> Enforcing SafetyNet is probably also a net positive change
How so? How does SafetyNet make any end-user even slightly more secure?
back
1 comments
It does not. Enforcing SafetyNet only makes it harder for users to use custom ROMs. It provides no benefit whatsoever to the end user.
It does provide major benefits to app makers who hope to control the user's device.
I agree that DRM, and control is probably the main reason why they are doing this.
However, most people do not unlock their bootloaders and install custom ROMs.
For them having an unlockeded system is an indication of something "bad" happening (spying, fraud, theft) and given how central smartphones are becoming in users life, I prefer that my mothers banking app refuses to work if her smartphones chain of trust is compromised.
I also happen to believe that it is impossible to "out-tech" OEMs in the long run and that the path to a fair app ecosystem is through legislation, regulation and anti trust measures.
That approach worked in other aspects of the economy and society.
> For them having an unlockeded system is an indication of something "bad" happening (spying, fraud, theft) and given how central smartphones are becoming in users life, I prefer that my mothers banking app refuses to work if her smartphones chain of trust is compromised.
In real life, the main security issue on smartphones right now is dubious quality stock ROMs and checking the bootloader won't help you with that.
The move should be in the opposite direction, it should be impossible for security reasons to query if the bootloader is unlocked or not from the device itself.
It doesn't matter whether your mother's banking app refuses to work. If her phone gets rooted, the attacker will replace it with an app that steals her credentials and then refuses to work. So even in that case, SafetyNet provides exactly zero security to the end user.
Before we enact new regulations in the hope of forcing corporations to build a 'fair' app ecosystem, I would argue step 1 is to repeal section anti-circumvention laws that give big tech one more stick to hit consumers with.