution. But a sandbox-config-master would be a great app for rooted phones.

Well apparently rooted phones can pretend to apps they're not rooted. Problem is, my phone isn't actually rooted.

Turn developer options off.

Do it, my local government app at least had the decency to explain it was the developer mode being on and not root.

I use developer options on a regular basis, so that won't be a permanent solution, but I could test to see if it is that.

Install TB Checker and use the various detection modes to figure out what the bank app might be picking up on.

They check for a lot of (dumb) things instead of just checking for Play Integrity like they're supposed to. For example it might be detecting an app that could be using root, even if it's not, and assume that means you must be rooted, even though you're not. 🤷

8 known trackers, and won't open when I install it from Aurora. Yeah...

I have too many gripes with banks and how they handle digital interactions.

They're a bunch of dinosaurs, both in what they support and how they support it. They're also in a position where they feel like they can do what they want and you just have to suck it up.

And for the most part, they're right, because all the banks are equally bad. A nontrivial number of the apps are just chrome running in an app window, security is a joke, they make you sign in with your card number which is plainly visible to anyone with eyes that is within a few meters of your card anytime you have it out of your wallet, they restrict your password so you can't use special characters or have it be long enough to actually provide real security, and they limit your 2FA options to SMS. Everything is terrible.

Even when you go into the bank or use the ATM, access is restricted by a fucking FOUR DIGIT NUMERICAL PIN and if you can even use a longer pin code, they don't tell you that and most systems assume your pin is four numbers and won't let you enter any more than that.

God forbid you lose your card, good luck going through the gauntlet of outdated information the bank is going to ask about for you to prove you are who you say you are.

They're all the fucking same and it infuriates me.

Banking tech is still run on FORTRAN and COBAL. It’s ancient and pretty much can’t be upgraded. Until there’s a major push for new technologies across all banking it’ll keep being this bad

They can create interfaces to buffer our experience with their back end (the COBOL running the actual transactions), which is largely what they're doing.

The COBOL back end basically just acts as the service that handles the data that represents the money and accounts.

Not having advanced security options, even as simple as complex passwords to allow clients to access their accounts can be managed by the intermediate layer between the COBOL service and the UI, and there shouldn't be a reason for such limited password length or restrictions on MFA.

The fact that COBOL runs they're back end doesn't excuse the terrible front end, especially on applications for mobile devices.

This has been thrown around as reason why things suck so hard, and bluntly, it's a piss poor excuse if you ask me.

Wasn't there talk about Google deprecating SafetyNet? If this has already happened and your banking app is still relying on it, it could lead to a fslse positive on the root check I believe.

Had the same problem with my banking app. Fortunately, mine was solved with a reboot.

Is it OEM unlocked?

Yes, but not rooted. I could relock it and see if that solves the issue, but the app was opening fine when it was still OEM unlocked for several months until the app was updated yesterday. I didn't want it locked in case I did ever find a custom ROM for my phone and I didn't want to delete all my data.

Pretty sure this is the reason then, OEM unlocks can trigger this on some devices.

If you've done an OEM unlock, you effectively already have root access to the device. You could boot a custom recovery right now and modify any system file.

"Rooting" just means using this privilege you already have in order to install a tool into the OS such that you can make use of this privilege while the regular OS is booted.

Go install Magisk and do the safetynet dance. It's a whole thing but should give you a "clean" device from the perspective of unprivileged apps. It's stupid that you have to do this but here we are.

Maybe not ideal but I'm sure the web version of your banking app would work through a browser.

It does, but it's not designed for mobile. I would send a screenshot, but I don't trust myself to censor everything important.

Try to use a desktop, try different browsers if needed, if you cannot, you may need to physically go to the bank.

That's a fair point. My old bank which was pretty terrible I never installed their app and found the app just loaded a mobile version of their website so I just used that.

The website also makes me log in with 3 random digits from a pass code and sms verification every time, as opposed to the fingerprint the app required, so it's definitely more of a pain. The website claims to have chat feature to get support, but I don't see it even when I disable ublock origin for the site.

How are you rooted?

Magisk Hide + Play Integrity Fix should fix it. Also hide all Google play services from detecting root.

magisk can hide root from apps

Yes, but only if I actually rooted it, which I didn't. I'd like to root it, but couldn't find any trustworthy image for my phone to patch.

theres usually twrp and from there you just need to install official magisk, no?

I have the magisk app, but I don't think TWRP works on the Motorola g73. Correct me if I'm wrong

thats a bummer. if its a newly released phone it might be a small while until someone compiles it for us.

Not so newly released, it came out last year in January. But it isn't super widely used, I guess.

I think there's magisk module that can bypass that but i forgot what's name
3 years ago i unlock bootloader + install custom ROM/Kernel in my mom phone (bc it's still running very ancient android) & install magisk after that i activate the module that can hide magisk presence (forgot what's name) so all e-banking & other payment apps work well

This might help:

https://www.youtube.com/watch?v=juKRQWzC8qM

Can't hide root if I'm not actually rooted.

Oh, sorry if you tried this already but you could also try resetting app data for that app and reloading to see if that helps?

Well, I tried uninstalling the app, restarting the device, and reinstalling it.

Shit, yeah that would wipe the app data too. Sorry buddy, I'm out of ideas. DRM is bullshit :(

Root so you can hide it?

Seriously though, that might actually work.

Either way, shit like this is why DRM is stupid.

If might work if I could work out how to root it. I can't find a stock image for my device to patch with magisk. Just out of interest, I wonder if there's one available for the edge 40 Neo, if I had got that. I don't have it, but if it supports root, I just might see if I can trade in my phone.

I haven't kept up with the rooting scene but if you want to get into that and are on a budget, a used Pixel might just be the ticket: They're very root friendly and well documented. Good luck!

The thing is, I need the device to support a micro SD card and have decent specs (8GB/256GB/120hz/5Ah) more than I need to be able to root it, but if I can get both I'd be very happy.

Sony Xperia has some nice stuff that might fit those requirements, pretty sure Moto makes at least once phone that meets those specs too but I can't recall the name off hand. Someone was just telling me about it last week and it was made in 2023. I'll let you know if I can remember the name of it.

Thanks, when you remember I'll be interested

Might be the Moto G Stylus I was thinking of, but even if it's not, that looks like it might fit what you're looking for

Would not recommend rooting anymore, as many apps that have a financial/banking/CC aspect will stop working. Like this one. Rooting used to serve great purposes & had no drawbacks; now there aren't many perks and many punishments. Even your Snapchat will refuse to work, probably because "you can use Snapchat to send & receive money". No one does, but that doesn't matter.

That sucks & I'm sorry. This (probably) wouldn't have helped with a banking app, which forces you to update frequently, but I do not update apps unless: they are buggy, there's an update I'd really like, or I am forced. Not all updates are good.

This is misinformation in the sense that with Magisk, Magiskhide and its denylist, I haven't seen an app that detects root. Everything works for me even though I'm rooted.

Not saying there aren't cases depending on phone and apps where it couldn't happen, but usually rooting is not a problem.

Oh that's fine, I'm glad it's working for you. I just remember I tried to put some form of Magisk on my rooted S8 Active & it was just a whole thing, I don't think I was successful. My financial stuff, my Samsung wallet, and even Snapchat didn't work.

Next phone & on, I thought about the reasons why I rooted in the first place. Enough of those reasons are resolved, or a non-issue now. I've turned into a more boring, regular adult that streams, surfs web, checks email, calls/texts. I've grown tired of jumping through hoops. 👍🏻 😴 Definitely miss making my battery last forever, though.